LoFP LoFP / developer or documentation content that legitimately discusses the instance metadata service or aws key formats could match. review the prompt in \"aws.bedrock_agentcore.request_payload.prompt\" to confirm intent.

Techniques

Sample rules

AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata

Description

Identifies prompts sent to an Amazon Bedrock AgentCore runtime that attempt to harvest credentials or coerce the agent into exfiltrating data. The runtime application logs capture the caller-supplied prompt; this rule flags prompts that reference the cloud instance metadata service (169.254.169.254, the ECS task metadata address, or the “latest/meta-data” / “security-credentials” paths), prompts that name AWS access or secret keys directly, and prompt-injection or jailbreak language (“ignore previous instructions”, “developer mode”, “do anything now”) combined with intent to reveal secrets, system prompts, or send data to an external endpoint. Asking an agent to read instance metadata credentials or to exfiltrate secrets is rarely legitimate and indicates an attempt to weaponize the agent for credential theft, even when the model refuses the request.

Detection logic

from logs-aws_bedrock_agentcore.runtime_application_logs-* metadata _id, _version, _index
| eval Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower = to_lower(aws.bedrock_agentcore.request_payload.prompt)
| where aws.bedrock_agentcore.operation == "InvokeAgentRuntime" and (
    Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(169\.254\.169\.254|169\.254\.170\.2|/latest/meta-data|/latest/api/token|security-credentials).*"""
    or Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(aws_secret_access_key|aws_access_key_id|secret access key|access key id).*"""
    or (
        Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(ignore (all )?(your )?(previous|prior|above) instructions|disregard (your |the )?(previous |above )?instructions|developer mode|do anything now|jailbreak).*"""
        and Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(system prompt|reveal|exfiltrate|credential|secret|password|api key|token|send .* to https?://).*"""
    )
  )
| keep _id, _version, _index, @timestamp, aws.*, cloud.*, event.*