LoFP / legitimate provisioning of bedrock agentcore resources by ci/cd pipelines or platform engineers. validate the caller identity against expected provisioning principals and verify the attached role is commensurate with the workload's documented requirements.

Techniques

• T1078
• T1098

Sample rules

AWS Bedrock AgentCore Resource Created with IAM Execution Role

• source: elastic
• technicques:
  • T1078
  • T1098

Description

Detects the creation of an AWS Bedrock AgentCore resource (code interpreter, agent runtime, browser, or harness) with an IAM execution role attached. When an attacker with iam:PassRole permission creates an AgentCore resource and attaches a privileged role, subsequent invocations inside that resource execute as the attached role — enabling privilege escalation to roles that trust bedrock-agentcore.amazonaws.com.

Detection logic

event.dataset: "aws.cloudtrail" and
  event.provider: "bedrock-agentcore.amazonaws.com" and
  event.action: (
    "CreateCodeInterpreter" or
    "CreateAgentRuntime" or
    "CreateBrowser" or
    "CreateHarness"
  ) and
  event.outcome: "success" and
  aws.cloudtrail.request_parameters: (*executionRoleArn* or *roleArn*) and
  not aws.cloudtrail.user_identity.invoked_by: ("bedrock-agentcore.amazonaws.com" or "cloudformation.amazonaws.com")