Cross-Tenant Data Leakage in AWS Bedrock via Manipulated Guardrails Configuration
Overview
A security vulnerability was identified in AWS Bedrock's Guardrails feature, allowing for potential cross-tenant data leakage under specific, complex conditions. Guardrails for Amazon Bedrock allows customers to implement safeguards and content filters for their generative AI applications. The vulnerability stemmed from an improper input sanitization flaw when the service processed deeply nested JSON structures within custom denied topic definitions. An attacker with permissions to configure Guardrails could craft a malicious Guardrail policy. When this policy was evaluated by the Bedrock service against user input, it could trigger a type confusion error in the backend evaluation engine, causing it to mishandle memory pointers. This could lead to a small portion of data from a previous or concurrent inference request made by another tenant being included in the response to the attacker's prompt. While the leaked data was typically fragmented and small (under 1KB), it could contain sensitive information from other users' prompts or model responses. The attack required privileged access to configure Guardrails, limiting its general exploitability, but it posed a significant risk for multi-tenant environments where strict data isolation is critical. The issue was discovered by an independent security researcher and reported responsibly to AWS, who deployed a server-side patch to their Guardrails processing backend, requiring no action from customers.
Affected Systems
Testing Guide
This vulnerability was patched on the server side by AWS, so it is no longer possible to test for it directly. To check if you were potentially exposed, you can review AWS CloudTrail logs prior to the patch date for any unauthorized modifications to your Bedrock Guardrails configurations. Look for `UpdateGuardrail` or `CreateGuardrail` events from unexpected IAM principals.
Mitigation Steps
1. **No customer action required**: AWS has deployed a server-side patch that mitigates this vulnerability for all customers. 2. **Review Guardrail permissions**: As a best practice, restrict permissions to create, update, and delete Bedrock Guardrails to only trusted administrative principals using AWS IAM. 3. **Monitor Guardrail changes**: Use AWS CloudTrail to monitor API calls related to Guardrails (`CreateGuardrail`, `UpdateGuardrail`) and alert on any unauthorized or suspicious changes.
Patch Details
A server-side patch was deployed by AWS across all regions on 2026-06-29. No customer-side updates are necessary.