Bedrock

eventName	Description	Sample	Rule
any	Catch-all entry for Bedrock rules that match the service but not a specific eventName.	N	N
AssociateAgentCollaborator	Associates a collaborator agent with a supervisor agent to enable multi-agent collaboration.	N	Y
AssociateAgentKnowledgeBase	Associates a knowledge base with an Amazon Bedrock agent, enabling the agent to query the knowledge base during conversations.	N	Y
Converse	Sends a conversational message to an Amazon Bedrock foundation model and returns a synchronous response.	Y	Y
ConverseStream	Sends a conversational message to an Amazon Bedrock foundation model and returns the response as a streaming event stream.	Y	Y
CreateAgent	Creates an Amazon Bedrock agent with a specified foundation model, instruction set, and configuration.	Y	Y
CreateAgentActionGroup	Creates an action group for a Bedrock agent, defining a set of API actions the agent can invoke.	N	Y
CreateAgentAlias	Creates an alias for a Bedrock agent that points to a specific agent version, enabling versioned deployments.	Y	Y
CreateCustomModelDeployment	Creates a deployment for a custom Amazon Bedrock model, making it available for inference.	N	Y
CreateDataSource	Creates a data source for a Bedrock knowledge base, specifying the location and ingestion configuration for documents.	N	Y
CreateFoundationModelAgreement	Creates an agreement to accept the end-user license terms for a foundation model, enabling access to that model.	Y	Y
CreateMarketplaceModelEndpoint	Creates an endpoint for a model subscribed through AWS Marketplace, making it available for Bedrock inference.	N	Y
CreateModelImportJob	Creates a job to import a custom model into Amazon Bedrock from an external source such as Amazon S3.	N	Y
CreateProvisionedModelThroughput	Creates a provisioned throughput allocation for a Bedrock foundation or custom model, reserving dedicated inference capacity.	N	Y
DeleteAutomatedReasoningPolicy	Deletes an automated reasoning policy from Amazon Bedrock, removing its constraints from model invocations.	N	Y
DeleteDataSource	Deletes a data source from a Bedrock knowledge base, removing it from future ingestion operations.	Y	Y
DeleteEnforcedGuardrailConfiguration	Deletes the enforced guardrail configuration, removing the requirement to apply a specific guardrail to model invocations.	Y	Y
DeleteGuardrail	Deletes a Bedrock guardrail resource, removing the content filtering and safety policies it defined.	Y	Y
DeleteKnowledgeBase	Deletes a Bedrock knowledge base and its associated configuration, disconnecting it from any associated agents and data sources.	Y	Y
DeleteKnowledgeBaseDocuments	Deletes specific documents from a Bedrock knowledge base data source, removing them from the index.	Y	Y
DeleteModelInvocationLoggingConfiguration	Deletes the model invocation logging configuration for the account, stopping the logging of Bedrock inference requests and responses.	Y	Y
DeleteProvisionedModelThroughput	Deletes a provisioned throughput allocation for a Bedrock model, releasing the reserved inference capacity.	N	Y
DeleteResourcePolicy	Deletes a resource-based policy attached to a Bedrock resource, removing the access permissions it granted.	Y	Y
IngestKnowledgeBaseDocuments	Directly ingests documents into a Bedrock knowledge base data source without starting a full ingestion job.	N	Y
InvokeModel	Invokes an Amazon Bedrock foundation, imported, or provisioned model with a single synchronous request payload.	Y	Y
InvokeModelWithResponseStream	Invokes an Amazon Bedrock model and streams the response back as a series of chunks using the response body.	Y	Y
ListFoundationModels	Returns a list of Amazon Bedrock foundation models available for use, including their providers, modalities, and inference types.	Y	Y
PrepareAgent	Prepares a Bedrock agent for use by packaging its latest configuration and creating a working draft version ready for testing or deployment.	Y	Y
PutEnforcedGuardrailConfiguration	Sets an enforced guardrail configuration that mandates a specific guardrail be applied to all model invocations in the account.	Y	Y
PutFoundationModelEntitlement	Sets the entitlement for a foundation model, granting access rights to the specified model for the account.	N	Y
PutModelInvocationLoggingConfiguration	Configures logging for Amazon Bedrock model invocations, directing request and response data to CloudWatch Logs or S3.	Y	Y
PutResourcePolicy	Attaches or replaces a resource-based policy on a Bedrock resource, controlling cross-account or cross-service access.	Y	Y
PutUseCaseForModelAccess	Submits a use case description to request access to Amazon Bedrock foundation models that require justification.	N	Y
RegisterMarketplaceModelEndpoint	Registers an existing AWS Marketplace model endpoint with Amazon Bedrock, enabling it to be used for Bedrock inference.	N	Y
StartIngestionJob	Starts an ingestion job to sync documents from a data source into a Bedrock knowledge base vector store.	N	Y
UpdateAgent	Updates the configuration of an existing Bedrock agent, such as its foundation model, instructions, or session timeout.	Y	Y
UpdateAgentActionGroup	Updates an action group associated with a Bedrock agent, modifying its API schema or Lambda function configuration.	Y	Y
UpdateAgentAlias	Updates a Bedrock agent alias to point to a different agent version or update its description.	Y	Y
UpdateAgentCollaborator	Updates the configuration of a collaborator agent associated with a supervisor agent.	Y	Y
UpdateAgentKnowledgeBase	Updates the configuration of a knowledge base associated with a Bedrock agent, such as its instruction or retrieval settings.	Y	Y
UpdateAutomatedReasoningPolicy	Updates an existing automated reasoning policy in Amazon Bedrock, modifying its rules or constraints.	N	Y
UpdateAutomatedReasoningPolicyAnnotations	Updates the annotations on an automated reasoning policy, revising human-authored labels or metadata on its rules.	N	Y
UpdateDataSource	Updates the configuration of a data source in a Bedrock knowledge base, such as its S3 location or chunking strategy.	Y	Y
UpdateGuardrail	Updates an existing Bedrock guardrail, modifying its content filters, topic denials, or sensitive information policies.	Y	Y
UpdateKnowledgeBase	Updates the configuration of a Bedrock knowledge base, such as its description, role ARN, or storage configuration.	Y	Y
UpdateProvisionedModelThroughput	Updates a provisioned throughput commitment for a Bedrock model, modifying its model units or model ID.	N	Y
BatchDeleteAdvancedPromptOptimizationJob	Deletes one or more advanced prompt optimization jobs.	N	N
BatchDeleteEvaluationJob	Deletes a batch of evaluation jobs.	N	N
CancelAutomatedReasoningPolicyBuildWorkflow	Cancels a running Automated Reasoning policy build workflow.	N	N
CreateAdvancedPromptOptimizationJob	Creates an advanced prompt optimization job.	N	N
CreateAutomatedReasoningPolicy	Creates an Automated Reasoning policy for Amazon Bedrock Guardrails.	N	N
CreateAutomatedReasoningPolicyTestCase	Creates a test for an Automated Reasoning policy.	N	N
CreateAutomatedReasoningPolicyVersion	Creates a new version of an existing Automated Reasoning policy.	N	N
CreateCustomModel	Creates a new custom model in Amazon Bedrock.	N	N
CreateEvaluationJob	Creates an evaluation job.	N	N
CreateGuardrail	Creates a guardrail to block topics and to implement safeguards for your generative AI applications.	Y	N
CreateGuardrailVersion	Creates a version of the guardrail.	N	N
CreateInferenceProfile	Creates an application inference profile to track metrics and costs when invoking a model.	N	N
CreateModelCopyJob	Copies a model to another region so that it can be used there.	N	N
CreateModelCustomizationJob	Creates a fine-tuning job to customize a base model.	N	N
CreateModelInvocationJob	Creates a batch inference job to invoke a model on multiple prompts.	N	N
CreatePromptRouter	Creates a prompt router that manages the routing of requests between multiple foundation models based on the routing criteria.	N	N
