AWS Bedrock GenAI Hardening

Scope bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream IAM permissions to specific model ARNs (e.g., arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-5-sonnet-20241022-v2:0). Never grant bedrock:InvokeModel with resource *. Use condition keys bedrock:ModelId and bedrock:InferenceProfileArn to restrict callers to approved model versions. Attach policies to roles, not IAM users. Wildcard resource grants allow a compromised role to pivot to any model — including expensive frontier models with larger capability profiles than the intended use case.

Remediation — AWS CLI

# AWS CLI v2 — enumerate available foundation models
aws bedrock list-foundation-models \
  --output json \
  --query 'modelSummaries[].{id:modelId,provider:providerName,status:modelLifecycle.status}'

# Simulate effective permissions for a role
aws iam simulate-principal-policy \
  --policy-source-arn "${ROLE_ARN}" \
  --action-names bedrock:InvokeModel \
  --resource-arns "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-5-sonnet-20241022-v2:0" \
  --query 'EvaluationResults[].{action:EvalActionName,decision:EvalDecision}'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
resource "aws_iam_policy" "bedrock_invoke_scoped" {
  name        = "bedrock-invoke-scoped"
  description = "Allow InvokeModel only on approved Bedrock model ARNs"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AllowScopedBedrockInvoke"
        Effect = "Allow"
        Action = [
          "bedrock:InvokeModel",
          "bedrock:InvokeModelWithResponseStream"
        ]
        Resource = [
          "arn:aws:bedrock:${var.region}::foundation-model/${var.allowed_model_id}"
        ]
        Condition = {
          StringEquals = {
            "bedrock:ModelId" = var.allowed_model_id
          }
        }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "bedrock_invoke_attachment" {
  role       = aws_iam_role.app_role.name
  policy_arn = aws_iam_policy.bedrock_invoke_scoped.arn
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Least-privilege IAM role allowing a single application to invoke a single Bedrock model.
Parameters:
  AppPrincipalArn:
    Type: String
  AllowedModelId:
    Type: String
    Default: anthropic.claude-3-5-sonnet-20241022-v2:0
Resources:
  BedrockInvokerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: bedrock-app-invoker
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Ref AppPrincipalArn
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Ref BedrockInvokeOnlyPolicy
  BedrockInvokeOnlyPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: bedrock-invoke-one-model
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - bedrock:InvokeModel
              - bedrock:InvokeModelWithResponseStream
            Resource: !Sub 'arn:aws:bedrock:${AWS::Region}::foundation-model/${AllowedModelId}'

Remediation — AWS CDK (TypeScript)

import * as cdk from 'aws-cdk-lib';
import { aws_iam as iam } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export interface BedrockInvokerProps extends cdk.StackProps {
  appPrincipalArn: string;
  allowedModelId: string;
}

export class BedrockInvokerStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: BedrockInvokerProps) {
    super(scope, id, props);

    const policy = new iam.ManagedPolicy(this, 'BedrockInvokeOneModel', {
      managedPolicyName: 'bedrock-invoke-one-model',
      statements: [
        new iam.PolicyStatement({
          actions: ['bedrock:InvokeModel', 'bedrock:InvokeModelWithResponseStream'],
          resources: [`arn:aws:bedrock:${this.region}::foundation-model/${props.allowedModelId}`],
        }),
      ],
    });

    new iam.Role(this, 'BedrockInvokerRole', {
      roleName: 'bedrock-app-invoker',
      assumedBy: new iam.ArnPrincipal(props.appPrincipalArn),
      managedPolicies: [policy],
    });
  }
}

Compliance mapping

fields @timestamp, eventName, requestParameters.userName, requestParameters.roleName, requestParameters.policyArn, requestParameters.policyDocument, userIdentity.arn
          | filter eventSource = "iam.amazonaws.com" and eventName in ["AttachUserPolicy","AttachRolePolicy","PutRolePolicy","PutUserPolicy"]
          | filter @message like /bedrock-runtime/ or @message like /"bedrock:\*"/ or @message like /BedrockFullAccess/
          | sort @timestamp desc
          | limit 50

Enable Bedrock Guardrails prompt attack detection policy. Prompt attack detection requires the Standard tier of Bedrock Guardrails. Basic tier does not include this capability. Verify your guardrail tier in the Bedrock console before relying on this control. Standard tier applies a separate ML classifier to detect jailbreak attempts, prompt injection, and prompt leakage before the prompt reaches the foundation model. This is DISTINCT from the content filter policy (aws-genai-02): prompt attack detection is an input-layer classification that identifies adversarial instructions attempting to override the system prompt, whereas the content filter moderates harm categories in outputs. Both must be configured — neither alone is sufficient.

