AWS Bedrock Model Customization Job Misconfiguration Allows Cross-Tenant S3 Data Access
Overview
A high-severity privilege escalation vulnerability was discovered in the AWS Bedrock service, specifically within its model fine-tuning functionality. The vulnerability stemmed from a logic flaw in how Bedrock's backend service principal handled IAM role permissions when accessing customer-provided training data in S3. Researchers found that a malicious actor in one AWS account could initiate a model customization job while specifying an S3 bucket located in a *different*, victim AWS account as the training data source. Due to improper validation of cross-account access policies in the Bedrock backend, the service would, under certain circumstances, be granted read access to the victim's data. This allowed the attacker to exfiltrate entire datasets used for model training, which could include highly sensitive proprietary code, business documents, or customer PII. To exploit this, an attacker needed their own AWS account and knowledge of the target S3 bucket's name. The vulnerability represented a critical break in the tenant isolation model, a core security principle of multi-tenant cloud services. AWS was notified through their responsible disclosure program and subsequently deployed a patch to their backend infrastructure to correctly enforce IAM boundaries. According to AWS, no customer data was compromised as a result of this flaw.
Affected Systems
Testing Guide
1. This vulnerability was patched by AWS on their infrastructure, so it is no longer possible to test for it directly. 2. To verify your own preventative controls, review the IAM policies and S3 bucket policies associated with your AI/ML workloads. 3. Create a test S3 bucket and apply a restrictive policy allowing access only from your AWS account's Bedrock jobs. 4. Attempt to launch a Bedrock fine-tuning job from a different AWS account (if possible) targeting this bucket. 5. The job should fail with an access denied error, confirming your S3 policies are correctly configured.
Mitigation Steps
1. The core vulnerability was in the AWS backend and has been patched by AWS. No direct customer action is required to fix the vulnerability itself. 2. As a best practice, apply strict, resource-based policies (bucket policies) to your S3 buckets containing training data. 3. Use the `aws:SourceArn` and `aws:SourceAccount` condition keys in your bucket policies to explicitly ensure that only specific Bedrock jobs from your own account can access the data. 4. Regularly monitor S3 access logs via AWS CloudTrail for any unexpected or unauthorized access patterns, particularly from AWS service principals.
Patch Details
AWS patched the issue on their backend infrastructure in February 2026. No client-side update is needed by customers.