DeleteAutomatedReasoningPolicyBuildWorkflow	Deletes an Automated Reasoning policy build workflow and its associated artifacts.	N	N
DeleteAutomatedReasoningPolicyTestCase	Deletes an Automated Reasoning policy test.	N	N
DeleteCustomModel	Deletes a custom model that you created earlier.	N	Y
DeleteCustomModelDeployment	Deletes a custom model deployment.	N	N
DeleteFoundationModelAgreement	Delete the model access agreement for the specified model.	Y	N
DeleteImportedModel	Deletes a custom model that you imported earlier.	Y	Y
DeleteInferenceProfile	Deletes an application inference profile.	Y	N
DeleteMarketplaceModelEndpoint	Deletes an endpoint for a model from Amazon Bedrock Marketplace.	Y	Y
DeletePromptRouter	Deletes a specified prompt router.	N	N
DeregisterMarketplaceModelEndpoint	Deregisters an endpoint for a model from Amazon Bedrock Marketplace.	Y	N
ExportAutomatedReasoningPolicyVersion	Exports the policy definition for an Automated Reasoning policy version.	N	N
GetAccountDataRetention	Returns the account-wide data retention mode for Amazon Bedrock.	Y	N
GetAdvancedPromptOptimizationJob	Gets information about an advanced prompt optimization job.	N	N
GetAutomatedReasoningPolicy	Retrieves details about an Automated Reasoning policy or policy version.	N	N
GetAutomatedReasoningPolicyAnnotations	Retrieves the current annotations for an Automated Reasoning policy build workflow.	N	N
GetAutomatedReasoningPolicyBuildWorkflow	Retrieves detailed information about an Automated Reasoning policy build workflow, including its status, configuration, and metadata.	N	N
GetAutomatedReasoningPolicyBuildWorkflowResultAssets	Retrieves the resulting assets from a completed Automated Reasoning policy build workflow, including build logs, quality reports, and generated policy artifacts.	N	N
GetAutomatedReasoningPolicyNextScenario	Retrieves the next test scenario for validating an Automated Reasoning policy.	N	N
GetAutomatedReasoningPolicyTestCase	Retrieves details about a specific Automated Reasoning policy test.	N	N
GetAutomatedReasoningPolicyTestResult	Retrieves the test result for a specific Automated Reasoning policy test.	N	N
GetCustomModel	Get the properties associated with a Amazon Bedrock custom model that you have created.	N	N
GetCustomModelDeployment	Retrieves information about a custom model deployment, including its status, configuration, and metadata.	N	N
GetEvaluationJob	Gets information about an evaluation job, such as the status of the job.	Y	N
GetFoundationModel	Get details about a Amazon Bedrock foundation model.	Y	N
GetFoundationModelAvailability	Get information about the Foundation model availability.	Y	N
GetGuardrail	Gets details about a guardrail.	Y	N
GetImportedModel	Gets properties associated with a customized model you imported.	Y	N
GetInferenceProfile	Gets information about an inference profile.	Y	N
GetMarketplaceModelEndpoint	Retrieves details about a specific endpoint for a model from Amazon Bedrock Marketplace.	Y	N
GetModelCopyJob	Retrieves information about a model copy job.	N	N
GetModelCustomizationJob	Retrieves the properties associated with a model-customization job, including the status of the job.	N	N
GetModelImportJob	Retrieves the properties associated with import model job, including the status of the job.	Y	N
GetModelInvocationJob	Gets details about a batch inference job.	Y	N
GetModelInvocationLoggingConfiguration	Get the current configuration values for model invocation logging.	Y	N
GetPromptRouter	Retrieves details about a prompt router.	Y	N
GetProvisionedModelThroughput	Returns details for a Provisioned Throughput.	N	N
GetResourcePolicy	Gets the resource policy document for a Bedrock resource	Y	N
GetUseCaseForModelAccess	Get usecase for model access.	Y	N
ListAdvancedPromptOptimizationJobs	Lists the advanced prompt optimization jobs in your account.	N	N
ListAutomatedReasoningPolicies	Lists all Automated Reasoning policies in your account, with optional filtering by policy ARN.	N	N
ListAutomatedReasoningPolicyBuildWorkflows	Lists all build workflows for an Automated Reasoning policy, showing the history of policy creation and modification attempts.	N	N
ListAutomatedReasoningPolicyTestCases	Lists tests for an Automated Reasoning policy.	N	N
ListAutomatedReasoningPolicyTestResults	Lists test results for an Automated Reasoning policy, showing how the policy performed against various test scenarios and validation checks.	N	N
ListCustomModelDeployments	Lists custom model deployments in your account.	N	N
ListCustomModels	Returns a list of the custom models that you have created with the CreateModelCustomizationJob operation.	Y	N
ListEnforcedGuardrailsConfiguration	Lists the account-level enforced guardrail configurations.	Y	N
ListEvaluationJobs	Lists all existing evaluation jobs.	Y	N
ListFoundationModelAgreementOffers	Get the offers associated with the specified model.	Y	N
ListGuardrails	Lists details about all the guardrails in an account.	Y	N
ListImportedModels	Returns a list of models you've imported.	Y	N
ListInferenceProfiles	Returns a list of inference profiles that you can use.	Y	N
ListMarketplaceModelEndpoints	Lists the endpoints for models from Amazon Bedrock Marketplace in your Amazon Web Services account.	Y	N
ListModelCopyJobs	Returns a list of model copy jobs that you have submitted.	N	N
ListModelCustomizationJobs	Returns a list of model customization jobs that you have submitted.	N	N
ListModelImportJobs	Returns a list of import jobs you've submitted.	Y	N
ListModelInvocationJobs	Lists all batch inference jobs in the account.	Y	N
ListPromptRouters	Retrieves a list of prompt routers.	Y	N
ListProvisionedModelThroughputs	Lists the Provisioned Throughputs in the account.	Y	N
ListTagsForResource	List the tags associated with the specified resource.	Y	N
PutAccountDataRetention	Sets the account-wide data retention mode for Amazon Bedrock.	Y	N
StartAutomatedReasoningPolicyBuildWorkflow	Starts a new build workflow for an Automated Reasoning policy.	N	N
StartAutomatedReasoningPolicyTestWorkflow	Initiates a test workflow to validate Automated Reasoning policy tests.	N	N
StopAdvancedPromptOptimizationJob	Stops an advanced prompt optimization job that is in progress.	N	N
StopEvaluationJob	Stops an evaluation job that is current being created or running.	Y	N
StopModelCustomizationJob	Stops an active model customization job.	N	N
StopModelInvocationJob	Stops a batch inference job.	Y	N
TagResource	Associate tags with a resource.	Y	N
UntagResource	Remove one or more tags from a resource.	Y	N
UpdateAutomatedReasoningPolicyTestCase	Updates an existing Automated Reasoning policy test.	N	N
UpdateCustomModelDeployment	Updates a custom model deployment with a new custom model.	N	N
UpdateMarketplaceModelEndpoint	Updates the configuration of an existing endpoint for a model from Amazon Bedrock Marketplace.	N	N
GetAgent	GetAgent recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
GetAgentActionGroup	GetAgentActionGroup recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
GetAgentVersion	GetAgentVersion recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
GetDataSource	GetDataSource recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
GetFlowAlias	GetFlowAlias recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ListAgentActionGroups	ListAgentActionGroups recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ListAgentKnowledgeBases	ListAgentKnowledgeBases recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ListAgentVersions	ListAgentVersions recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ListDataAutomationProjects	ListDataAutomationProjects recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ListFlowAliases	ListFlowAliases recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ListFlows	ListFlows recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ListKnowledgeBases	ListKnowledgeBases recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ListPrompts	ListPrompts recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N

