Detection of Unauthorized Amazon Bedrock Foundation Model Access Attempts

This threat brief focuses on detecting unauthorized attempts to enable account-level access to Amazon Bedrock foundation models. Attackers who compromise AWS identities may attempt to enable model entitlements or agree to model EULAs to unlock expensive foundation models for malicious usage, a technique often referred to as LLMjacking. By monitoring for denied control-plane API calls, defenders can identify compromised or under-privileged principals performing boundary-testing. This activity is critical to intercept, as successfully enabling these entitlements provides the necessary persistence for subsequent model invocation and abuse. While access-denied errors can stem from benign permission gaps in CI/CD pipelines or new employee onboarding, recurring unauthorized requests from unexpected source IPs or user agents are strong indicators of potential malicious reconnaissance.

Impact

Successful exploitation of these Bedrock control-plane functions allows attackers to gain unauthorized access to LLM services, resulting in unauthorized costs, data exfiltration through model interaction, and potential abuse of generative AI capabilities. Organizations that do not monitor for these denied attempts risk missing the initial reconnaissance phase of an LLMjacking attack.

Recommendation

Prioritize the investigation of unauthorized Bedrock control-plane activity to identify compromised credentials before they are successfully used to unlock models.

• Deploy the detection rule provided below to your SIEM to monitor for 'AccessDenied' events on Bedrock configuration APIs.
• Establish a baseline for users and roles authorized to perform 'PutFoundationModelEntitlement', 'PutUseCaseForModelAccess', and 'CreateFoundationModelAgreement' actions.
• Use CloudTrail logs to correlate denied Bedrock attempts with other suspicious IAM activity, such as permission enumeration or credential creation.
• Implement IAM Service Control Policies (SCPs) to restrict Bedrock management capabilities to specific, hardened administrator roles.