Cross-Tenant Data Leakage in AWS Bedrock Agents via Service-Side Request Forgery in Tool Definition
Overview
A high-severity vulnerability was identified in the AWS Bedrock Agents service that could allow an attacker to exfiltrate data from other AWS services within the victim's account. The vulnerability stemmed from insufficient validation of the OpenAPI schema provided when defining a custom tool (Action Group) for an agent. An attacker could craft a malicious OpenAPI schema where the server URL for an API endpoint pointed to an internal AWS metadata service or other sensitive local endpoints (e.g., `http://169.254.169.254`). When the Bedrock Agent was invoked and decided to use this malicious tool, the Bedrock service itself would make a server-side request to the specified internal URL. By manipulating the parameters passed to the tool, an attacker could use the agent to query the EC2 metadata service and exfiltrate temporary IAM credentials associated with the Bedrock service role. These credentials could then be used to access other AWS resources within the same account, such as S3 buckets or DynamoDB tables, that the role had permissions for. The attack could be triggered by tricking a user into invoking the agent with a prompt that causes it to use the malicious tool. This SSRF vulnerability bypassed traditional network controls as the request originated from within AWS's trusted infrastructure, highlighting the importance of strict URL validation and network egress policies for managed AI services.
Affected Systems
Testing Guide
1. Create a new Action Group for a test agent in AWS Bedrock. 2. In the OpenAPI schema for the tool, set the `servers.url` field to a controlled endpoint you can monitor, such as a Burp Collaborator or Interactsh URL. 3. Invoke the agent with a prompt that forces it to use this tool. 4. Check your monitoring endpoint to see if a request is received from an AWS IP address. This confirms the service makes server-side requests. 5. (In a secure, isolated test account) attempt to set the URL to a known internal endpoint like `http://169.254.169.254/latest/meta-data/`. As of the patch date, this request should be blocked by AWS.
Mitigation Steps
1. **Apply AWS Patch.** AWS has patched the service to implement stricter validation on URLs provided in OpenAPI schemas for Action Groups. No customer action is required for the service-side fix. 2. **Audit Action Groups.** Review all custom tools (Action Groups) defined for your Bedrock Agents. Ensure that all API endpoint URLs are valid, expected, and point to trusted, publicly-routable domains. 3. **Apply Principle of Least Privilege.** Ensure the IAM Role associated with your Bedrock Agent has the absolute minimum permissions necessary. It should not have broad access to services like S3 (`s3:*`) if it only needs to read from a specific bucket. 4. **Use VPC Endpoints.** For tools that interact with other AWS services, configure the Bedrock Agent to operate within a VPC and use VPC endpoints to ensure traffic does not traverse the public internet and is restricted to the AWS network.
Patch Details
AWS deployed a service-side patch on 2026-05-30 that blocks requests to internal metadata endpoints and enforces stricter URL validation for Action Groups.