LoFP / cloud or security administrators may legitimately delete or reconfigure bedrock model invocation logging during onboarding, log destination migrations, or compliance changes. verify whether the user identity, user agent, and source ip are expected to make this change. for putmodelinvocationloggingconfiguration, confirm that the destination s3 bucket or cloudwatch log group remains owned and monitored by your organization. known, planned changes can be exempted from this rule.

Techniques

• T1562

Sample rules

AWS Bedrock Model Invocation Logging Disabled or Modified

• source: elastic
• technicques:
  • T1562

Description

Detects when an AWS Bedrock model invocation logging configuration is deleted or overwritten via the DeleteModelInvocationLoggingConfiguration or PutModelInvocationLoggingConfiguration API calls. Model invocation logging is the source that feeds the logs-aws_bedrock.invocation-* dataset relied upon by all data-plane Bedrock detections. An adversary who has gained access to a Bedrock environment can blind defenders by deleting this configuration, or by using the Put API to redirect logs to an attacker-controlled or non-monitored S3 bucket or CloudWatch log group. Because this single control-plane action can neutralize the entire data-plane detection stack, it is a high-value evasion technique that should be validated against expected administrative change activity.

Detection logic

data_stream.dataset: "aws.cloudtrail" and
    event.provider: "bedrock.amazonaws.com" and
    event.action: ("DeleteModelInvocationLoggingConfiguration" or "PutModelInvocationLoggingConfiguration") and 
    event.outcome: "success"