Cross-Tenant Data Exposure in AWS Bedrock Model Customization Jobs
Overview
Security researchers at AI Sentinel Labs discovered a high-severity data exposure vulnerability in the AWS Bedrock service related to its model customization feature. The flaw resided in the backend process that handles fine-tuning jobs submitted by users. When multiple customization jobs from different tenants were scheduled on the same underlying GPU cluster, an improper resource cleanup mechanism could cause data from a previous job's S3 bucket to be inadvertently cached and made accessible to the subsequent job. An attacker could trigger this condition by submitting a series of carefully timed, small fine-tuning jobs, increasing the probability of being scheduled on a recently used, non-sanitized instance. This could allow them to access and exfiltrate proprietary training data from other AWS customers, including sensitive PII, corporate documents, or trade secrets used for model fine-tuning. The impact was significant due to the high value of proprietary data used to customize foundation models. Amazon's security team responded promptly after being notified, confirming the vulnerability was related to a race condition in the storage volume detachment logic for their managed training fleet. They deployed a patch globally within 48 hours of notification that enforces a synchronous and complete data wipe of local instance storage between jobs.
Affected Systems
Testing Guide
As this was a server-side vulnerability patched by AWS, direct testing by customers is not feasible. To check if your organization was potentially impacted: 1. **Identify Timeframe**: Review all model customization jobs that were run prior to the patch date announced by AWS (approximately 2026-06-22). 2. **Review Logs**: Correlate the timestamps of your customization jobs with S3 access logs for the corresponding data buckets. Look for any access events that cannot be attributed to the AWS Bedrock service role or your own internal processes. 3. **Consult AWS Support**: For definitive confirmation regarding specific job IDs, contact AWS Enterprise Support and reference the relevant security bulletin (if one was publicly issued).
Mitigation Steps
1. **Confirm Patch Application**: AWS has patched this issue on the service side, so no direct customer action is required for mitigation. However, it is recommended to review AWS security bulletins to confirm the timeline of the fix. 2. **Review IAM Policies**: Restrict access to S3 buckets used for training data to the absolute minimum required principals. Use bucket policies that explicitly limit access to the Bedrock service role and trusted accounts. 3. **Monitor S3 Access Logs**: Enable and actively monitor S3 server access logs and CloudTrail logs for any anomalous access patterns to your training data buckets, especially from unexpected roles or IP ranges. 4. **Data Minimization**: When fine-tuning models, use the principle of least privilege for data. Only provide the minimum necessary dataset for the task to limit the potential impact of any future data exposure incidents.
Patch Details
The vulnerability was patched by AWS on their backend infrastructure. No client-side updates are required. The fix was rolled out globally by 2026-06-22.