LoFP / automation or sdk tooling configured with a bedrock api key may call non-bedrock apis for benign credential validation. ubiquitous no-op sts identity calls (getcalleridentity, getsessiontoken, getaccesskeyinfo) are excluded; other non-bedrock activity by a bedrockapikey-* principal — recon, privilege escalation, lateral movement, or exfiltration — is unexpected for an inference-only key. confirm the key and source in \"source.ip\"/\"user_agent.original\" are sanctioned.

Techniques

• T1078

Sample rules

AWS Bedrock API Key Phantom User Activity Outside Bedrock

• source: elastic
• technicques:
  • T1078

Description

Identifies an Amazon Bedrock API key phantom user (an IAM user whose name starts with “BedrockAPIKey-”) acting as the caller of a non-Bedrock API request, such as IAM, STS, EC2, VPC, or KMS calls. These users are provisioned by AWS to back a Bedrock bearer token and carry the AmazonBedrockLimitedAccess managed policy, which also grants IAM, VPC, and KMS reconnaissance. A phantom user performing activity outside of Bedrock indicates its credentials are being used beyond their intended scope, which is the privilege-escalation path realized: an attacker who created standard IAM access keys for the phantom user is now using them for reconnaissance or lateral movement outside the Bedrock authentication boundary.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and aws.cloudtrail.user_identity.type: "IAMUser"
    and user.name: BedrockAPIKey-*
    and not event.provider: (
        "bedrock.amazonaws.com" or "signin.amazonaws.com" or
        "agreement-marketplace.amazonaws.com" or "discovery-marketplace.amazonaws.com"
    )
    and not event.action: ("GetCallerIdentity" or "GetSessionToken" or "GetAccessKeyInfo")