AWS Bedrock API Key Phantom User Activity Outside Bedrock

  1[metadata]
  2creation_date = "2026/07/06"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies an Amazon Bedrock API key phantom user (an IAM user whose name starts with "BedrockAPIKey-") acting as the
 11caller of a non-Bedrock API request, such as IAM, STS, EC2, VPC, or KMS calls. These users are provisioned by AWS to
 12back a Bedrock bearer token and carry the AmazonBedrockLimitedAccess managed policy, which also grants IAM, VPC, and KMS
 13reconnaissance. A phantom user performing activity outside of Bedrock indicates its credentials are being used beyond
 14their intended scope, which is the privilege-escalation path realized: an attacker who created standard IAM access keys
 15for the phantom user is now using them for reconnaissance or lateral movement outside the Bedrock authentication
 16boundary.
 17"""
 18false_positives = [
 19    """
 20    Automation or SDK tooling configured with a Bedrock API key may call non-Bedrock APIs for benign credential
 21    validation. Ubiquitous no-op STS identity calls (GetCallerIdentity, GetSessionToken, GetAccessKeyInfo) are excluded;
 22    other non-Bedrock activity by a BedrockAPIKey-* principal — recon, privilege escalation, lateral movement, or
 23    exfiltration — is unexpected for an inference-only key. Confirm the key and source in
 24    "source.ip"/"user_agent.original" are sanctioned.
 25    """,
 26]
 27from = "now-30m"
 28index = ["logs-aws.cloudtrail-*"]
 29language = "kuery"
 30license = "Elastic License v2"
 31name = "AWS Bedrock API Key Phantom User Activity Outside Bedrock"
 32note = """## Triage and analysis
 33
 34### Investigating AWS Bedrock API Key Phantom User Activity Outside Bedrock
 35
 36Amazon Bedrock API key phantom users ("BedrockAPIKey-*") exist only to back a Bedrock bearer token and carry the AmazonBedrockLimitedAccess managed policy. That policy grants Bedrock control-plane actions plus IAM, VPC, and KMS reconnaissance, so if an attacker adds standard IAM access keys (or a console login) to the phantom user, those credentials can be used for reconnaissance and lateral movement well beyond Bedrock.
 37
 38This rule fires when a "BedrockAPIKey-*" user is the caller of an API request whose service is not Bedrock. Because the phantom user has no legitimate reason to act outside Bedrock, such activity is the privilege-escalation path realized.
 39
 40### Possible investigation steps
 41
 42- Review "aws.cloudtrail.user_identity.arn", "event.provider", and "event.action" to understand what non-Bedrock activity the phantom user performed.
 43- Inspect "source.ip"/"source.as.number" and "user_agent.original", and determine whether the phantom user holds IAM access keys or a login profile (the escalation pivot).
 44- Review the full sequence of the phantom user's actions for reconnaissance (IAM/EC2/STS enumeration) or attempts to access other resources.
 45- Correlate with the credential-addition event (CreateAccessKey/CreateLoginProfile on the same user).
 46
 47### False positive analysis
 48
 49- Phantom users are not meant to perform non-Bedrock activity, so this should be rare. Validate any intentional repurposing before excluding the identity.
 50
 51### Response and remediation
 52
 53- If unauthorized, disable and remove the phantom user's IAM access keys and login profile, and delete the phantom user after preserving forensic evidence.
 54- Review the account for resources the phantom user may have accessed or modified.
 55- Deploy an SCP denying "iam:CreateAccessKey" and "iam:CreateLoginProfile" on "arn:aws:iam::*:user/BedrockAPIKey-*" to prevent the pivot.
 56"""
 57references = [
 58    "https://www.beyondtrust.com/blog/entry/aws-bedrock-security-guide-api-keys-detection-response",
 59    "https://www.beyondtrust.com/blog/entry/aws-bedrock-security-api-keys",
 60    "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html",
 61]
 62risk_score = 73
 63rule_id = "56788ae8-794b-4ade-affd-534aa5c9e28d"
 64setup = "This rule requires AWS CloudTrail logs ingested via the Elastic AWS integration. See https://docs.elastic.co/integrations/aws/cloudtrail for setup details."
 65severity = "high"
 66tags = [
 67    "Domain: Cloud",
 68    "Domain: GenAI",
 69    "Data Source: AWS",
 70    "Data Source: AWS CloudTrail",
 71    "Data Source: Amazon Web Services",
 72    "Data Source: AWS IAM",
 73    "Data Source: AWS Bedrock",
 74    "Data Source: Amazon Bedrock",
 75    "Use Case: Threat Detection",
 76    "Tactic: Privilege Escalation",
 77    "Resources: Investigation Guide",
 78    "Noise: Medium",
 79    "Performance: Fast",
 80    "Profile: Recommended",
 81    "Threat: Unauthorized AI Usage",
 82    "Rule Type: Custom Query (KQL)",
 83    "Platform: AWS",
 84    "Service: AWS IAM",
 85    "Service: AWS Bedrock",
 86    "Mitre Atlas: AML.T0012",
 87    "Mitre Atlas: AML.T0055",
 88]
 89timestamp_override = "event.ingested"
 90type = "query"
 91
 92query = '''
 93data_stream.dataset: "aws.cloudtrail"
 94    and aws.cloudtrail.user_identity.type: "IAMUser"
 95    and user.name: BedrockAPIKey-*
 96    and not event.provider: (
 97        "bedrock.amazonaws.com" or "signin.amazonaws.com" or
 98        "agreement-marketplace.amazonaws.com" or "discovery-marketplace.amazonaws.com"
 99    )
100    and not event.action: ("GetCallerIdentity" or "GetSessionToken" or "GetAccessKeyInfo")
101'''
102
103
104[[rule.threat]]
105framework = "MITRE ATT&CK"
106[[rule.threat.technique]]
107id = "T1078"
108name = "Valid Accounts"
109reference = "https://attack.mitre.org/techniques/T1078/"
110[[rule.threat.technique.subtechnique]]
111id = "T1078.004"
112name = "Cloud Accounts"
113reference = "https://attack.mitre.org/techniques/T1078/004/"
114
115
116
117[rule.threat.tactic]
118id = "TA0004"
119name = "Privilege Escalation"
120reference = "https://attack.mitre.org/tactics/TA0004/"
121[[rule.threat_mappings]]
122framework = "MITRE ATLAS"
123version = "2026.08"
124[[rule.threat_mappings.threat]]
125framework = "MITRE ATLAS"
126[[rule.threat_mappings.threat.technique]]
127id = "AML.T0012"
128name = "Valid Accounts"
129reference = "https://atlas.mitre.org/techniques/AML.T0012/"
130
131
132[rule.threat_mappings.threat.tactic]
133id = "AML.TA0012"
134name = "Privilege Escalation"
135reference = "https://atlas.mitre.org/tactics/AML.TA0012/"
136[[rule.threat_mappings.threat]]
137framework = "MITRE ATLAS"
138[[rule.threat_mappings.threat.technique]]
139id = "AML.T0055"
140name = "Unsecured Credentials"
141reference = "https://atlas.mitre.org/techniques/AML.T0055/"
142
143
144[rule.threat_mappings.threat.tactic]
145id = "AML.TA0013"
146name = "Credential Access"
147reference = "https://atlas.mitre.org/tactics/AML.TA0013/"