any: Bedrock (catch-all)

Service: bedrock

Description

Catch-all entry for Bedrock rules that match the service but not a specific eventName.

AssociateAgentCollaborator

Service: bedrock

Description

Associates a collaborator agent with a supervisor agent to enable multi-agent collaboration.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Agent or Action Group Manipulation source medium: Detects modification of deployed Amazon Bedrock agents and their action groups, collaborators, or aliases via the Bedrock Agent control plane. Adversaries with access to an AWS account can tamper with an existing, trusted agent by altering its instructions (UpdateAgent), adding or changing action groups that wire the agent to Lambda functions or APIs (CreateAgentActionGroup, UpdateAgentActionGroup), attaching or modifying collaborators (AssociateAgentCollaborator, UpdateAgentCollaborator), or repointing an alias to a tampered version (CreateAgentAlias, UpdateAgentAlias). A PrepareAgent call is required to make a tampered configuration live. By implanting malicious behavior into an agent that legitimate users continue to invoke, an attacker can maintain durable access through a trusted component. Creation of brand-new agents (CreateAgent) is intentionally excluded as lower-signal activity.T1505↳ also matches CreateAgentActionGroup, CreateAgentAlias, PrepareAgent, UpdateAgent, UpdateAgentActionGroup, UpdateAgentAlias, UpdateAgentCollaborator

AssociateAgentKnowledgeBase

Service: bedrock

Description

Associates a knowledge base with an Amazon Bedrock agent, enabling the agent to query the knowledge base during conversations.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Third-Party or External Knowledge Base Associated to Agent source medium: Detects when an Amazon Bedrock agent is associated with, or updated to use, a knowledge base via the AssociateAgentKnowledgeBase, or UpdateAgentKnowledgeBase API actions. Bedrock agents consume knowledge base (RAG) content as trusted context for the model. By wiring an agent to an externally controlled or third-party knowledge base, or by swapping in an attacker-controlled knowledge base, an adversary can redraw the agent's trust boundary toward an untrusted source. This is a software-supply-chain compromise and an indirect prompt-injection delivery vector: poisoned or adversarial content served from the associated knowledge base is treated as authoritative by the agent. Validate that the associated knowledge base, and any underlying data source, is owned and controlled by your organization.T1505↳ also matches UpdateAgentKnowledgeBase

