AWS Bedrock AgentCore Privilege Escalation via IAM Role Assumption

AWS Bedrock AgentCore services, including code interpreters, agent runtimes, browser sessions, and harnesses, execute user-defined workloads within isolated MicroVM environments. A privilege escalation vector exists where an attacker possessing both iam:PassRole and bedrock-agentcore:Create* permissions can create these resources and explicitly attach a privileged IAM execution role. Once the resource is initialized, any code or session initiated within that environment assumes the identity of the attached role. This allows attackers to bypass their original permission boundaries, effectively inheriting the permissions of roles that trust bedrock-agentcore.amazonaws.com. Because standard CloudTrail management events do not capture the subsequent data-plane operations (e.g., code execution or session invocation), this activity often remains invisible to organizations that have not enabled specific data-plane logging.

Impact

Successful exploitation allows an attacker to escalate privileges to match the scope of an assigned IAM role. This can result in unauthorized access to sensitive data, modification of cloud infrastructure, or further lateral movement within an AWS environment. The technique affects organizations utilizing AWS Bedrock for AI/ML workloads where IAM roles are insufficiently scoped or where identity-based access controls are not strictly enforced on the provisioning of AgentCore resources.

Recommendation

• Enable data-plane logging for Bedrock AgentCore to ensure that post-creation session invocations are captured in logs.
• Implement strict IAM policies for iam:PassRole, ensuring that callers are restricted using iam:PassedToService conditions specifically limiting the roles that can be passed to Bedrock.
• Audit all CreateCodeInterpreter, CreateAgentRuntime, CreateBrowser, and CreateHarness events in CloudTrail to identify provisioning by non-standard users or roles.
• Revoke iam:PassRole permissions from non-privileged identities and rotate credentials for any roles that may have been compromised through unauthorized resource association.