Attack Chain

1. An attacker compromises an Amazon Bedrock AgentCore's Code Interpreter microVM, likely by exploiting a string-filter bypass vulnerability within the sandbox environment.
2. The attacker abuses the compromised microVM's access to the instance metadata service (IMDS) to retrieve temporary AWS credentials for the AgentCore execution role.
3. The attacker successfully exfiltrates these temporary AWS credentials, associated with the AgentCore execution role, from the microVM sandbox.
4. The exfiltrated credentials are then used to make unauthorized AWS API calls to services outside the AgentCore's normal operational scope, such as sts:GetCallerIdentity, ec2:Describe*, or iam:List*/Get* for reconnaissance.
5. The attacker leverages these stolen credentials to attempt privilege escalation (e.g., sts:AssumeRole, iam:Put*/Attach*) or achieve lateral movement to other AWS resources and accounts.
6. The successful abuse results in unauthorized access to sensitive data, modification of AWS resources, or further deep compromise of the cloud environment.

Impact

The successful exfiltration and abuse of AWS Bedrock AgentCore execution role credentials can lead to significant unauthorized access within an organization's AWS environment. Attackers can perform extensive reconnaissance, gain elevated privileges, and move laterally across various AWS services. This allows them to access sensitive data, modify critical configurations, deploy additional malicious resources, or disrupt operations. The compromise can impact a wide range of AWS-dependent applications and services, leading to data breaches, service outages, and potential financial and reputational damage. The broad access afforded by assumed roles means that the blast radius of such an incident can be substantial, affecting multiple cloud accounts or entire organizational infrastructure.

Recommendation

• Deploy the Sigma rule "AWS Bedrock AgentCore Execution Role Used Outside Its Runtime" to your SIEM and tune for your environment to detect anomalous API calls.
• Review the aws.cloudtrail.user_identity.session_context.session_issuer.arn and event.provider fields for any triggered alerts and investigate the legitimacy of the activity.
• Restrict Bedrock AgentCore execution roles to the principle of least privilege, ensuring they only have access to necessary services and actions.
• Configure AWS Code Interpreter microVMs to use VPC network mode where possible and ensure the instance metadata service requires session tokens to mitigate credential exfiltration risks.
• If unauthorized activity is confirmed, immediately revoke the affected execution role's active sessions and rotate any associated secrets.
• Refer to the provided references from Sonrai Security and Palo Alto Networks Unit 42 for further details on string-filter bypasses and sandbox escapes.