From 692786a23c3a8dc5b9db3dfd70e81cb173433541 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Wed, 14 Oct 2026 19:34:23 +0000 Subject: [PATCH 1/2] Add content from: Beyond Valid Credentials: How Exposed AWS Keys Are Tested fo... --- .../aws-services/aws-bedrock-enum.md | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md index a1674806b4..1af80489de 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md @@ -10,6 +10,41 @@ Amazon Bedrock is a fully managed service that makes it easy to build and scale `InvokeModel`, `Converse`, and their streaming variants on the Bedrock Runtime endpoint are management events. Agents Runtime calls are optional data events: configure a trail with `resources.type = AWS::Bedrock::AgentAlias` to record `InvokeAgent`, and `AWS::Bedrock::KnowledgeBase` for `Retrieve` and `RetrieveAndGenerate`. CloudTrail Event History does not show data events, even when a trail records them. Agent calls absent from Event History therefore do not establish that they were unlogged. Use model invocation logging and agent traces separately when prompt, response, or reasoning content is needed.[[11]](#references) +## Check exposed credentials for usable model access + +A valid AWS access key is not proof of Bedrock access. First identify the principal with [STS `GetCallerIdentity`](aws-sts-enum.md#enumeration), then check Bedrock in each region of interest. `ListFoundationModels` returns a regional model catalog, while `ListInferenceProfiles` lists profiles that may be used as runtime targets. Successful listing proves discovery permission, **not** permission to invoke a model.[[14]](#references)[[15]](#references) + +```bash +aws sts get-caller-identity +for region in us-east-1 us-west-2; do + aws bedrock list-foundation-models --region "$region" \ + --query 'modelSummaries[].{id:modelId,provider:providerName,inference:inferenceTypesSupported}' + aws bedrock list-inference-profiles --region "$region" \ + --query 'inferenceProfileSummaries[].{id:inferenceProfileId,arn:inferenceProfileArn}' +done +``` + +To confirm usable access, invoke a **message-capable** model or inference profile through `bedrock-runtime` in a region where it is available. `Converse` uses a common message format and requires `bedrock:InvokeModel`; `InvokeModel` is an alternative but needs a model-specific body. A minimal prompt and four output tokens keep validation cost low. Use an actual model or profile ID returned for the target region; a catalog entry alone may not be usable by this identity.[[14]](#references)[[16]](#references) + +```bash +aws bedrock-runtime converse --region '' \ + --model-id '' \ + --messages '[{"role":"user","content":[{"text":"ping"}]}]' \ + --inference-config '{"maxTokens":4}' +``` + +If `Converse` returns a `ValidationException` about an unsupported inference parameter, retry without `--inference-config`; do not classify that request-shape error as a permission failure. The analyzed checker also omits `temperature` to avoid a model-specific validation failure. An Anthropic error containing `use case details` can instead mean the account has not submitted the first-use form (AWS documents `FTUFormNotFilled` as HTTP 404). That does not invalidate the credentials or imply that non-Anthropic models are blocked.[[14]](#references)[[17]](#references) + +### Bedrock bearer tokens + +`AWS_BEARER_TOKEN_BEDROCK` is a separate credential type worth checking in exposed environment files or credential records. One observed harvester matches assignments with optional spaces or quotes and a long base64-like value; that pattern is a discovery heuristic, not a guarantee that the token is valid. A Bedrock API key can authenticate supported Bedrock and Bedrock Runtime operations through a bearer header or the environment variable, but it cannot be tested with STS and does not grant general AWS API access.[[14]](#references)[[18]](#references) + +```regex +/AWS_BEARER_TOKEN_BEDROCK\s*[=:]\s*["']?([A-Za-z0-9/+=]{40,})["']?/i +``` + +When runtime access succeeds, the separate [Billing `GetCredits` enumeration](aws-cost-explorer-enum.md#credit-records-through-legacy-aws-portalviewbilling) can show remaining credit and `applicableProductNames`. An empty product list is only a possible Bedrock eligibility signal; a named restriction must include Bedrock to support that inference. Credit records do not prove model invocation permission.