Detection of Unauthorized AWS Bedrock Model Import and Deployment

Adversaries targeting cloud environments may attempt to gain persistence and influence machine learning pipelines by importing unauthorized model artifacts into AWS Bedrock. By utilizing Bedrock APIs such as CreateModelImportJob, CreateCustomModelDeployment, CreateMarketplaceModelEndpoint, or RegisterMarketplaceModelEndpoint, an attacker can introduce a backdoored or poisoned model into the organization's environment. Once deployed, these malicious models can be invoked by downstream applications, allowing the attacker to manipulate outputs, conduct data exfiltration, or maintain persistent unauthorized access. Defenders should monitor for these API calls to ensure all model onboarding aligns with approved internal training and validation pipelines, specifically verifying the provenance of S3-based artifacts and the authorization of the invoking principal.

Impact

Successful exploitation results in a supply-chain compromise where poisoned models are utilized for inference in production applications. This can lead to manipulated decision-making, unauthorized data processing, and potential persistent control over AI-driven workflows. Organizations are advised to audit all current Bedrock model imports and marketplace endpoints to verify their origin.

Recommendation

• Enable logging for CreateModelImportJob, CreateCustomModelDeployment, CreateMarketplaceModelEndpoint, and RegisterMarketplaceModelEndpoint via AWS CloudTrail to support the provided detection logic.
• Implement IAM policies that restrict the ability to register or import Bedrock models to verified MLOps service roles and CI/CD automation principals.
• Establish a formal review process for all S3 buckets acting as sources for model imports to ensure they reside in organization-controlled infrastructure.
• Deploy the provided detection logic to identify unauthorized or anomalous model onboarding activity.