Remediation — AWS CLI

# AWS CLI v2 — check if prompt attack detection is configured on a guardrail
aws bedrock get-guardrail \
  --guardrail-id "${GUARDRAIL_ID}" \
  --query "promptAttackConfig"

# Create a guardrail with prompt attack detection enabled (Standard tier)
# The tier must be STANDARD for prompt attack detection to be available
aws bedrock create-guardrail \
  --name "prod-guardrail" \
  --blocked-input-messaging "This input has been flagged and cannot be processed." \
  --blocked-outputs-messaging "This output has been filtered." \
  --prompt-attack-filter-strength HIGH

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# Note: prompt attack detection requires Bedrock Guardrails Standard tier.
# Verify the tier argument name against the Terraform Registry for hashicorp/aws
# at the version pinned in your configuration (~> 5.60.0 minimum recommended).
resource "aws_bedrock_guardrail" "prompt_attack" {
  name                      = var.guardrail_name
  blocked_input_messaging   = "This input has been flagged and cannot be processed."
  blocked_outputs_messaging = "This output has been filtered."

  prompt_attack_policy_config {
    filters_config {
      type             = "PROMPT_ATTACK"
      input_strength   = "HIGH"
    }
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Bedrock Guardrail with HIGH-strength PROMPT_ATTACK filter and minimal content baseline.
Resources:
  PromptAttackGuardrail:
    Type: AWS::Bedrock::Guardrail
    Properties:
      Name: prompt-attack-guardrail
      BlockedInputMessaging: Your input was blocked because it appears to attempt prompt injection.
      BlockedOutputsMessaging: The model response was blocked due to a guardrail violation.
      ContentPolicyConfig:
        FiltersConfig:
          - Type: PROMPT_ATTACK
            InputStrength: HIGH
            OutputStrength: NONE

Remediation — AWS CDK (TypeScript)

import * as cdk from 'aws-cdk-lib';
import { aws_bedrock as bedrock } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class PromptAttackGuardrailStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    new bedrock.CfnGuardrail(this, 'PromptAttackGuardrail', {
      name: 'prompt-attack-guardrail',
      blockedInputMessaging: 'Your input was blocked because it appears to attempt prompt injection.',
      blockedOutputsMessaging: 'The model response was blocked due to a guardrail violation.',
      contentPolicyConfig: {
        filtersConfig: [
          { type: 'PROMPT_ATTACK', inputStrength: 'HIGH', outputStrength: 'NONE' },
        ],
      },
    });
  }
}

Compliance mapping

fields @timestamp, eventName, requestParameters.guardrailIdentifier, requestParameters.name, requestParameters.contentPolicyConfig, userIdentity.arn
          | filter eventSource = "bedrock.amazonaws.com" and eventName in ["DeleteGuardrail","UpdateGuardrail","CreateGuardrail"]
          | filter @message like /PROMPT_ATTACK/ or eventName = "DeleteGuardrail"
          | sort @timestamp desc
          | limit 50

Scope Bedrock Agent action-group execution roles to the minimum required ARNs — no wildcard * in Resource for Lambda function invocations, S3 objects, or API Gateway endpoints. Each action group should have its own least-privileged IAM role. Bedrock Agents inherit the execution role's permissions during orchestration; an over-permissioned role enables an adversary who can inject into the agent's reasoning trace to trigger unintended tool calls across the full scope of the wildcard permission. See aws-iam-07 — permission boundaries for the permission boundary pattern that provides an additional containment layer for delegated roles.