Converse

Service: bedrock

Description

Sends a conversational message to an Amazon Bedrock foundation model and returns a synchronous response.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "The provided model identifier is invalid.",
  "eventCategory": "Management",
  "eventID": "2d8fe66d-788f-49d3-8053-9a83436416e7",
  "eventName": "Converse",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:42Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "17278187-c28a-4676-b625-1f24a4ee1fe0",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock-runtime.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::requestParameters` (elastic rule field)	is_not_null		1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock High-Frequency Single-Model Inference API Probing source medium: Identifies an AWS principal performing a high volume of Amazon Bedrock inference API calls against a single model within a short window. Membership inference attacks require hundreds to thousands of statistically similar queries whose prompts and responses are intentionally content-benign, making guardrail- and content-based rules ineffective. This rule detects the high-frequency single-model probing pattern that precedes membership inference and related exfiltration via the inference API. It is a behavioral / volumetric precursor: it does not observe model confidence scores and a fixed call-count threshold only catches the loud variant, so paced, low-and-slow, or credential-distributed probing will evade it. Definitive membership inference detection requires ML anomaly analysis over per-entity inference-rate and response-distribution baselines.↳ also matches ConverseStream, InvokeModel, InvokeModelWithResponseStream

ConverseStream

Service: bedrock

Description

Sends a conversational message to an Amazon Bedrock foundation model and returns the response as a streaming event stream.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "The provided model identifier is invalid.",
  "eventCategory": "Management",
  "eventID": "52f40b10-6448-4afe-8e52-f9fd54f95963",
  "eventName": "ConverseStream",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:42Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "f399839c-5599-49ec-9bc3-b8291bf9b448",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock-runtime.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::requestParameters` (elastic rule field)	is_not_null		1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock High-Frequency Single-Model Inference API Probing source medium: Identifies an AWS principal performing a high volume of Amazon Bedrock inference API calls against a single model within a short window. Membership inference attacks require hundreds to thousands of statistically similar queries whose prompts and responses are intentionally content-benign, making guardrail- and content-based rules ineffective. This rule detects the high-frequency single-model probing pattern that precedes membership inference and related exfiltration via the inference API. It is a behavioral / volumetric precursor: it does not observe model confidence scores and a fixed call-count threshold only catches the loud variant, so paced, low-and-slow, or credential-distributed probing will evade it. Definitive membership inference detection requires ML anomaly analysis over per-entity inference-rate and response-distribution baselines.↳ also matches Converse, InvokeModel, InvokeModelWithResponseStream

CreateAgent

Service: bedrock

Description

Creates an Amazon Bedrock agent with a specified foundation model, instruction set, and configuration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "237cb7e0-a070-4ef0-af41-4f0315619314",
  "eventName": "CreateAgent",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T21:54:05Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "28909571-966f-4125-b492-ddeaeed1bf5e",
  "requestParameters": {
    "agentName": "***",
    "clientToken": "0bd3dbd4-8f95-43e0-a924-3a267848f901",
    "description": "***",
    "idleSessionTTLInSeconds": 60,
    "tags": {
      "Project": "dwfix"
    }
  },
  "responseElements": {
    "agent": {
      "agentArn": "arn:aws:bedrock:us-west-1:123456789012:agent/1CK9WOCX18",
      "agentCollaboration": "DISABLED",
      "agentId": "1CK9WOCX18",
      "agentName": "***",
      "agentStatus": "CREATING",
      "createdAt": "2026-06-29T21:54:05.421115401Z",
      "description": "***",
      "idleSessionTTLInSeconds": 60,
      "orchestrationType": "DEFAULT",
      "updatedAt": "2026-06-29T21:54:05.421115401Z"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::userIdentity.type` (elastic rule field)	in	`iamuser`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Agent Created by IAM User or Root source low: Identifies AWS Bedrock Agent creation performed directly by an IAM user or the root account. Bedrock Agents are autonomous AI systems that execute multi-step tasks, invoke Lambda action groups to call external APIs, and query knowledge bases. Adversaries with access to an AWS account can create rogue agents configured to exfiltrate data via action group Lambda functions, pivot to other services, or act as a persistent AI-driven command-and-control channel. This rule is scoped to IAMUser and Root identity types — AssumedRole sessions (which represent automated CI/CD pipelines and SSO-federated engineers) are excluded to avoid global false positives from legitimate deployment automation that varies widely across customer environments.T1505

CreateAgentActionGroup

Service: bedrock

Description

Creates an action group for a Bedrock agent, defining a set of API actions the agent can invoke.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Agent or Action Group Manipulation source medium: Detects modification of deployed Amazon Bedrock agents and their action groups, collaborators, or aliases via the Bedrock Agent control plane. Adversaries with access to an AWS account can tamper with an existing, trusted agent by altering its instructions (UpdateAgent), adding or changing action groups that wire the agent to Lambda functions or APIs (CreateAgentActionGroup, UpdateAgentActionGroup), attaching or modifying collaborators (AssociateAgentCollaborator, UpdateAgentCollaborator), or repointing an alias to a tampered version (CreateAgentAlias, UpdateAgentAlias). A PrepareAgent call is required to make a tampered configuration live. By implanting malicious behavior into an agent that legitimate users continue to invoke, an attacker can maintain durable access through a trusted component. Creation of brand-new agents (CreateAgent) is intentionally excluded as lower-signal activity.T1505↳ also matches AssociateAgentCollaborator, CreateAgentAlias, PrepareAgent, UpdateAgent, UpdateAgentActionGroup, UpdateAgentAlias, UpdateAgentCollaborator

CreateAgentAlias

Service: bedrock

Description

Creates an alias for a Bedrock agent that points to a specific agent version, enabling versioned deployments.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "c0464339-8682-4bec-87af-384c8f40db6d",
  "eventName": "CreateAgentAlias",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T21:54:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "8332a97c-c380-47bc-8a09-dc1e7941a62b",
  "requestParameters": {
    "agentAliasName": "***",
    "agentId": "1CK9WOCX18",
    "clientToken": "b45c9cd1-a0cd-4a6a-b410-5a404e47c6e3",
    "description": "***",
    "tags": {
      "Project": "dwfix"
    }
  },
  "responseElements": {
    "message": "Create operation can't be performed on AgentAlias when Agent is in Not Prepared state."
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Agent or Action Group Manipulation source medium: Detects modification of deployed Amazon Bedrock agents and their action groups, collaborators, or aliases via the Bedrock Agent control plane. Adversaries with access to an AWS account can tamper with an existing, trusted agent by altering its instructions (UpdateAgent), adding or changing action groups that wire the agent to Lambda functions or APIs (CreateAgentActionGroup, UpdateAgentActionGroup), attaching or modifying collaborators (AssociateAgentCollaborator, UpdateAgentCollaborator), or repointing an alias to a tampered version (CreateAgentAlias, UpdateAgentAlias). A PrepareAgent call is required to make a tampered configuration live. By implanting malicious behavior into an agent that legitimate users continue to invoke, an attacker can maintain durable access through a trusted component. Creation of brand-new agents (CreateAgent) is intentionally excluded as lower-signal activity.T1505↳ also matches AssociateAgentCollaborator, CreateAgentActionGroup, PrepareAgent, UpdateAgent, UpdateAgentActionGroup, UpdateAgentAlias, UpdateAgentCollaborator

