Cross-Tenant IAM Role Assumption Vulnerability in AWS Bedrock Agents
Overview
Researchers from Wiz.io discovered a critical privilege escalation vulnerability within the AWS Bedrock Agents service. The flaw allowed for cross-tenant IAM role assumption, breaking account isolation boundaries. AWS Bedrock Agents orchestrate tasks by invoking APIs, which are defined in Action Groups and executed using a specified IAM role. The vulnerability resided in the service's validation logic when an agent was configured. An attacker in their own AWS account could create an agent and specify an Action Group that points to an IAM role ARN in a different, victim AWS account. Due to improper validation, the Bedrock service principal in the attacker's account was ableto assume the victim's IAM role if the role had a trust policy that was overly permissive (e.g., trusting `bedrock.amazonaws.com` without a condition restricting the source account). A successful exploit would allow the attacker's agent to execute API calls with the permissions of the victim's role, potentially leading to data exfiltration from S3 buckets, database access, or modification of other AWS resources in the victim's account. This represented a significant risk for organizations using Bedrock Agents with broadly trusted IAM roles. Amazon's security team responded quickly, deploying a service-side fix that enforces stricter validation of IAM role ARNs, ensuring they belong to the same AWS account where the agent is being configured.
Affected Systems
Testing Guide
1. The vulnerability has been patched by AWS. Testing for the original vulnerability is no longer possible. 2. To verify your IAM roles are secure, attempt to create a Bedrock agent in a separate, non-production AWS account (Account B). 3. In the agent's Action Group configuration, provide the ARN of an IAM role from your primary AWS account (Account A). 4. The creation process should now fail with an authorization error, confirming that the cross-account validation is in effect.
Mitigation Steps
1. AWS has deployed a server-side patch, so no direct customer action is required to fix the root cause. 2. **Action Required:** Review all IAM role trust policies associated with AWS Bedrock Agents. 3. Ensure trust policies use the `aws:SourceArn` or `aws:SourceAccount` condition keys to restrict role assumption to specific agents or accounts. Example policy condition: `"Condition": { "StringEquals": { "aws:SourceAccount": "123456789012" } }`. 4. Audit CloudTrail logs for any unexpected `sts:AssumeRole` events from the Bedrock service principal originating from unknown accounts.
Patch Details
A transparent, server-side patch was deployed by AWS across all regions. No specific version number is associated with the fix.