Remediation — AWS CLI

# AWS CLI v2 — inspect Bedrock Agent action group configuration
aws bedrock-agent get-agent-action-group \
  --agent-id "${AGENT_ID}" \
  --agent-version "DRAFT" \
  --action-group-id "${AG_ID}" \
  --query "{name:actionGroupName,executor:actionGroupExecutor,state:actionGroupState}"

# Verify the execution role trust policy restricts to Bedrock Agent service principal
aws iam get-role \
  --role-name "${AGENT_EXECUTION_ROLE_NAME}" \
  --query "Role.AssumeRolePolicyDocument"

Remediation — Terraform

# Terraform AWS provider ~> 5.0
resource "aws_iam_role" "bedrock_agent_role" {
  name = "bedrock-agent-execution-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "bedrock.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy" "agent_lambda_scoped" {
  name = "agent-lambda-scoped"
  role = aws_iam_role.bedrock_agent_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["lambda:InvokeFunction"]
      Resource = [aws_lambda_function.action_group_handler.arn]
    }]
  })
}

resource "aws_bedrockagent_agent" "this" {
  agent_name              = var.agent_name
  agent_resource_role_arn = aws_iam_role.bedrock_agent_role.arn
  foundation_model        = var.foundation_model_id
  instruction             = var.agent_instruction
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Bedrock Agent execution role scoped to one agent ARN with no broad bedrock:* grants.
Parameters:
  AgentName:
    Type: String
  AllowedModelId:
    Type: String
Resources:
  AgentExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub 'bedrock-agent-${AgentName}-exec'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: bedrock.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub 'arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:agent/*'
      ManagedPolicyArns:
        - !Ref AgentExecPolicy
  AgentExecPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub 'bedrock-agent-${AgentName}-exec-policy'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: InvokeOneModel
            Effect: Allow
            Action: bedrock:InvokeModel
            Resource: !Sub 'arn:aws:bedrock:${AWS::Region}::foundation-model/${AllowedModelId}'

Remediation — AWS CDK (TypeScript)

import * as cdk from 'aws-cdk-lib';
import { aws_iam as iam } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export interface AgentRoleProps extends cdk.StackProps {
  agentName: string;
  allowedModelId: string;
}

export class AgentExecutionRoleStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: AgentRoleProps) {
    super(scope, id, props);

    const policy = new iam.ManagedPolicy(this, 'AgentExecPolicy', {
      managedPolicyName: `bedrock-agent-${props.agentName}-exec-policy`,
      statements: [
        new iam.PolicyStatement({
          sid: 'InvokeOneModel',
          actions: ['bedrock:InvokeModel'],
          resources: [`arn:aws:bedrock:${this.region}::foundation-model/${props.allowedModelId}`],
        }),
      ],
    });

    new iam.Role(this, 'AgentExecutionRole', {
      roleName: `bedrock-agent-${props.agentName}-exec`,
      assumedBy: new iam.ServicePrincipal('bedrock.amazonaws.com', {
        conditions: {
          StringEquals: { 'aws:SourceAccount': this.account },
          ArnLike: { 'aws:SourceArn': `arn:aws:bedrock:${this.region}:${this.account}:agent/*` },
        },
      }),
      managedPolicies: [policy],
    });
  }
}

Compliance mapping

fields @timestamp, eventName, requestParameters.agentId, requestParameters.agentName, requestParameters.agentResourceRoleArn, requestParameters.actionGroupExecutor, userIdentity.arn
          | filter eventSource = "bedrock-agent.amazonaws.com" and eventName in ["UpdateAgent","CreateAgent","UpdateActionGroup","CreateActionGroup"]
          | sort @timestamp desc
          | limit 50

Configure Bedrock Guardrails content filter policy with explicit harm-category thresholds for HATE, SEXUAL, VIOLENCE, INSULTS, MISCONDUCT, and PROMPT_ATTACK set to HIGH or MEDIUM for both input and output. Configure PII redaction using sensitive_information_policy_config with pii_entities_config per entity type (EMAIL → ANONYMIZE; AWS_ACCESS_KEY → BLOCK). This is a separate Guardrails configuration block from prompt attack detection (aws-genai-06): the content filter policy moderates harm categories in prompts and completions, whereas prompt attack detection is an input-layer classifier for adversarial injection patterns.

