Defenders must differentiate between legitimate automated deployment pipelines, which typically utilize AssumedRole sessions, and interactive creation via human IAM identities. The creation of Bedrock agents by IAM users or the root account is a high-signal indicator of potential unauthorized activity, as production infrastructure is almost exclusively managed via service-linked roles. This threat is particularly concerning because the AI agent itself acts as a persistent command-and-control channel that can perform actions autonomously over extended periods without further interaction from the adversary.

Impact

Successful deployment of rogue Bedrock Agents grants attackers an autonomous capability to interact with cloud environments, potentially leading to unauthorized data exfiltration through Lambda-based action groups, lateral movement into internal services, and the establishment of a persistent, non-traditional C2 channel that is difficult to detect using standard network-based traffic analysis.

Recommendation

• Deploy detection logic to monitor 'CreateAgent' API calls originating from human IAM identities (IAMUser or Root).
• Restrict the 'bedrock:CreateAgent' permission to authorized CI/CD roles using IAM policies or Service Control Policies (SCPs).
• Audit existing Bedrock agent configurations, specifically reviewing the 'instruction' system prompt and the 'actionGroupExecutor' Lambda ARNs for anomalous or unauthorized code.
• Investigate 'PrepareAgent', 'CreateAgentAlias', and 'AssociateAgentKnowledgeBase' events following any detected agent creation to determine the scope of agent deployment.