LoFP LoFP / automation that intentionally manages bedrock resources using an api key could match. confirm the principal in \"aws.cloudtrail.user_identity.arn\", the affected resource in \"aws.cloudtrail.request_parameters\", and whether the change was expected. known maintenance principals can be excluded after validation.

Techniques

Sample rules

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action

Description

Identifies an Amazon Bedrock API key (bearer token) being used to perform a destructive or anti-recovery control-plane action, such as deleting a guardrail, deleting a custom or imported model, removing provisioned throughput, or disabling model invocation logging. Bedrock API keys are bearer credentials intended for model invocation (InvokeModel, Converse); using one to delete Bedrock resources or disable logging is inconsistent with that purpose and is characteristic of LLMjacking or sabotage following key theft. Every Bedrock API key call is identifiable in CloudTrail by “additionalEventData.callWithBearerToken” being true. The rule matches regardless of outcome, because a destructive attempt via a bearer token is suspicious even when denied.

Detection logic

FROM logs-aws.cloudtrail-* METADATA _id, _version, _index
| WHERE event.provider == "bedrock.amazonaws.com"
    AND aws.cloudtrail.additional_eventdata RLIKE """.*callWithBearerToken=true.*"""
    AND event.action IN (
        "DeleteGuardrail",
        "DeleteModelInvocationLoggingConfiguration",
        "PutModelInvocationLoggingConfiguration",
        "DeleteImportedModel",
        "DeleteCustomModel",
        "DeleteModelCustomizationJob",
        "DeleteProvisionedModelThroughput",
        "DeleteMarketplaceModelEndpoint"
    )
| KEEP _id, _version, _index, @timestamp, aws.*, cloud.*, event.*, source.*, user.*, user_agent.*