CreateCustomModelDeployment

Service: bedrock

Description

Creates a deployment for a custom Amazon Bedrock model, making it available for inference.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered source medium: Detects when an AWS Bedrock custom model is imported or deployed, or when a marketplace model endpoint is created or registered, via the CreateModelImportJob, CreateCustomModelDeployment, CreateMarketplaceModelEndpoint, or RegisterMarketplaceModelEndpoint API calls. These actions introduce a model artifact from outside the organization's trusted training and approval pipeline. A backdoored, poisoned, or attacker-supplied model that downstream applications subsequently invoke represents a software supply-chain compromise. New model imports and marketplace endpoint registrations should be validated for artifact provenance (S3 source ownership), the registering identity, and whether the model originates from an approved internal pipeline.T1525↳ also matches CreateMarketplaceModelEndpoint, CreateModelImportJob, RegisterMarketplaceModelEndpoint

CreateDataSource

Service: bedrock

Description

Creates a data source for a Bedrock knowledge base, specifying the location and ingestion configuration for documents.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Knowledge Base or RAG Data Source Tampering source medium: Detects control-plane mutations to AWS Bedrock knowledge bases and their backing RAG data sources via CloudTrail. An adversary with access to Bedrock Agent APIs can poison the corpus that RAG-enabled models treat as authoritative by ingesting attacker-controlled documents (IngestKnowledgeBaseDocuments, StartIngestionJob), deleting legitimate documents (DeleteKnowledgeBaseDocuments), or repointing/altering the data source itself (CreateDataSource, UpdateDataSource, DeleteDataSource, UpdateKnowledgeBase). Because downstream applications and users trust model answers grounded in this stored data, tampering with the corpus is a stored data manipulation that can drive misinformation, fraud, or manipulated decisions at inference time. This is a New Terms rule that looks for the first time a given identity ARN performs one of these knowledge base or data source mutations within the history window.T1565, T1565.001↳ also matches DeleteDataSource, DeleteKnowledgeBase, DeleteKnowledgeBaseDocuments, IngestKnowledgeBaseDocuments, StartIngestionJob, UpdateDataSource, UpdateKnowledgeBase

CreateFoundationModelAgreement

Service: bedrock

Description

Creates an agreement to accept the end-user license terms for a foundation model, enabling access to that model.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T20:58:23Z",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "CreateFoundationModelAgreement",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#bedrock.create-foundation-model-agreement",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "requestParameters": null,
  "responseElements": null,
  "requestID": "2ddd7c8a-5d44-4a31-aa6f-452b2354aaa6",
  "eventID": "8c3e9d84-069f-4665-a3f5-7e99c602c669",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::errorCode` (elastic rule field)	in	`accessdenied`	1 rule	elastic
`aws::errorCode` (elastic rule field)	in	`accessdeniedexception`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Unauthorized Foundation Model Access Attempt source low: Identifies failed, access-denied attempts to enable account-level access to an Amazon Bedrock foundation model, either by granting a foundation-model entitlement, submitting a use case for model access, or creating a foundation-model agreement (accepting the EULA). These account-level "model access" actions unlock a foundation model so that it can subsequently be invoked. A principal that is repeatedly denied when attempting these actions may be a compromised or under-privileged identity probing for the ability to unlock expensive models (LLMjacking) or to establish a durable ability to invoke models. Unlike the companion rule that detects successful model-access grants, this rule surfaces the attempt itself, which is a high-signal indicator of credential boundary-testing even though access was not granted.T1098↳ also matches PutFoundationModelEntitlement, PutUseCaseForModelAccess
AWS Bedrock Foundation Model Access Enabled or Entitlement Granted source medium: Identifies when access to an Amazon Bedrock foundation model is enabled at the account level, either by granting a foundation-model entitlement, submitting a use case for model access, or creating a foundation-model agreement (accepting the EULA). These account-level "model access" actions unlock a foundation model so that it can subsequently be invoked. Adversaries or a compromised principal may enable model access to abuse expensive models (LLMjacking), to establish a durable ability to invoke models within the account, or to bypass organizational controls. This activity is distinct from changes to a resource-based model invocation policy and is identified by the Bedrock control-plane API calls that grant model entitlements and agreements.T1098↳ also matches PutFoundationModelEntitlement, PutUseCaseForModelAccess

CreateMarketplaceModelEndpoint

Service: bedrock

Description

Creates an endpoint for a model subscribed through AWS Marketplace, making it available for Bedrock inference.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered source medium: Detects when an AWS Bedrock custom model is imported or deployed, or when a marketplace model endpoint is created or registered, via the CreateModelImportJob, CreateCustomModelDeployment, CreateMarketplaceModelEndpoint, or RegisterMarketplaceModelEndpoint API calls. These actions introduce a model artifact from outside the organization's trusted training and approval pipeline. A backdoored, poisoned, or attacker-supplied model that downstream applications subsequently invoke represents a software supply-chain compromise. New model imports and marketplace endpoint registrations should be validated for artifact provenance (S3 source ownership), the registering identity, and whether the model originates from an approved internal pipeline.T1525↳ also matches CreateCustomModelDeployment, CreateModelImportJob, RegisterMarketplaceModelEndpoint