Audit — AWS CLI

# AWS CLI v2 — check content filter policy thresholds on a guardrail
aws bedrock get-guardrail \
  --guardrail-id "${GUARDRAIL_ID}" \
  --output json | jq '.contentPolicy'

# List all guardrails in the account to verify coverage
aws bedrock list-guardrails \
  --output json \
  --query 'guardrails[].{id:guardrailId,name:name,version:version,status:status}'

Remediation — Terraform

# Terraform AWS provider ~> 5.0 (min 5.60.0 for pii_entities_config input_action/output_action)
resource "aws_bedrock_guardrail" "this" {
  name                      = var.guardrail_name
  blocked_input_messaging   = "I cannot process that input."
  blocked_outputs_messaging = "I cannot provide that output."

  sensitive_information_policy_config {
    pii_entities_config {
      type          = "EMAIL"
      input_action  = "ANONYMIZE"
      output_action = "ANONYMIZE"
    }
    pii_entities_config {
      type          = "AWS_ACCESS_KEY"
      input_action  = "BLOCK"
      output_action = "BLOCK"
    }
    pii_entities_config {
      type          = "NAME"
      input_action  = "ANONYMIZE"
      output_action = "ANONYMIZE"
    }
  }

  content_policy_config {
    filters_config {
      type            = "HATE"
      input_strength  = "HIGH"
      output_strength = "HIGH"
    }
    filters_config {
      type            = "SEXUAL"
      input_strength  = "HIGH"
      output_strength = "HIGH"
    }
    filters_config {
      type            = "VIOLENCE"
      input_strength  = "HIGH"
      output_strength = "HIGH"
    }
    filters_config {
      type            = "INSULTS"
      input_strength  = "MEDIUM"
      output_strength = "HIGH"
    }
    filters_config {
      type            = "MISCONDUCT"
      input_strength  = "MEDIUM"
      output_strength = "HIGH"
    }
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Bedrock Guardrail enforcing HIGH-strength content filters on hate/insults/sexual/violence/misconduct.
Resources:
  ContentFilterGuardrail:
    Type: AWS::Bedrock::Guardrail
    Properties:
      Name: content-filter-guardrail
      BlockedInputMessaging: Your message was blocked by a content filter.
      BlockedOutputsMessaging: The model response was blocked by a content filter.
      ContentPolicyConfig:
        FiltersConfig:
          - Type: HATE
            InputStrength: HIGH
            OutputStrength: HIGH
          - Type: INSULTS
            InputStrength: HIGH
            OutputStrength: HIGH
          - Type: SEXUAL
            InputStrength: HIGH
            OutputStrength: HIGH
          - Type: VIOLENCE
            InputStrength: HIGH
            OutputStrength: HIGH
          - Type: MISCONDUCT
            InputStrength: HIGH
            OutputStrength: HIGH

Compliance mapping

fields @timestamp, eventName, requestParameters.guardrailIdentifier, requestParameters.contentPolicyConfig.filtersConfig, requestParameters.guardrailVersion, userIdentity.arn
          | filter eventSource = "bedrock.amazonaws.com" and eventName in ["UpdateGuardrail","DeleteGuardrailVersion","CreateGuardrailVersion"]
          | filter @message like /VIOLENCE/ or @message like /HATE/ or @message like /SEXUAL/ or @message like /MISCONDUCT/
          | sort @timestamp desc
          | limit 50

Create VPC Interface Endpoints for com.amazonaws.<region>.bedrock-runtime (inference) and com.amazonaws.<region>.bedrock (control plane) to route inference traffic through the AWS backbone, never traversing the public internet. Deny public Bedrock invocations via SCP using the aws:SourceVpc condition key to enforce that all bedrock:InvokeModel calls originate from within an approved VPC. Without this control, prompts, completions, and system prompts traverse corporate egress infrastructure where they may be logged, inspected, or intercepted. See aws-net-05 — VPC endpoints / PrivateLink for the general VPC endpoint pattern.

Remediation — AWS CLI

# AWS CLI v2 — check for existing Bedrock VPC endpoints
aws ec2 describe-vpc-endpoints \
  --filters "Name=service-name,Values=com.amazonaws.${REGION}.bedrock-runtime" \
            "Name=vpc-endpoint-type,Values=Interface" \
  --query 'VpcEndpoints[].{id:VpcEndpointId,vpc:VpcId,state:State,dns:DnsEntries[0].DnsName}'

