Beyond Valid Credentials How Exposed AWS Keys Are Tested for...

src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md

@@ -10,6 +10,43 @@ Amazon Bedrock is a fully managed service that makes it easy to build and scale
 
 `InvokeModel`, `Converse`, and their streaming variants on the Bedrock Runtime endpoint are management events. Agents Runtime calls are optional data events: configure a trail with `resources.type = AWS::Bedrock::AgentAlias` to record `InvokeAgent`, and `AWS::Bedrock::KnowledgeBase` for `Retrieve` and `RetrieveAndGenerate`. CloudTrail Event History does not show data events, even when a trail records them. Agent calls absent from Event History therefore do not establish that they were unlogged. Use model invocation logging and agent traces separately when prompt, response, or reasoning content is needed.<sup>[[11]](#references)</sup>
 
+## Check exposed credentials for usable model access
+
+A valid AWS access key is not proof of Bedrock access. First identify the principal with [STS `GetCallerIdentity`](aws-sts-enum.md#enumeration), then check Bedrock in each region of interest. `ListFoundationModels` returns a regional model catalog, while `ListInferenceProfiles` lists profiles that may be used as runtime targets. Successful listing proves discovery permission, **not** permission to invoke a model.<sup>[[14]](#references)[[15]](#references)</sup>
+
+```bash
+aws sts get-caller-identity
+for region in us-east-1 us-west-2; do
+  aws bedrock list-foundation-models --region "$region" \
+    --query 'modelSummaries[].{id:modelId,provider:providerName,inference:inferenceTypesSupported}'
+  aws bedrock list-inference-profiles --region "$region" \
+    --query 'inferenceProfileSummaries[].{id:inferenceProfileId,arn:inferenceProfileArn}'
+done
+```
+
+To confirm usable access, invoke a **message-capable** model or inference profile through `bedrock-runtime` in a region where it is available. `Converse` uses a common message format and requires `bedrock:InvokeModel`; `InvokeModel` is an alternative but needs a model-specific body. A minimal prompt and four output tokens keep validation cost low. Use an actual model or profile ID returned for the target region; a catalog entry alone may not be usable by this identity.<sup>[[14]](#references)[[16]](#references)</sup>
+
+```bash
+aws bedrock-runtime converse --region '<region>' \
+  --model-id '<model-id-or-inference-profile-id>' \
+  --messages '[{"role":"user","content":[{"text":"ping"}]}]' \
+  --inference-config '{"maxTokens":4}'
+```
+
+A `ValidationException` about an unsupported inference parameter is not proof of denied access. Some models reject optional parameters such as `temperature`; if the request above fails for this reason, retry without `--inference-config`. An Anthropic `use case details` error can mean that the account has not submitted the first-use form (`FTUFormNotFilled`, HTTP 404), not that the credentials are invalid or that other providers are blocked.<sup>[[14]](#references)[[17]](#references)</sup>
+
+### Bedrock bearer tokens
+
+`AWS_BEARER_TOKEN_BEDROCK` identifies a separate Bedrock API key that may appear in exposed environment files or credential records. It can authenticate supported Bedrock and Bedrock Runtime operations, including `Converse`, through a bearer header or the environment variable. It is not an AWS access key: STS cannot validate it, and it cannot authorize general AWS APIs or Bedrock Agents, Data Automation, and bidirectional streaming APIs.<sup>[[14]](#references)[[18]](#references)</sup>
+
+One observed harvester used this pattern to find candidate variable assignments in text. It is a search heuristic, not an official Bedrock API-key format or a validity check.<sup>[[14]](#references)</sup>
+
+```regex
+/AWS_BEARER_TOKEN_BEDROCK\s*[=:]\s*["']?([A-Za-z0-9/+=]{40,})["']?/i
+```
+
+If model invocation succeeds, [Billing `GetCredits` enumeration](aws-cost-explorer-enum.md#credit-records-through-legacy-aws-portalviewbilling) provides separate financial context. Credit records do not establish invocation permission or prove that a credit applies to Bedrock.<sup>[[14]](#references)</sup>
+
 ## Privesc
 
 {{#ref}}
@@ -41,5 +78,10 @@ Amazon Bedrock is a fully managed service that makes it easy to build and scale
 - [11] [Monitor Amazon Bedrock API calls using CloudTrail](https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html)
 - [12] [AgentCore Identity observability](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-identity-metrics.html)
 - [13] [AgentCore actions and resource types](https://docs.aws.amazon.com/service-authorization/latest/reference/list_bedrock-agentcore.html)
+- [14] [Beyond Valid Credentials: How Exposed AWS Keys Are Tested for Amazon Bedrock Access](https://securitylabs.datadoghq.com/articles/beyond-valid-credentials-how-exposed-aws-keys-are-tested-for-amazon-bedrock-access/)
+- [15] [ListInferenceProfiles API](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_ListInferenceProfiles.html)
+- [16] [Inference using Converse API](https://docs.aws.amazon.com/bedrock/latest/userguide/conversation-inference.html)
+- [17] [Troubleshooting Amazon Bedrock API Error Codes](https://docs.aws.amazon.com/bedrock/latest/userguide/troubleshooting-api-error-codes.html)
+- [18] [Use an Amazon Bedrock API key](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-use.html)
 
 {{#include ../../../banners/hacktricks-training.md}}