Cross-Account Data Exposure in AWS Bedrock via Insecure Model Customization Job Logging
Overview
A potential data exposure vector was identified in AWS Bedrock's model customization feature. The issue was not a direct vulnerability in the service itself, but an 'interaction vulnerability' where a combination of common misconfigurations in IAM and S3 could lead to sensitive training data being leaked to an unauthorized AWS account. Researchers found that when a user configured a model fine-tuning job, they could specify an S3 bucket for output and logging. If the IAM role used for the job had `s3:PutObject` permissions on a bucket in another account, and that bucket's policy was overly permissive, the logs containing snippets of the training data could be written directly to an attacker-controlled location. The attack scenario involves an attacker creating a malicious public machine learning 'utility' (e.g., a data pre-processing script) that requires users to provide an IAM role. The instructions would guide the user to create a role with overly broad permissions, which the attacker could then assume and use to configure a Bedrock job that exfiltrates data from the victim's account to the attacker's S3 bucket. AWS has responded by updating their documentation with more explicit security best practices and enhancing AWS Trusted Advisor checks to detect such insecure cross-account configurations for Bedrock.
Affected Systems
Testing Guide
1. Review the IAM roles used for any AWS Bedrock model customization jobs. 2. Check the trust policy of the role. Does it allow assumption by unknown principals? 3. Examine the permissions policy attached to the role. Does it grant `s3:PutObject` permissions to S3 buckets outside of your AWS organization (`s3:*` on `arn:aws:s3:::*`)? 4. Review the bucket policies of the target S3 buckets. If a combination of the above exists, you may be vulnerable.
Mitigation Steps
1. **Apply Principle of Least Privilege:** Create narrowly-scoped IAM roles for each Bedrock fine-tuning job. The role should only have permissions to the specific S3 buckets required for that job. 2. **Use `aws:SourceArn` and `aws:SourceAccount`:** In IAM role trust policies and S3 bucket policies, use condition keys to ensure that access is granted only to specific Bedrock jobs from your account. 3. **Enable S3 Block Public Access:** Ensure this is enabled on all S3 buckets used for Bedrock training and logging to prevent accidental public exposure. 4. **Utilize AWS IAM Access Analyzer:** Regularly run IAM Access Analyzer to identify and review any cross-account access permissions that could be exploited.
Patch Details
AWS issued a security bulletin and updated documentation and best practice guides. No service change was required as the issue stems from customer configuration.