Server-Side Request Forgery (SSRF) in AWS Bedrock Agent Data Sources
Overview
A security flaw was discovered in the AWS Bedrock Agents' data source configuration, allowing for a Server-Side Request Forgery (SSRF) attack. When setting up a knowledge base for an agent, users can specify an S3 bucket as a data source. Researchers found that by manipulating the S3 bucket's location parameters during the data source creation API call, it was possible to trick the Bedrock service into making an HTTP request to an arbitrary internal AWS IP address instead of the legitimate S3 endpoint. The Bedrock service's backend parser improperly validated the user-supplied endpoint, allowing it to be redirected. An attacker could use this to scan the internal network of the AWS service fabric, probe for open ports on internal services, and potentially access sensitive metadata services, including the EC2 Instance Metadata Service (IMDS). While the requests were limited in what they could achieve, the ability to map internal infrastructure and interact with sensitive endpoints presented a significant security risk. Amazon's security team responded by implementing stricter validation on all user-supplied data source endpoints, ensuring they resolve to legitimate, public S3 domains before any connection is attempted by the service.
Affected Systems
Testing Guide
1. This vulnerability was patched by AWS on the server side, so it is no longer possible for customers to test for it directly. 2. To verify your security posture, attempt to create a Bedrock knowledge base data source pointing to a non-S3 URL or a private IP address. The API call should now fail with a validation error, indicating that the patch is effective.
Mitigation Steps
1. **No User Action Required:** AWS has patched this vulnerability on the service side. All Bedrock users are protected automatically. 2. **Audit IAM Roles:** As a best practice, review the IAM roles associated with your Bedrock agents and knowledge bases. Ensure they follow the principle of least privilege and do not have unnecessary permissions to access other AWS services. 3. **Use VPC Endpoints:** For enhanced security, configure your Bedrock knowledge bases to use VPC endpoints for S3, ensuring that traffic between Bedrock and your S3 bucket does not traverse the public internet and is contained within your VPC.
Patch Details
The vulnerability was patched by AWS globally on May 29, 2026. No customer action is needed.