LoFP LoFP / prompts or completions that reference example or documentation keys (for example the aws sample access key ending in example) match the access-key pattern. review the matched value in \"gen_ai.prompt\" or \"gen_ai.completion\" and confirm whether it is a live credential before responding.

Techniques

Sample rules

AWS Bedrock Model Prompt or Completion Containing Credentials

Description

Identifies an Amazon Bedrock model invocation whose prompt or completion contains an AWS access key identifier (AKIA long-term or ASIA temporary/STS, followed by 16 characters), an Amazon Bedrock API key (ABSK bearer token), or a PEM private-key block. Credentials in the model input mean an application or user is sending secrets to the model, exposing them to invocation logging, the model provider, and prompt history; credentials in the model output mean the model is emitting secrets, which can result from training-data leakage, poisoned context, or a prompt-injection-driven exfiltration attempt. Either case is a credential-exposure event that warrants immediate rotation of the affected secret.

Detection logic

from logs-aws_bedrock.invocation-* metadata _id, _version, _index
| where event.action in ("ConverseStream", "Converse") AND 
   ( gen_ai.prompt rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*"""
    or gen_ai.completion rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*"""
    or gen_ai.prompt rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*"""
    or gen_ai.completion rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*"""
    or gen_ai.prompt rlike """.*ABSK[A-Za-z0-9+/=]{20}.*"""
    or gen_ai.completion rlike """.*ABSK[A-Za-z0-9+/=]{20}.*"""
    or gen_ai.prompt rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*"""
    or gen_ai.completion rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*"""
    or gen_ai.prompt rlike """.*github_pat_[A-Za-z0-9_]+.*"""
    or gen_ai.completion rlike """.*github_pat_[A-Za-z0-9_]+.*"""
    or gen_ai.prompt rlike """.*glpat-[A-Za-z0-9_\\-]+.*"""
    or gen_ai.completion rlike """.*glpat-[A-Za-z0-9_\\-]+.*""")
| keep _id, _version, _index, @timestamp, gen_ai.*, aws_bedrock.*, user.*, cloud.*, event.*