AWS Bedrock Agent IAM Privilege Escalation via Assumed Role Chaining
Overview
A privilege escalation vulnerability was identified in the permission model for AWS Bedrock Agents. The issue stemmed from how Bedrock Agents handle IAM role assumption when interacting with other AWS services through its configured tools (Action Groups). An agent configured with a specific, limited-privilege IAM role could, under certain conditions, be manipulated to assume a different, more powerful role present in the same AWS account. The attack requires the agent to call an AWS service tool (e.g., a Lambda function) that itself has permissions to assume another role (`sts:AssumeRole`). A malicious prompt could instruct the agent to invoke this tool with parameters that cause the target Lambda function to assume a higher-privilege role and perform actions outside the agent's originally intended scope. For example, an agent only permitted to read from an S3 bucket could trick a misconfigured Lambda tool into assuming an admin role and creating a new IAM user. This vulnerability undermines the security model of scoping agent permissions and could lead to a full account takeover. The root cause was a lack of clear separation and validation of execution contexts between the Bedrock Agent service and the tools it invokes.
Affected Systems
Testing Guide
1. Review the IAM roles associated with your Bedrock Agents and their Action Group Lambda functions. 2. Check if the agent's role has `sts:AssumeRole` permissions. If so, determine if it's necessary. 3. Examine the trust policies of higher-privilege roles in the account. Check if they can be assumed by the agent's role or its Lambda function role without sufficient restrictive conditions. 4. Attempt to prompt the agent to perform an action that would require it to invoke a tool that assumes a different role and confirm if the action succeeds or fails as expected.
Mitigation Steps
1. **Upgrade SDK and Runtimes:** Ensure all AWS SDKs and Lambda runtimes are updated to the versions specified in the AWS security bulletin. 2. **Apply Principle of Least Privilege:** Strictly scope the IAM roles attached to Bedrock Agents and any Lambda functions they call. The agent's role should not have `sts:AssumeRole` permissions unless absolutely necessary. 3. **Use IAM Conditions:** Implement IAM role trust policies with strict conditions, such as restricting role assumption to specific source IP addresses or service principals (`bedrock.amazonaws.com`). 4. **Monitor CloudTrail:** Actively monitor AWS CloudTrail logs for unusual `sts:AssumeRole` events originating from the Bedrock service or its associated resources.
Patch Details
AWS issued a security bulletin and updated the Bedrock service backend to enforce stricter validation on role assumption chains originating from agents. No specific user action is required for the service-side fix, but updating IAM policies is strongly recommended.