CreateModelImportJob

Service: bedrock

Description

Creates a job to import a custom model into Amazon Bedrock from an external source such as Amazon S3.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered source medium: Detects when an AWS Bedrock custom model is imported or deployed, or when a marketplace model endpoint is created or registered, via the CreateModelImportJob, CreateCustomModelDeployment, CreateMarketplaceModelEndpoint, or RegisterMarketplaceModelEndpoint API calls. These actions introduce a model artifact from outside the organization's trusted training and approval pipeline. A backdoored, poisoned, or attacker-supplied model that downstream applications subsequently invoke represents a software supply-chain compromise. New model imports and marketplace endpoint registrations should be validated for artifact provenance (S3 source ownership), the registering identity, and whether the model originates from an approved internal pipeline.T1525↳ also matches CreateCustomModelDeployment, CreateMarketplaceModelEndpoint, RegisterMarketplaceModelEndpoint

CreateProvisionedModelThroughput

Service: bedrock

Description

Creates a provisioned throughput allocation for a Bedrock foundation or custom model, reserving dedicated inference capacity.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Provisioned Model Throughput Tampering source medium: Detects creation, modification, or deletion of AWS Bedrock Provisioned Model Throughput via the CreateProvisionedModelThroughput, UpdateProvisionedModelThroughput, and DeleteProvisionedModelThroughput APIs. Provisioned Throughput reserves dedicated, billed model capacity for Amazon Bedrock. An adversary who scales this capacity up can drive large, unauthorized cost (cloud resource/bill hijacking), while deleting reserved throughput can cause denial of service to production workloads that depend on that committed capacity. These control-plane changes should be validated against approved capacity-planning and change-management processes.T1496, T1496.004↳ also matches DeleteProvisionedModelThroughput, UpdateProvisionedModelThroughput

DeleteAutomatedReasoningPolicy

Service: bedrock

Description

Deletes an automated reasoning policy from Amazon Bedrock, removing its constraints from model invocations.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Automated Reasoning Safety Policy Tampering source medium: Detects deletion or modification of AWS Bedrock Automated Reasoning policies via the DeleteAutomatedReasoningPolicy, UpdateAutomatedReasoningPolicy, or UpdateAutomatedReasoningPolicyAnnotations CloudTrail actions. Automated Reasoning policies are a Bedrock safety and validation control that constrains model outputs against formal rules. An adversary who deletes a policy or alters the policy definition or its annotations weakens an enforced output-validation defense, potentially allowing unsafe or non-compliant model responses to pass unchecked. Benign build, test-workflow, and test-case CRUD operations are intentionally excluded as they have no coherent abuse path.T1562, T1562.001↳ also matches UpdateAutomatedReasoningPolicy, UpdateAutomatedReasoningPolicyAnnotations

DeleteDataSource

Service: bedrock

Description

Deletes a data source from a Bedrock knowledge base, removing it from future ingestion operations.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "f94f0b19-1472-491a-9f30-951f465400ad",
  "eventName": "DeleteDataSource",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ebf8c748-6ed0-4692-8e57-b0dc2c278a00",
  "requestParameters": {
    "dataSourceId": "dw-probe",
    "knowledgeBaseId": "dw-probe"
  },
  "responseElements": {
    "Access-Control-Expose-Headers": "x-amzn-errortype,x-amzn-requestid,x-amzn-trace-id",
    "message": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: bedrock:DeleteDataSource"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Knowledge Base or RAG Data Source Tampering source medium: Detects control-plane mutations to AWS Bedrock knowledge bases and their backing RAG data sources via CloudTrail. An adversary with access to Bedrock Agent APIs can poison the corpus that RAG-enabled models treat as authoritative by ingesting attacker-controlled documents (IngestKnowledgeBaseDocuments, StartIngestionJob), deleting legitimate documents (DeleteKnowledgeBaseDocuments), or repointing/altering the data source itself (CreateDataSource, UpdateDataSource, DeleteDataSource, UpdateKnowledgeBase). Because downstream applications and users trust model answers grounded in this stored data, tampering with the corpus is a stored data manipulation that can drive misinformation, fraud, or manipulated decisions at inference time. This is a New Terms rule that looks for the first time a given identity ARN performs one of these knowledge base or data source mutations within the history window.T1565, T1565.001↳ also matches CreateDataSource, DeleteKnowledgeBase, DeleteKnowledgeBaseDocuments, IngestKnowledgeBaseDocuments, StartIngestionJob, UpdateDataSource, UpdateKnowledgeBase

DeleteEnforcedGuardrailConfiguration

Service: bedrock

Description

Deletes the enforced guardrail configuration, removing the requirement to apply a specific guardrail to model invocations.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value 'dw-probe' at 'configId' failed to satisfy constraint: Member must satisfy regular expression pattern: [a-z0-9]+",
  "eventCategory": "Management",
  "eventID": "96421b28-d857-493a-9f1a-2a39b873052f",
  "eventName": "DeleteEnforcedGuardrailConfiguration",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "75cc3cb5-d673-4286-9589-ea0e77f2db11",
  "requestParameters": {
    "configId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Guardrail Deleted or Weakened source medium: Detects deletion, weakening, or version management of AWS Bedrock guardrails via the DeleteGuardrail, UpdateGuardrail, DeleteEnforcedGuardrailConfiguration, or PutEnforcedGuardrailConfiguration APIs. Bedrock guardrails enforce content, topic, word, and sensitive-information policies on model invocations. Deleting a guardrail, loosening its policies, removing or overwriting the organization-enforced guardrail configuration, or creating a new version to enforce a weakened configuration allows an adversary to bypass these protections — the cloud control-plane equivalent of disabling a security tool. This activity should be validated against approved change management and the responsible identity.T1562, T1562.001↳ also matches DeleteGuardrail, PutEnforcedGuardrailConfiguration, UpdateGuardrail

