AWS Bedrock Model Prompt or Completion Containing Credentials

  1[metadata]
  2creation_date = "2026/07/08"
  3integration = ["aws_bedrock"]
  4maturity = "production"
  5updated_date = "2026/07/08"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies an Amazon Bedrock model invocation whose prompt or completion contains an AWS access key identifier
 11(AKIA long-term or ASIA temporary/STS, followed by 16 characters), an Amazon Bedrock API key (ABSK bearer token),
 12or a PEM private-key block. Credentials in the model input mean an
 13application or user is sending secrets to the model, exposing them to invocation logging, the model provider, and
 14prompt history; credentials in the model output mean the model is emitting secrets, which can result from
 15training-data leakage, poisoned context, or a prompt-injection-driven exfiltration attempt. Either case is a
 16credential-exposure event that warrants immediate rotation of the affected secret.
 17"""
 18false_positives = [
 19    """
 20    Prompts or completions that reference example or documentation keys (for example the AWS sample access key ending
 21    in EXAMPLE) match the access-key pattern. Review the matched value in "gen_ai.prompt" or "gen_ai.completion" and
 22    confirm whether it is a live credential before responding.
 23    """,
 24]
 25from = "now-60m"
 26interval = "10m"
 27language = "esql"
 28license = "Elastic License v2"
 29name = "AWS Bedrock Model Prompt or Completion Containing Credentials"
 30note = """## Triage and analysis
 31
 32### Investigating AWS Bedrock Model Prompt or Completion Containing Credentials
 33
 34Bedrock model invocation logging records the full request and response of each InvokeModel/Converse call. This rule scans the decoded prompt and completion for live-credential patterns: AWS access key IDs (AKIA/ASIA followed by 16 characters) and PEM private-key headers. A credential in the prompt indicates secrets are being sent to the model (and persisted in logs and, for hosted models, to the provider); a credential in the completion indicates the model returned a secret, which is a sign of training-data or context leakage or a successful prompt-injection exfiltration.
 35
 36### Possible investigation steps
 37
 38- Review the matched value in "gen_ai.prompt" and "gen_ai.completion" and confirm whether it is a live credential or an example/placeholder.
 39- Identify the caller in "user.id" and the model in "aws_bedrock.invocation.model_id", and determine which application generated the invocation.
 40- If the credential is in the completion, review the prompt for injection or data-exfiltration instructions and check the model's knowledge base or context sources.
 41- Determine the scope and privileges of the exposed credential to gauge impact.
 42
 43### False positive analysis
 44
 45- Example or documentation keys (such as the AWS EXAMPLE key) match the pattern. Confirm the value is a real credential before escalating.
 46
 47### Response and remediation
 48
 49- If the credential is live, rotate or deactivate it immediately and review CloudTrail for any use of it.
 50- Identify and fix the application path that placed the credential into the prompt, and add input/output filtering (such as a Bedrock guardrail with a sensitive-information policy) to prevent recurrence.
 51"""
 52references = [
 53    "https://www.beyondtrust.com/blog/entry/aws-bedrock-security-guide-api-keys-detection-response",
 54]
 55risk_score = 47
 56rule_id = "68521f99-9b4f-40ef-a4e7-4d74794852b2"
 57setup = "This rule requires Amazon Bedrock model invocation logs ingested via the Elastic AWS Bedrock integration, with text data delivery enabled in the Bedrock model-invocation-logging configuration."
 58severity = "medium"
 59tags = [
 60    "Domain: LLM",
 61    "Data Source: AWS Bedrock",
 62    "Data Source: Amazon Web Services",
 63    "Use Case: Threat Detection",
 64    "Mitre Atlas: LLM06",
 65    "Resources: Investigation Guide",
 66    "Tactic: Credential Access"
 67]
 68timestamp_override = "event.ingested"
 69type = "esql"
 70
 71query = '''
 72from logs-aws_bedrock.invocation-* metadata _id, _version, _index
 73| where event.action in ("ConverseStream", "Converse") AND 
 74   ( gen_ai.prompt rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*"""
 75    or gen_ai.completion rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*"""
 76    or gen_ai.prompt rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*"""
 77    or gen_ai.completion rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*"""
 78    or gen_ai.prompt rlike """.*ABSK[A-Za-z0-9+/=]{20}.*"""
 79    or gen_ai.completion rlike """.*ABSK[A-Za-z0-9+/=]{20}.*"""
 80    or gen_ai.prompt rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*"""
 81    or gen_ai.completion rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*"""
 82    or gen_ai.prompt rlike """.*github_pat_[A-Za-z0-9_]+.*"""
 83    or gen_ai.completion rlike """.*github_pat_[A-Za-z0-9_]+.*"""
 84    or gen_ai.prompt rlike """.*glpat-[A-Za-z0-9_\\-]+.*"""
 85    or gen_ai.completion rlike """.*glpat-[A-Za-z0-9_\\-]+.*""")
 86| keep _id, _version, _index, @timestamp, gen_ai.*, aws_bedrock.*, user.*, cloud.*, event.*
 87'''
 88
 89
 90[[rule.threat]]
 91framework = "MITRE ATT&CK"
 92[[rule.threat.technique]]
 93id = "T1552"
 94name = "Unsecured Credentials"
 95reference = "https://attack.mitre.org/techniques/T1552/"
 96
 97
 98[rule.threat.tactic]
 99id = "TA0006"
100name = "Credential Access"
101reference = "https://attack.mitre.org/tactics/TA0006/"