# Verify both service names are available in the target region
aws ec2 describe-vpc-endpoint-services \
  --service-names \
    "com.amazonaws.${REGION}.bedrock-runtime" \
    "com.amazonaws.${REGION}.bedrock" \
  --query 'ServiceDetails[].{name:ServiceName,available:ServiceType[0].ServiceType}'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
resource "aws_vpc_endpoint" "bedrock_runtime" {
  vpc_id              = var.vpc_id
  service_name        = "com.amazonaws.${var.region}.bedrock-runtime"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = var.private_subnet_ids
  security_group_ids  = [aws_security_group.bedrock_endpoint_sg.id]
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "bedrock_control" {
  vpc_id              = var.vpc_id
  service_name        = "com.amazonaws.${var.region}.bedrock"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = var.private_subnet_ids
  security_group_ids  = [aws_security_group.bedrock_endpoint_sg.id]
  private_dns_enabled = true
}

resource "aws_security_group" "bedrock_endpoint_sg" {
  name        = "bedrock-endpoint-sg"
  description = "Allow HTTPS from application subnets to Bedrock VPC endpoints"
  vpc_id      = var.vpc_id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = var.app_subnet_cidrs
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: VPC interface endpoint for Bedrock Runtime, restricted to the application VPC.
Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
  SubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
  SecurityGroupId:
    Type: AWS::EC2::SecurityGroup::Id
Resources:
  BedrockRuntimeEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VpcId
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.bedrock-runtime'
      VpcEndpointType: Interface
      SubnetIds: !Ref SubnetIds
      SecurityGroupIds:
        - !Ref SecurityGroupId
      PrivateDnsEnabled: true

Compliance mapping

fields @timestamp, eventName, requestParameters.vpcEndpointId, requestParameters.serviceName, requestParameters.policyDocument, userIdentity.arn
          | filter eventSource = "ec2.amazonaws.com" and eventName in ["DeleteVpcEndpoints","ModifyVpcEndpoint","CreateVpcEndpoint"]
          | filter @message like /bedrock-runtime/ or @message like /com.amazonaws.[a-z0-9-]+\.bedrock/
          | sort @timestamp desc
          | limit 50

Enable Bedrock model invocation logging to CloudWatch Logs and/or S3 with KMS-CMK encryption. Configure minimum 90-day log retention. Invocation logging captures the full request metadata (model ID, input tokens, output tokens, latency) and optionally the prompt and completion text. Log the text content for audit purposes but apply PII redaction before storage — the Guardrails PII redaction layer (aws-genai-02) operates at inference time and is complementary to, not a replacement for, PII-aware log storage configuration. Use aws bedrock put-model-invocation-logging-configuration to enable; invocation logging is disabled by default and requires explicit activation per region.

Audit — AWS CLI

# AWS CLI v2 — check if model invocation logging is enabled
aws bedrock get-model-invocation-logging-configuration \
  --region us-east-1 \
  --query 'loggingConfig'

# Enable invocation logging (CloudWatch Logs + S3 with KMS-CMK)
aws bedrock put-model-invocation-logging-configuration \
  --logging-config '{
    "cloudWatchConfig": {
      "logGroupName": "/aws/bedrock/modelinvocations",
      "roleArn": "'"${LOGGING_ROLE_ARN}"'",
      "largeDataDeliveryS3Config": {
        "bucketName": "'"${LOG_BUCKET}"'",
        "keyPrefix": "bedrock/large-payloads/"
      }
    },
    "s3Config": {
      "bucketName": "'"${LOG_BUCKET}"'",
      "keyPrefix": "bedrock/invocations/"
    },
    "textDataDeliveryEnabled": true,
    "imageDataDeliveryEnabled": false,
    "embeddingDataDeliveryEnabled": false
  }'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
resource "aws_bedrock_model_invocation_logging_configuration" "this" {
  logging_config {
    cloud_watch_config {
      log_group_name = aws_cloudwatch_log_group.bedrock_invocations.name
      role_arn       = aws_iam_role.bedrock_logging_role.arn
    }
    s3_config {
      bucket_name = aws_s3_bucket.bedrock_logs.id
      key_prefix  = "bedrock/invocations/"
    }
    text_data_delivery_enabled  = true
    image_data_delivery_enabled = false
  }
}

resource "aws_cloudwatch_log_group" "bedrock_invocations" {
  name              = "/aws/bedrock/modelinvocations"
  retention_in_days = 90
  kms_key_id        = aws_kms_key.bedrock_logs_key.arn
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: CloudWatch log group capturing Bedrock model invocation logs (prompt + completion metadata).
Resources:
  BedrockInvocationLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/bedrock/invocation-logs
      RetentionInDays: 365

