Cross-Tenant Model Access Vulnerability in AWS Bedrock Custom Model Import
Overview
A severe access control vulnerability was identified in the AWS Bedrock service, specifically within the custom model import and fine-tuning job pipeline. The vulnerability stemmed from insufficient validation of S3 bucket ownership and object permissions during the initiation of a model import job. An authenticated attacker in one AWS account could craft a malicious API request to create a Bedrock fine-tuning job that referenced a custom model's data stored in an S3 bucket belonging to a different AWS account (the victim). If the attacker could guess or discover the victim's S3 bucket and object key for a proprietary model, they could import and gain full access to that model within their own Bedrock environment. This allowed for the theft of valuable, proprietary fine-tuned models. The attack did not require any interaction from the victim. The issue was discovered by internal AWS security teams during a routine audit and was patched before any evidence of public exploitation was found. The impact is considered critical due to the potential for intellectual property theft and the erosion of tenant isolation, a core security promise of cloud services.
Affected Systems
Testing Guide
Since this was a server-side vulnerability patched by AWS, direct testing by customers is not feasible. You can verify security posture by: 1. Attempting to create a Bedrock model import job from `Account A` that points to an S3 bucket in `Account B` without an explicit cross-account IAM policy. The API call should now fail with an `AccessDenied` error. 2. Reviewing AWS CloudTrail logs for all `CreateFineTuningJob` or `CreateModelImportJob` API calls to ensure they originate from expected roles and reference buckets within your organization's control.
Mitigation Steps
1. **No Customer Action Required:** AWS has remediated this vulnerability on the service side globally. 2. **Review IAM Policies:** As a best practice, regularly review and enforce least-privilege IAM policies for S3 buckets containing sensitive model data. Ensure that only authorized Bedrock service principals and users can access them. 3. **Enable S3 Access Logging:** Monitor S3 server access logs for any unusual or unauthorized access patterns to your model artifact buckets.
Patch Details
The issue was remediated by AWS on the service side on 2026-07-03. The patch enforces strict S3 bucket ownership validation and cross-account permission checks via IAM policies before a model import job can be initiated. No customer action is required.