XM Cyber Maps Eight Attack Paths in AWS Bedrock

Article Details

Attack Vectors

• Redirect model invocation logs to an attacker-controlled S3 bucket using bedrock:PutModelInvocationLoggingConfiguration, exposing prompts.
• Delete S3 objects or CloudWatch log streams to remove evidence of activity.
• Read raw knowledge-base data from its underlying S3 source, bypassing the model.
• Retrieve and decrypt stored credentials for integrated services; the article says these could potentially enable lateral movement into Active Directory through SharePoint.
• Use knowledge-base credentials and network access to obtain vector-database endpoints and API keys, or use intercepted credentials to access AWS-native data stores.
• Modify or create agents, rewrite their prompts, or attach malicious action-group executors.
• Update an agent's Lambda function code or publish a Lambda layer to inject malicious code or dependencies into tool calls.
• Modify Bedrock Flows to route data through an attacker-controlled node, alter condition checks, or replace a flow's customer-managed encryption key.
• Weaken or delete Bedrock Guardrails, reducing or removing filtering controls.
• Modify managed prompt templates or select a poisoned prompt version to alter the behavior of agents and flows.

Defensive Notes

• Apply tight permission controls to Bedrock workloads and their integrations.
• Inventory AI workloads and the permissions attached to them.
• Map attack paths across cloud and on-premises environments.
• Maintain posture controls across every component in the Bedrock stack.