Server-Side Request Forgery (SSRF) in AWS Bedrock Agents via Custom Tool OpenAPI Schema
Overview
A critical SSRF vulnerability was discovered in the AWS Bedrock Agents service, allowing attackers to coerce the service's backend infrastructure to make arbitrary HTTP requests to internal network resources. The vulnerability stemmed from insufficient validation of the `servers` block within user-provided OpenAPI schemas for custom tools (Actions). An attacker could define a custom tool for an agent and specify an internal AWS endpoint, such as the EC2 metadata service (169.254.169.254), as the server URL. When the agent invoked this tool, the Bedrock backend would fetch the OpenAPI spec and make a request to the malicious URL. This allowed the exfiltration of temporary IAM credentials associated with the Bedrock service role, potentially granting the attacker extensive access to the victim's AWS account resources, including S3 buckets, databases, and other services. The flaw was reported by a security researcher and has been patched by AWS. The impact was critical as it broke the security boundary of the managed service, leading to potential cross-tenant data access and full account compromise depending on the permissions of the service role.
Affected Systems
Testing Guide
1. **Review CloudTrail Logs**: Search your AWS CloudTrail logs for requests originating from the Bedrock service principal (`bedrock.amazonaws.com`) to suspicious IP addresses, especially `169.254.169.254`. 2. **Create a Test Tool**: In a non-production environment, create a new Action Group for an agent. 3. **Define a Malicious Schema**: In the OpenAPI schema for the tool, set the server URL to a request bin service you control (e.g., `https://example.requestcatcher.com`). 4. **Invoke the Agent**: Trigger the agent to use the test tool. If the Bedrock service makes a request to your request bin endpoint, your version of the service was vulnerable. AWS has patched this, so this test should now fail.
Mitigation Steps
1. **Apply AWS Patches**: AWS has patched this issue on their backend. No user action is required for the service itself. 2. **Audit IAM Roles**: Review the IAM roles associated with your Bedrock Agents. Apply the principle of least privilege to limit the potential impact of a similar vulnerability in the future. Ensure roles do not have unnecessary permissions (e.g., `s3:*` or `ec2:*`). 3. **Implement Network Controls**: For self-hosted tools connected to Bedrock, use VPC endpoints and security groups to strictly control inbound and outbound traffic, preventing agents from accessing internal metadata services. 4. **Validate OpenAPI Schemas**: Before uploading, programmatically scan any OpenAPI schemas for suspicious URLs in the `servers` block, especially those pointing to private IP ranges or cloud metadata services.
Patch Details
AWS deployed a server-side patch in mid-June 2026 that enhances validation of OpenAPI schemas to block requests to internal and loopback addresses.