DeleteGuardrail

Service: bedrock

Description

Deletes a Bedrock guardrail resource, removing the content filtering and safety policies it defined.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "10324bee-a371-4b19-aa2e-a5e7b01e2ea4",
  "eventName": "DeleteGuardrail",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2025-02-25T23:14:21Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "111111111111111",
  "requestID": "7bb8db01-f50c-4294-b194-26e41fb08a65",
  "requestParameters": {
    "guardrailIdentifier": "bvl2dp3mzcyw"
  },
  "responseElements": null,
  "sessionCredentialFromConsole": "true",
  "sourceIPAddress": "23.93.242.200",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-2.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36",
  "userIdentity": {
    "accessKeyId": "ASIAAAAAAAAAAAAAAAA",
    "accountId": "111111111111111",
    "arn": "arn:aws:sts::111111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/dafpunk",
    "principalId": "ARSSSSSSSSSSSSSSSSSS:dafpunk",
    "sessionContext": {
      "attributes": {
        "creationDate": "2025-02-25T20:18:43Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111111",
        "arn": "arn:aws:iam::111111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f",
        "principalId": "ARSSSSSSSSSSSSSSSSSS",
        "type": "Role",
        "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"
      }
    },
    "type": "AssumedRole"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

AWS Bedrock Guardrail Deleted source medium: Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow unsafe or unauthorized model responses.T1685

Elastic #

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action source high: Identifies an Amazon Bedrock API key (bearer token) being used to perform a destructive or anti-recovery control-plane action, such as deleting a guardrail, deleting a custom or imported model, removing provisioned throughput, or disabling model invocation logging. Bedrock API keys are bearer credentials intended for model invocation (InvokeModel, Converse); using one to delete Bedrock resources or disable logging is inconsistent with that purpose and is characteristic of LLMjacking or sabotage following key theft. Every Bedrock API key call is identifiable in CloudTrail by "additionalEventData.callWithBearerToken" being true. The rule matches regardless of outcome, because a destructive attempt via a bearer token is suspicious even when denied.T1485, T1562, T1562.001↳ also matches DeleteModelInvocationLoggingConfiguration, DeleteProvisionedModelThroughput, PutModelInvocationLoggingConfiguration, DeleteCustomModel, DeleteImportedModel, DeleteMarketplaceModelEndpoint
AWS Bedrock Guardrail Deleted or Weakened source medium: Detects deletion, weakening, or version management of AWS Bedrock guardrails via the DeleteGuardrail, UpdateGuardrail, DeleteEnforcedGuardrailConfiguration, or PutEnforcedGuardrailConfiguration APIs. Bedrock guardrails enforce content, topic, word, and sensitive-information policies on model invocations. Deleting a guardrail, loosening its policies, removing or overwriting the organization-enforced guardrail configuration, or creating a new version to enforce a weakened configuration allows an adversary to bypass these protections — the cloud control-plane equivalent of disabling a security tool. This activity should be validated against approved change management and the responsible identity.T1562, T1562.001↳ also matches DeleteEnforcedGuardrailConfiguration, PutEnforcedGuardrailConfiguration, UpdateGuardrail

Splunk #

AWS Bedrock Delete GuardRails source: The following analytic identifies attempts to delete AWS Bedrock GuardRails, which are security controls designed to prevent harmful, biased, or inappropriate AI outputs. It leverages AWS CloudTrail logs to detect when a user or service…T1685, T1685.002

Panther #

AWS Bedrock Guardrail Updated or Deleted source medium: An Amazon Bedrock Guardrail was updated or deleted. Amazon Bedrock Guardrails are used to implement application-specific safeguards based on your use cases and responsible AI policies. Updating or deleting a guardrail can have security implications to your AI workloads.T1562.001↳ also matches UpdateGuardrail

References #

Sample log: splunk/attack_data

DeleteKnowledgeBase

Service: bedrock

Description

Deletes a Bedrock knowledge base and its associated configuration, disconnecting it from any associated agents and data sources.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "bff5a344-3908-41f0-bb57-d57a01014ff3",
  "eventName": "DeleteKnowledgeBase",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2025-04-03T23:49:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "111111111111111",
  "requestID": "9dfbaf92-e781-4837-ad53-d72e20be1ac2",
  "requestParameters": {
    "knowledgeBaseId": "T9PFUXGAPO"
  },
  "responseElements": {
    "Access-Control-Expose-Headers": "x-amzn-Apigw-id,x-amzn-ErrorMessage,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-Trace-id,refreshtoken,Date",
    "knowledgeBaseId": "T9PFUXGAPO",
    "status": "DELETING"
  },
  "sourceIPAddress": "23.93.242.200",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLLIVGGYLX",
    "accountId": "111111111111111",
    "arn": "arn:aws:sts::111111111111111:assumed-role/redacted/daftpunk@splunk.com",
    "principalId": "ARADDDDDDDDDDDDDDDD",
    "sessionContext": {
      "attributes": {
        "creationDate": "2025-04-03T21:50:08Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111111",
        "arn": "arn:aws:iam::111111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/redacted",
        "principalId": "AROAYTOGP2RLDF6WP4HD6",
        "type": "Role",
        "userName": "redacted"
      }
    },
    "type": "AssumedRole"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Knowledge Base or RAG Data Source Tampering source medium: Detects control-plane mutations to AWS Bedrock knowledge bases and their backing RAG data sources via CloudTrail. An adversary with access to Bedrock Agent APIs can poison the corpus that RAG-enabled models treat as authoritative by ingesting attacker-controlled documents (IngestKnowledgeBaseDocuments, StartIngestionJob), deleting legitimate documents (DeleteKnowledgeBaseDocuments), or repointing/altering the data source itself (CreateDataSource, UpdateDataSource, DeleteDataSource, UpdateKnowledgeBase). Because downstream applications and users trust model answers grounded in this stored data, tampering with the corpus is a stored data manipulation that can drive misinformation, fraud, or manipulated decisions at inference time. This is a New Terms rule that looks for the first time a given identity ARN performs one of these knowledge base or data source mutations within the history window.T1565, T1565.001↳ also matches CreateDataSource, DeleteDataSource, DeleteKnowledgeBaseDocuments, IngestKnowledgeBaseDocuments, StartIngestionJob, UpdateDataSource, UpdateKnowledgeBase

Splunk #

AWS Bedrock Delete Knowledge Base source: The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. It monitors AWS CloudTrail logs for DeleteKnowledgeBase API calls. This…T1485