Compliance mapping

fields @timestamp, eventName, requestParameters.loggingConfig.cloudWatchConfig.logGroupName, requestParameters.loggingConfig.textDataDeliveryEnabled, requestParameters.loggingConfig.imageDataDeliveryEnabled, userIdentity.arn
          | filter eventSource = "bedrock.amazonaws.com" and eventName in ["PutModelInvocationLoggingConfiguration","DeleteModelInvocationLoggingConfiguration"]
          | sort @timestamp desc
          | limit 50

Enable CloudTrail data event recording for AWS::Bedrock::InvokeModel and AWS::Bedrock::InvokeAgent event types. Data events are not captured by default in CloudTrail management events — explicit configuration via put-event-selectors or advanced event selectors is required. CloudTrail data events provide API-level caller attribution (IAM principal ARN, source IP, user agent) for every model invocation, enabling forensic reconstruction of which identity invoked which model at what time. This control is complementary to invocation logging (aws-genai-04): data events provide control-plane caller attribution; invocation logging provides data-plane prompt and completion capture.

Remediation — AWS CLI

# AWS CLI v2 — enable CloudTrail data events for Bedrock InvokeModel
aws cloudtrail put-event-selectors \
  --trail-name "${TRAIL_NAME}" \
  --event-selectors '[
    {
      "ReadWriteType": "All",
      "DataResources": [
        {
          "Type": "AWS::Bedrock::InvokeModel",
          "Values": ["arn:aws:bedrock:*"]
        }
      ]
    }
  ]'

# Verify current event selector configuration
aws cloudtrail get-event-selectors \
  --trail-name "${TRAIL_NAME}" \
  --query 'EventSelectors[].DataResources'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
resource "aws_cloudtrail" "bedrock_data_events" {
  name                          = var.trail_name
  s3_bucket_name                = aws_s3_bucket.cloudtrail_logs.id
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  kms_key_id                    = aws_kms_key.cloudtrail_key.arn

  event_selector {
    read_write_type = "All"

    data_resource {
      type   = "AWS::Bedrock::InvokeModel"
      values = ["arn:aws:bedrock:*"]
    }
  }

  event_selector {
    read_write_type = "All"

    data_resource {
      type   = "AWS::Bedrock::InvokeAgent"
      values = ["arn:aws:bedrock:*"]
    }
  }
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Org CloudTrail trail capturing Bedrock InvokeModel and InvokeAgent data events.
Parameters:
  TrailBucketName:
    Type: String
Resources:
  BedrockDataEventsTrail:
    Type: AWS::CloudTrail::Trail
    Properties:
      TrailName: bedrock-data-events-trail
      S3BucketName: !Ref TrailBucketName
      IsLogging: true
      IsMultiRegionTrail: true
      IsOrganizationTrail: true
      AdvancedEventSelectors:
        - Name: Bedrock data events
          FieldSelectors:
            - Field: eventCategory
              Equals: [Data]
            - Field: resources.type
              Equals: [AWS::Bedrock::AgentAlias, AWS::Bedrock::KnowledgeBase]

Compliance mapping

fields @timestamp, eventName, requestParameters.trailName, requestParameters.advancedEventSelectors, requestParameters.eventSelectors, userIdentity.arn
          | filter eventSource = "cloudtrail.amazonaws.com" and eventName = "PutEventSelectors"
          | filter requestParameters.trailName like /-bedrock-/ or requestParameters.trailName like /-genai-/
          | sort @timestamp desc
          | limit 50

Secure Bedrock Knowledge Base data sources by: (1) enforcing VPC-only S3 bucket policies that deny non-VPC access using the aws:SourceVpc condition key; (2) configuring per-source ingestion-time PII filtering to redact sensitive data before it enters the vector store; (3) scoping the Bedrock Knowledge Base service role to only the specific S3 bucket prefix containing the knowledge base data, not the entire bucket. Prevent RAG poisoning by ensuring only authorized, change-controlled sources can be ingested into the vector store — an attacker with write access to the S3 source can inject malicious instructions that are embedded and retrieved on every subsequent RAG query.

