AWS Bedrock Cross-Tenant Resource Access via Model Customization Job Side-Channel
Overview
Researchers from a prominent cloud security firm discovered a critical vulnerability in AWS Bedrock's model customization and fine-tuning service. The flaw resided in the resource allocation and isolation mechanism for asynchronous fine-tuning jobs. By submitting a specially crafted fine-tuning job with manipulated hyperparameter configurations, an attacker in one AWS account could trigger a race condition in the underlying container orchestration layer. This race condition allowed them to briefly access a shared, ephemeral storage volume used for staging training data. While the window was small, a determined attacker could repeatedly trigger the condition to read or overwrite data slices from other tenants' fine-tuning jobs that were being processed concurrently on the same physical hardware. The impact is severe, potentially leading to the exfiltration of sensitive proprietary training data, intellectual property, or personally identifiable information (PII) used in model customization. The discovery highlights the complexities of secure multi-tenancy in managed AI/ML platforms where resource-intensive jobs are co-located. AWS responded within days by deploying a fix that enforces stricter storage volume isolation using unique, time-bounded credentials and randomizes job scheduling across a wider pool of hardware to mitigate co-location risks.
Affected Systems
Testing Guide
As this was a cloud provider vulnerability that has been patched, direct testing is no longer possible for customers. You can verify your security posture by: 1. Running a CloudTrail query for `CreateModelCustomizationJob` events in the period before the patch was announced (approx. 2026-07-02). 2. Reviewing the event history for jobs with unusual configurations or frequent failures. 3. Confirming that your IAM roles related to Bedrock adhere to the principle of least privilege.
Mitigation Steps
1. This was a platform-level vulnerability. AWS has patched its infrastructure, and no direct user action is required. 2. Review AWS Identity and Access Management (IAM) policies to ensure that only trusted entities have permission to start model customization jobs (`bedrock:CreateModelCustomizationJob`). 3. Monitor CloudTrail logs for any unusual or failed customization job activity originating from untrusted sources. 4. For highly sensitive data, consider performing fine-tuning on dedicated infrastructure (e.g., SageMaker) where tenancy is not shared, if possible.
Patch Details
The vulnerability was patched on the AWS backend around 2026-07-07. No client-side updates are needed.