Attack Chain

1. Reconnaissance & Crafting: An attacker researches AWS Bedrock AgentCore capabilities and identifies potential weaknesses for prompt injection or data exfiltration. They craft a malicious prompt designed to access sensitive information.
2. Initial Access (Prompt Delivery): The attacker sends the crafted prompt to the Bedrock AgentCore runtime (e.g., via a web application frontend, API gateway, or direct InvokeAgentRuntime call).
3. Instruction Injection: The AgentCore runtime processes the prompt, which contains instructions referencing cloud instance metadata service IPs (e.g., 169.254.169.254, 169.254.170.2), specific metadata paths (/latest/meta-data, /security-credentials), explicit AWS access key names (aws_secret_access_key, aws_access_key_id), or a combination of "jailbreak" language (e.g., "ignore previous instructions", "developer mode") with intent to reveal system prompts, credentials, or exfiltrate data to an external URL.
4. Agent Processing & Potential Action: The agent attempts to interpret and act on the malicious instructions. If the agent is misconfigured, has code execution capabilities, or possesses network access to the specified endpoints, it might attempt to retrieve or generate the requested sensitive information.
5. Exfiltration (Conditional): If the agent complies with the malicious prompt and has outbound network access, it might send the harvested credentials, API keys, or other sensitive data to an attacker-controlled external endpoint (e.g., https://attacker.com/data).
6. Credential Acquisition & Abuse: The attacker receives the exfiltrated credentials or sensitive data, which can then be used to gain unauthorized access to AWS resources, escalate privileges, or conduct further attacks within the cloud environment.

Impact

Successful exploitation of an AWS Bedrock AgentCore through credential harvesting or data exfiltration can lead to severe consequences. Attackers can gain unauthorized access to AWS accounts and resources, potentially leading to data breaches, privilege escalation, resource modification or deletion, and financial losses due to unauthorized resource usage. The impact can extend across multiple services if the compromised credentials have broad permissions. Organizations using vulnerable agents could face significant reputational damage, regulatory fines, and disruption of critical business operations. Even if the agent refuses the request, the presence of such malicious prompts indicates targeted efforts to breach cloud security.

Recommendation

• Deploy the provided Sigma rule to your SIEM and monitor for alerts on suspicious prompts targeting AWS Bedrock AgentCore.
• Ensure aws_bedrock_agentcore.runtime_application_logs are enabled and ingested into your security monitoring platform to capture the necessary telemetry for this detection.
• Review the full prompt in aws.bedrock_agentcore.request_payload.prompt for any detected incidents to confirm intent.
• Identify the agent using aws.bedrock_agentcore.agent_name or aws.bedrock_agentcore.resource_arn and the session with aws.bedrock_agentcore.session_id to investigate surrounding prompts.
• Verify that AgentCore guardrails are configured to block instance-metadata and credential-exfiltration prompts.
• Ensure IMDSv2 is enforced, and agent execution roles are configured with the principle of least privilege, especially if the agent has code execution or outbound network access capabilities.