Audit — AWS CLI

# AWS CLI v2 — inspect Knowledge Base data source configuration
aws bedrock-agent get-knowledge-base \
  --knowledge-base-id "${KB_ID}" \
  --query "{name:name,status:status,storageConfig:storageConfiguration}"

# Verify the S3 source bucket has VPC-only policy
aws s3api get-bucket-policy \
  --bucket "${KB_BUCKET}" \
  --query "Policy" | jq '.'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
resource "aws_bedrockagent_knowledge_base" "this" {
  name     = var.kb_name
  role_arn = aws_iam_role.kb_service_role.arn

  knowledge_base_configuration {
    type = "VECTOR"
    vector_knowledge_base_configuration {
      embedding_model_arn = var.embedding_model_arn
    }
  }

  storage_configuration {
    type = "OPENSEARCH_SERVERLESS"
    opensearch_serverless_configuration {
      collection_arn    = var.opensearch_collection_arn
      vector_index_name = var.vector_index_name
      field_mapping {
        vector_field   = "embedding"
        text_field     = "text"
        metadata_field = "metadata"
      }
    }
  }
}

# S3 bucket policy — deny non-VPC access to knowledge base source
resource "aws_s3_bucket_policy" "kb_source_vpc_only" {
  bucket = aws_s3_bucket.kb_source.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "DenyNonVPCAccess"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource  = [
          "${aws_s3_bucket.kb_source.arn}",
          "${aws_s3_bucket.kb_source.arn}/*"
        ]
        Condition = {
          StringNotEquals = {
            "aws:SourceVpc" = var.vpc_id
          }
        }
      }
    ]
  })
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Bedrock Knowledge Base service role with read-only access to a private OpenSearch Serverless collection.
Parameters:
  KbName:
    Type: String
  CollectionArn:
    Type: String
Resources:
  KbServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub 'bedrock-kb-${KbName}-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: bedrock.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Ref KbReadPolicy
  KbReadPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub 'bedrock-kb-${KbName}-read'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - aoss:APIAccessAll
            Resource: !Ref CollectionArn

Compliance mapping

fields @timestamp, eventName, requestParameters.knowledgeBaseId, requestParameters.roleArn, requestParameters.dataSourceConfiguration, userIdentity.arn
          | filter eventSource in ["bedrock.amazonaws.com","bedrock-agent.amazonaws.com"] and eventName in ["UpdateKnowledgeBase","CreateKnowledgeBase","UpdateDataSource","CreateDataSource"]
          | sort @timestamp desc
          | limit 50

Enforce Bedrock Guardrails at the AWS Organizations level by: (1) requiring Guardrail association on all InvokeModel calls via SCP using the bedrock:GuardrailIdentifier condition key; (2) denying bedrock:CreateGuardrail without required cost-allocation and environment tags; (3) using AWS Organizations delegated admin for Bedrock to centralize Guardrail management across member accounts. This is the cross-account enforcement layer that prevents member accounts from invoking models without a guardrail policy — per-account Guardrails must exist before this SCP can be applied. See aws-iam-08 — SCP deny-list for the general SCP authoring pattern.

Audit — AWS CLI

# AWS CLI v2 — list SCPs applied in the organization
aws organizations list-policies \
  --filter SERVICE_CONTROL_POLICY \
  --query 'Policies[].{id:Id,name:Name,awsManaged:AwsManaged}'

# Enumerate guardrails in the current account
aws bedrock list-guardrails \
  --output json \
  --query 'guardrails[].{id:guardrailId,name:name,status:status}'

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# SCP: deny bedrock:InvokeModel if no guardrail is specified
resource "aws_organizations_policy" "bedrock_require_guardrail" {
  name        = "bedrock-require-guardrail"
  description = "Deny Bedrock InvokeModel calls without an associated guardrail"
  type        = "SERVICE_CONTROL_POLICY"

  content = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "DenyBedrockInvokeWithoutGuardrail"
        Effect = "Deny"
        Action = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"]
        Resource = "*"
        Condition = {
          StringNotLike = {
            "bedrock:GuardrailIdentifier" = [
              "arn:aws:bedrock:*:${var.account_id}:guardrail/*"
            ]
          }
        }
      }
    ]
  })
}

resource "aws_organizations_policy_attachment" "bedrock_guardrail_attachment" {
  policy_id = aws_organizations_policy.bedrock_require_guardrail.id
  target_id = var.target_ou_id
}

