Amazon Bedrock: Unauthorized Model Inference (LLMjacking)

LLMjacking involves threat actors gaining unauthorized access to Amazon Bedrock through stolen AWS credentials. These actors often distribute access tokens across proxy networks or resell them, resulting in high-volume inference requests originating from a wide array of global IP addresses. This activity increases operational costs and leverages the compromised identity for unauthorized Generative AI consumption.

Impact

• Unauthorized financial expenditure due to excessive model inference calls.
• Potential leakage of proprietary information or data sent to models via compromised accounts.
• Risk of further account compromise if the principal has broader IAM permissions beyond Bedrock access.

Recommendation

• Monitor AWS CloudTrail management events for InvokeModel, InvokeModelWithResponseStream, Converse, and ConverseStream actions.
• Implement alerts for IAM principals or roles exhibiting activity from three or more unique countries and source IPs within a 4-hour window.
• Investigate principals flagged for this behavior by checking aws_cloudtrail.user_identity.access_key_id consistency across disparate geographic regions.
• Enforce Principle of Least Privilege for Bedrock access, ensuring service-linked roles are scoped to necessary regions and functions.
• Configure AWS Budgets to detect and trigger alerts on abnormal spend associated with Bedrock usage.