there is no known legitimate workflow that adds iam access keys or console login profiles to a bedrock api key phantom user. any match should be investigated. confirm the actor in \"aws.cloudtrail.user_identity.arn\" and the target user in \"aws.cloudtrail.request_parameters\", and remove the credential if it was not expected.

Techniques

T1098

Sample rules

AWS IAM Credentials Added to a Bedrock API Key Phantom User

source: elastic
technicques:
- T1098

Description

Identifies standard IAM credentials being added to an Amazon Bedrock API key phantom user, whose user name starts with “BedrockAPIKey-”: either a long-term access key (CreateAccessKey) or a console password / login profile (CreateLoginProfile, UpdateLoginProfile). When a long-term Bedrock API key is generated through the AWS Console, AWS silently provisions a “BedrockAPIKey-” IAM user with the AmazonBedrockLimitedAccess managed policy. That user is intended only to back a Bedrock bearer token and should never hold standard programmatic keys or interactive console access. Adding either converts a Bedrock-scoped identity into general-purpose IAM credentials that inherit the policy’s Bedrock control-plane and IAM, VPC, and KMS reconnaissance permissions and that persist after the Bedrock API key is revoked. This is the privilege-escalation and persistence pivot documented for Bedrock API key phantom users, and there is no legitimate workflow that produces it.

Detection logic

FROM logs-aws.cloudtrail-* METADATA _id, _version, _index
| WHERE event.provider == "iam.amazonaws.com"
    AND event.action IN ("CreateAccessKey", "CreateLoginProfile", "UpdateLoginProfile")
    AND event.outcome == "success"
    AND user.target.name LIKE "BedrockAPIKey-*"
| KEEP _id, _version, _index, @timestamp, aws.*, cloud.*, event.*, source.*, user.*, user_agent.*