AWS guide to CloudTrail investigation for multi-stage Bedrock attacks
This AWS security guide, part two of a series, details a complex multi-stage attack involving a web application vulnerability, IMDSv1 credential harvesting, and unauthorized Amazon Bedrock access. It showcases how threat actors chain techniques, pivoting from an EC2 instance to AI infrastructure across AWS Regions. The post provides investigation techniques and hardening steps for security teams using CloudTrail event evidence. It specifically outlines four key CloudTrail events that trace the attack progression.
- →Multi-stage attack scenario: SSRF to Bedrock misuse
- →Attack progression from web app exploit to Bedrock access
- →Investigating the attack with CloudTrail events
- →Essential CloudTrail fields for incident investigation
Notes (4) ›
- Multi-stage attack scenario: SSRF to Bedrock misuse
This guide explores a complex scenario where a web application vulnerability cascades into credential harvesting via IMDSv1 and unauthorized, multi-Region access to Amazon Bedrock services. It demonstrates how threat actors combine techniques to compromise AI infrastructure.
- Attack progression from web app exploit to Bedrock access
The attack unfolded in five stages: initial SSRF exploitation, IMDSv1 credential harvesting, permission testing with harvested credentials, service pivoting to Amazon Bedrock, and cross-Region activity. This progression highlights the chaining of techniques to achieve unauthorized access.
- Investigating the attack with CloudTrail events
The article walks through four key CloudTrail events that document the attack: a failed IAM CreateUser call, a successful console sign-in without MFA, Amazon Bedrock reconnaissance, and active model exploitation using the Converse API. Each event highlights critical log fields for forensic analysis.
- Essential CloudTrail fields for incident investigation
The guide emphasizes the importance of fields like `userIdentity` for attribution, tracing compromised credentials back to their source, and `readOnly` for understanding the intent behind an action (reconnaissance vs. modification). These fields are crucial for reconstructing the attack narrative.
https://aws.amazon.com/blogs/security/incident-response-guide-for-aws-cloudtrail-investigations-part-2/
Related releases
- Amazon S3 Adds PrivateLink Support for FIPS Endpoints AWS What's New ·
- SageMaker Unified Studio CI/CD adds notebook promotion and AI-assisted manifest generation AWS What's New ·
- Amazon EMR Trino Now Integrates with S3 Tables via Iceberg REST Endpoint AWS Big Data Blog ·
- AWS Tools for PowerShell Introduces S3 PowerShell Drive AWS Developer Tools Blog ·
- AWS Deadline Cloud now supports sharing render job bundles across teams AWS What's New ·
- AWS Backup Increases Amazon S3 Bucket Protection Limit AWS What's New ·