AWS Bedrock API Key Phantom User Activity Outside Bedrock

  1[metadata]
  2creation_date = "2026/07/06"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/07/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies an Amazon Bedrock API key phantom user (an IAM user whose name starts with "BedrockAPIKey-") acting as the
 11caller of a non-Bedrock API request, such as IAM, STS, EC2, VPC, or KMS calls. These users are provisioned by AWS to back
 12a Bedrock bearer token and carry the AmazonBedrockLimitedAccess managed policy, which also grants IAM, VPC, and KMS
 13reconnaissance. A phantom user performing activity outside of Bedrock indicates its credentials are being used beyond
 14their intended scope, which is the privilege-escalation path realized: an attacker who created standard IAM access keys
 15for the phantom user is now using them for reconnaissance or lateral movement outside the Bedrock authentication boundary.
 16"""
 17false_positives = [
 18    """
 19    Automation or SDK tooling configured with a Bedrock API key may call non-Bedrock APIs for benign
 20    credential validation. Ubiquitous no-op STS identity calls (GetCallerIdentity, GetSessionToken, 
 21    GetAccessKeyInfo) are excluded; other non-Bedrock activity by a BedrockAPIKey-* principal — recon, 
 22    privilege escalation, lateral movement, or exfiltration — is unexpected for an inference-only key. 
 23    Confirm the key and source in "source.ip"/"user_agent.original" are sanctioned.
 24    """,
 25]
 26from = "now-30m"
 27index = ["logs-aws.cloudtrail-*"]
 28language = "kuery"
 29license = "Elastic License v2"
 30name = "AWS Bedrock API Key Phantom User Activity Outside Bedrock"
 31note = """## Triage and analysis
 32
 33### Investigating AWS Bedrock API Key Phantom User Activity Outside Bedrock
 34
 35Amazon Bedrock API key phantom users ("BedrockAPIKey-*") exist only to back a Bedrock bearer token and carry the AmazonBedrockLimitedAccess managed policy. That policy grants Bedrock control-plane actions plus IAM, VPC, and KMS reconnaissance, so if an attacker adds standard IAM access keys (or a console login) to the phantom user, those credentials can be used for reconnaissance and lateral movement well beyond Bedrock.
 36
 37This rule fires when a "BedrockAPIKey-*" user is the caller of an API request whose service is not Bedrock. Because the phantom user has no legitimate reason to act outside Bedrock, such activity is the privilege-escalation path realized.
 38
 39### Possible investigation steps
 40
 41- Review "aws.cloudtrail.user_identity.arn", "event.provider", and "event.action" to understand what non-Bedrock activity the phantom user performed.
 42- Inspect "source.ip"/"source.as.number" and "user_agent.original", and determine whether the phantom user holds IAM access keys or a login profile (the escalation pivot).
 43- Review the full sequence of the phantom user's actions for reconnaissance (IAM/EC2/STS enumeration) or attempts to access other resources.
 44- Correlate with the credential-addition event (CreateAccessKey/CreateLoginProfile on the same user).
 45
 46### False positive analysis
 47
 48- Phantom users are not meant to perform non-Bedrock activity, so this should be rare. Validate any intentional repurposing before excluding the identity.
 49
 50### Response and remediation
 51
 52- If unauthorized, disable and remove the phantom user's IAM access keys and login profile, and delete the phantom user after preserving forensic evidence.
 53- Review the account for resources the phantom user may have accessed or modified.
 54- Deploy an SCP denying "iam:CreateAccessKey" and "iam:CreateLoginProfile" on "arn:aws:iam::*:user/BedrockAPIKey-*" to prevent the pivot.
 55"""
 56references = [
 57    "https://www.beyondtrust.com/blog/entry/aws-bedrock-security-guide-api-keys-detection-response",
 58    "https://www.beyondtrust.com/blog/entry/aws-bedrock-security-api-keys",
 59    "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html",
 60]
 61risk_score = 73
 62rule_id = "56788ae8-794b-4ade-affd-534aa5c9e28d"
 63setup = "This rule requires AWS CloudTrail logs ingested via the Elastic AWS integration. See https://docs.elastic.co/integrations/aws/cloudtrail for setup details."
 64severity = "high"
 65tags = [
 66    "Domain: Cloud",
 67    "Domain: LLM",
 68    "Data Source: AWS",
 69    "Data Source: AWS CloudTrail",
 70    "Data Source: Amazon Web Services",
 71    "Data Source: AWS IAM",
 72    "Data Source: Amazon Bedrock",
 73    "Use Case: Threat Detection",
 74    "Tactic: Privilege Escalation",
 75    "Resources: Investigation Guide",
 76]
 77timestamp_override = "event.ingested"
 78type = "query"
 79
 80query = '''
 81data_stream.dataset: "aws.cloudtrail"
 82    and aws.cloudtrail.user_identity.type: "IAMUser"
 83    and user.name: BedrockAPIKey-*
 84    and not event.provider: (
 85        "bedrock.amazonaws.com" or "signin.amazonaws.com" or
 86        "agreement-marketplace.amazonaws.com" or "discovery-marketplace.amazonaws.com"
 87    )
 88    and not event.action: ("GetCallerIdentity" or "GetSessionToken" or "GetAccessKeyInfo")
 89'''
 90
 91[[rule.threat]]
 92framework = "MITRE ATT&CK"
 93[[rule.threat.technique]]
 94id = "T1078"
 95name = "Valid Accounts"
 96reference = "https://attack.mitre.org/techniques/T1078/"
 97[[rule.threat.technique.subtechnique]]
 98id = "T1078.004"
 99name = "Cloud Accounts"
100reference = "https://attack.mitre.org/techniques/T1078/004/"
101
102[rule.threat.tactic]
103id = "TA0004"
104name = "Privilege Escalation"
105reference = "https://attack.mitre.org/tactics/TA0004/"