Elastic high stable kql

AWS Bedrock API Key Phantom User Activity Outside Bedrock

Identifies an Amazon Bedrock API key phantom user (an IAM user whose name starts with "BedrockAPIKey-") acting as the caller of a non-Bedrock API request, such as IAM, STS, EC2, VPC, or KMS calls. These users are provisioned by AWS to back a Bedrock bearer token and carry the AmazonBedrockLimitedAccess managed policy, which also grants IAM, VPC, and KMS reconnaissance. A phantom user performing activity outside of Bedrock indicates its credentials are being used beyond their intended scope, which is the privilege-escalation path realized: an attacker who created standard IAM access keys for the phantom user is now using them for reconnaissance or lateral movement outside the Bedrock authentication boundary.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and aws.cloudtrail.user_identity.type: "IAMUser"
    and user.name: BedrockAPIKey-*
    and not event.provider: (
        "bedrock.amazonaws.com" or "signin.amazonaws.com" or
        "agreement-marketplace.amazonaws.com" or "discovery-marketplace.amazonaws.com"
    )
    and not event.action: ("GetCallerIdentity" or "GetSessionToken" or "GetAccessKeyInfo")

False Positives

  • ⚠ Automation or SDK tooling configured with a Bedrock API key may call non-Bedrock APIs for benign credential validation. Ubiquitous no-op STS identity calls (GetCallerIdentity, GetSessionToken, GetAccessKeyInfo) are excluded; other non-Bedrock activity by a BedrockAPIKey-* principal — recon, privilege escalation, lateral movement, or exfiltration — is unexpected for an inference-only key. Confirm the key and source in "source.ip"/"user_agent.original" are sanctioned.

Field Validations

Loading…

Comments (0)

Loading comments...