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: SCP requiring every Bedrock InvokeModel call to carry a guardrailIdentifier (org-enforced).
Parameters:
  OrgRootId:
    Type: String
Resources:
  RequireGuardrailOnInvoke:
    Type: AWS::Organizations::Policy
    Properties:
      Name: require-bedrock-guardrail-on-invoke
      Type: SERVICE_CONTROL_POLICY
      TargetIds:
        - !Ref OrgRootId
      Content:
        Version: '2012-10-17'
        Statement:
          - Sid: DenyInvokeWithoutGuardrail
            Effect: Deny
            Action:
              - bedrock:InvokeModel
              - bedrock:InvokeModelWithResponseStream
            Resource: '*'
            Condition:
              'Null':
                bedrock:GuardrailIdentifier: 'true'

Compliance mapping

fields @timestamp, eventName, requestParameters.policyId, requestParameters.targetId, requestParameters.content, userIdentity.arn
          | filter eventSource = "organizations.amazonaws.com" and eventName in ["UpdatePolicy","DetachPolicy","DeletePolicy","AttachPolicy"]
          | filter @message like /bedrock/ or @message like /InvokeModel/
          | sort @timestamp desc
          | limit 50

Lock cross-region inference to approved geographic profiles by: (1) restricting which inference profiles are callable using the bedrock:InferenceProfileRegion IAM condition key in policies and SCPs; (2) denying bedrock:GetInferenceProfile on profile ARNs not in an explicit allow-list; (3) documenting the approved provisioned-throughput regions in your data-residency policy. AWS cross-region inference can automatically route requests to different AWS regions for capacity — without explicit allow-listing this routing can violate data-residency requirements by sending prompts and completions to unapproved geographic locations. This is especially relevant for GDPR, DPDPA, and similar data localisation regulations where prompt data constitutes personal data.

Audit — AWS CLI

# AWS CLI v2 — enumerate available system-defined cross-region inference profiles
aws bedrock list-inference-profiles \
  --type-equals SYSTEM_DEFINED \
  --query 'inferenceProfileSummaries[].{id:inferenceProfileId,name:inferenceProfileName,regions:models[].modelArn}'

# Inspect routing regions for a specific inference profile
aws bedrock get-inference-profile \
  --inference-profile-identifier "${PROFILE_ARN}" \
  --query "{id:inferenceProfileId,status:status,models:models}"

Remediation — Terraform

# Terraform AWS provider ~> 5.0
# SCP: deny bedrock:InvokeModel for inference profiles routing to unapproved regions
resource "aws_organizations_policy" "bedrock_data_residency" {
  name        = "bedrock-data-residency-lock"
  description = "Restrict Bedrock cross-region inference to approved regions only"
  type        = "SERVICE_CONTROL_POLICY"

  content = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "DenyBedrockUnapprovedRegions"
        Effect = "Deny"
        Action = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"]
        Resource = "*"
        Condition = {
          StringNotEquals = {
            "aws:RequestedRegion" = var.approved_regions
          }
        }
      }
    ]
  })
}

# variable approved_regions example: ["us-east-1", "eu-west-1"]

Remediation — CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: SCP forbidding Bedrock inference profile creation outside an approved region allowlist.
Parameters:
  OrgRootId:
    Type: String
Resources:
  DenyBedrockOutsideAllowedRegions:
    Type: AWS::Organizations::Policy
    Properties:
      Name: deny-bedrock-outside-allowed-regions
      Type: SERVICE_CONTROL_POLICY
      TargetIds:
        - !Ref OrgRootId
      Content:
        Version: '2012-10-17'
        Statement:
          - Sid: DenyBedrockNonAllowedRegions
            Effect: Deny
            Action:
              - bedrock:CreateInferenceProfile
              - bedrock:InvokeModel
              - bedrock:InvokeModelWithResponseStream
            Resource: '*'
            Condition:
              StringNotEqualsIfExists:
                aws:RequestedRegion:
                  - us-east-1
                  - us-west-2
                  - eu-central-1

Compliance mapping

fields @timestamp, eventName, requestParameters.modelId, requestParameters.inferenceProfileId, awsRegion, errorCode, userIdentity.arn
          | filter eventSource in ["bedrock-runtime.amazonaws.com","bedrock.amazonaws.com"] and eventName in ["InvokeModel","Converse","CreateInferenceProfile","DeleteInferenceProfile"]
          | filter requestParameters.modelId like /^us\./ or requestParameters.modelId like /^eu\./ or requestParameters.modelId like /^apac\./ or requestParameters.inferenceProfileId like /cross-region/
          | sort @timestamp desc
          | limit 100