[[14]](#references) + ## Privesc {{#ref}} @@ -41,5 +76,10 @@ Amazon Bedrock is a fully managed service that makes it easy to build and scale - [11] [Monitor Amazon Bedrock API calls using CloudTrail](https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html) - [12] [AgentCore Identity observability](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-identity-metrics.html) - [13] [AgentCore actions and resource types](https://docs.aws.amazon.com/service-authorization/latest/reference/list_bedrock-agentcore.html) +- [14] [Beyond Valid Credentials: How Exposed AWS Keys Are Tested for Amazon Bedrock Access](https://securitylabs.datadoghq.com/articles/beyond-valid-credentials-how-exposed-aws-keys-are-tested-for-amazon-bedrock-access/) +- [15] [ListInferenceProfiles API](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_ListInferenceProfiles.html) +- [16] [Inference using Converse API](https://docs.aws.amazon.com/bedrock/latest/userguide/conversation-inference.html) +- [17] [Troubleshooting Amazon Bedrock API Error Codes](https://docs.aws.amazon.com/bedrock/latest/userguide/troubleshooting-api-error-codes.html) +- [18] [Use an Amazon Bedrock API key](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-use.html) {{#include ../../../banners/hacktricks-training.md}} From aa53552a15b22d80034c33031aab4ad912aab439 Mon Sep 17 00:00:00 2001 From: SirBroccoli Date: Wed, 14 Oct 2026 21:54:54 +0200 Subject: [PATCH 2/2] docs: repair PR placement and formatting after editorial review --- .../aws-security/aws-services/aws-bedrock-enum.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md index 1af80489de..a2cdcbeb9a 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md @@ -33,17 +33,19 @@ aws bedrock-runtime converse --region '' \ --inference-config '{"maxTokens":4}' ``` -If `Converse` returns a `ValidationException` about an unsupported inference parameter, retry without `--inference-config`; do not classify that request-shape error as a permission failure. The analyzed checker also omits `temperature` to avoid a model-specific validation failure. An Anthropic error containing `use case details` can instead mean the account has not submitted the first-use form (AWS documents `FTUFormNotFilled` as HTTP 404). That does not invalidate the credentials or imply that non-Anthropic models are blocked.[[14]](#references)[[17]](#references) +A `ValidationException` about an unsupported inference parameter is not proof of denied access. Some models reject optional parameters such as `temperature`; if the request above fails for this reason, retry without `--inference-config`. An Anthropic `use case details` error can mean that the account has not submitted the first-use form (`FTUFormNotFilled`, HTTP 404), not that the credentials are invalid or that other providers are blocked.[[14]](#references)[[17]](#references) ### Bedrock bearer tokens -`AWS_BEARER_TOKEN_BEDROCK` is a separate credential type worth checking in exposed environment files or credential records. One observed harvester matches assignments with optional spaces or quotes and a long base64-like value; that pattern is a discovery heuristic, not a guarantee that the token is valid. A Bedrock API key can authenticate supported Bedrock and Bedrock Runtime operations through a bearer header or the environment variable, but it cannot be tested with STS and does not grant general AWS API access.[[14]](#references)[[18]](#references) +`AWS_BEARER_TOKEN_BEDROCK` identifies a separate Bedrock API key that may appear in exposed environment files or credential records. It can authenticate supported Bedrock and Bedrock Runtime operations, including `Converse`, through a bearer header or the environment variable. It is not an AWS access key: STS cannot validate it, and it cannot authorize general AWS APIs or Bedrock Agents, Data Automation, and bidirectional streaming APIs.[[14]](#references)[[18]](#references) + +One observed harvester used this pattern to find candidate variable assignments in text. It is a search heuristic, not an official Bedrock API-key format or a validity check.[[14]](#references) ```regex /AWS_BEARER_TOKEN_BEDROCK\s*[=:]\s*["']?([A-Za-z0-9/+=]{40,})["']?/i ``` -When runtime access succeeds, the separate [Billing `GetCredits` enumeration](aws-cost-explorer-enum.md#credit-records-through-legacy-aws-portalviewbilling) can show remaining credit and `applicableProductNames`. An empty product list is only a possible Bedrock eligibility signal; a named restriction must include Bedrock to support that inference. Credit records do not prove model invocation permission.[[14]](#references) +If model invocation succeeds, [Billing `GetCredits` enumeration](aws-cost-explorer-enum.md#credit-records-through-legacy-aws-portalviewbilling) provides separate financial context. Credit records do not establish invocation permission or prove that a credit applies to Bedrock.[[14]](#references) ## Privesc