References #

Sample log: splunk/attack_data

DeleteKnowledgeBaseDocuments

Service: bedrock

Description

Deletes specific documents from a Bedrock knowledge base data source, removing them from the index.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "3db010ae-a210-43de-9221-421474fb71d6",
  "eventName": "DeleteKnowledgeBaseDocuments",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "aa30b886-7336-4ae9-91a2-080d5043e067",
  "requestParameters": {
    "clientToken": "e475949b-026c-46a4-801c-9ec2cbeff61c",
    "dataSourceId": "dw-probe",
    "documentIdentifiers": [
      {
        "dataSourceType": "CUSTOM"
      }
    ],
    "knowledgeBaseId": "dw-probe"
  },
  "responseElements": {
    "Access-Control-Expose-Headers": "x-amzn-errortype,x-amzn-requestid,x-amzn-trace-id",
    "message": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: bedrock:DeleteKnowledgeBaseDocuments"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Knowledge Base or RAG Data Source Tampering source medium: Detects control-plane mutations to AWS Bedrock knowledge bases and their backing RAG data sources via CloudTrail. An adversary with access to Bedrock Agent APIs can poison the corpus that RAG-enabled models treat as authoritative by ingesting attacker-controlled documents (IngestKnowledgeBaseDocuments, StartIngestionJob), deleting legitimate documents (DeleteKnowledgeBaseDocuments), or repointing/altering the data source itself (CreateDataSource, UpdateDataSource, DeleteDataSource, UpdateKnowledgeBase). Because downstream applications and users trust model answers grounded in this stored data, tampering with the corpus is a stored data manipulation that can drive misinformation, fraud, or manipulated decisions at inference time. This is a New Terms rule that looks for the first time a given identity ARN performs one of these knowledge base or data source mutations within the history window.T1565, T1565.001↳ also matches CreateDataSource, DeleteDataSource, DeleteKnowledgeBase, IngestKnowledgeBaseDocuments, StartIngestionJob, UpdateDataSource, UpdateKnowledgeBase

DeleteModelInvocationLoggingConfiguration

Service: bedrock

Description

Deletes the model invocation logging configuration for the account, stopping the logging of Bedrock inference requests and responses.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::111111111111111:user/daftpunk is not authorized to perform: bedrock:DeleteModelInvocationLoggingConfiguration because no identity-based policy allows the bedrock:DeleteModelInvocationLoggingConfiguration action",
  "eventCategory": "Management",
  "eventID": "1f7bd76f-13fb-4dff-b9bb-95a466217721",
  "eventName": "DeleteModelInvocationLoggingConfiguration",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2025-04-03T17:16:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "111111111111111",
  "requestID": "11519ac6-2761-4434-813a-585547a59096",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "4.5.6.7",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-2.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "aws-cli/2.24.22 md/awscrt#0.23.8 ua/2.1 os/macos#24.3.0 md/arch#arm64 lang/python#3.12.9 md/pyimpl#CPython cfg/retry-mode#standard md/installer#source md/prompt#off md/command#bedrock.delete-model-invocation-logging-configuration",
  "userIdentity": {
    "accessKeyId": "AKIAYTOGP2RLD45A4NGA",
    "accountId": "111111111111111",
    "arn": "arn:aws:iam::111111111111111:user/daftpunk",
    "principalId": "AAAAAAAAAAAAAAAAAAAAAA",
    "type": "IAMUser",
    "userName": "daftpunk"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Model Invocation Logging Disabled or Modified source high: Detects when an AWS Bedrock model invocation logging configuration is deleted or overwritten via the DeleteModelInvocationLoggingConfiguration or PutModelInvocationLoggingConfiguration API calls. Model invocation logging is the source that feeds the logs-aws_bedrock.invocation-* dataset relied upon by all data-plane Bedrock detections. An adversary who has gained access to a Bedrock environment can blind defenders by deleting this configuration, or by using the Put API to redirect logs to an attacker-controlled or non-monitored S3 bucket or CloudWatch log group. Because this single control-plane action can neutralize the entire data-plane detection stack, it is a high-value evasion technique that should be validated against expected administrative change activity.T1562, T1562.008↳ also matches PutModelInvocationLoggingConfiguration
AWS Bedrock API Key Used for Destructive or Anti-Recovery Action source high: Identifies an Amazon Bedrock API key (bearer token) being used to perform a destructive or anti-recovery control-plane action, such as deleting a guardrail, deleting a custom or imported model, removing provisioned throughput, or disabling model invocation logging. Bedrock API keys are bearer credentials intended for model invocation (InvokeModel, Converse); using one to delete Bedrock resources or disable logging is inconsistent with that purpose and is characteristic of LLMjacking or sabotage following key theft. Every Bedrock API key call is identifiable in CloudTrail by "additionalEventData.callWithBearerToken" being true. The rule matches regardless of outcome, because a destructive attempt via a bearer token is suspicious even when denied.T1485, T1562, T1562.001↳ also matches DeleteGuardrail, DeleteProvisionedModelThroughput, PutModelInvocationLoggingConfiguration, DeleteCustomModel, DeleteImportedModel, DeleteMarketplaceModelEndpoint

Splunk #

AWS Bedrock Delete Model Invocation Logging Configuration source: The following analytic identifies attempts to delete AWS Bedrock model invocation logging configurations. It leverages AWS CloudTrail logs to detect when a user or service calls the DeleteModelInvocationLogging API. This activity is…T1685, T1685.002

Panther #

AWS Bedrock Model Invocation Logging Configuration Deleted source medium: An Amazon Bedrock Model Invocation Logging Configuration was deleted. Use model invocation logging to collect metadata, requests, and responses for all model invocations in your account. Deleting a model invocation logging configuration can have security implications to your AI workloads.T1562.003

References #

Sample log: splunk/attack_data

DeleteProvisionedModelThroughput

Service: bedrock

Description

Deletes a provisioned throughput allocation for a Bedrock model, releasing the reserved inference capacity.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action source high: Identifies an Amazon Bedrock API key (bearer token) being used to perform a destructive or anti-recovery control-plane action, such as deleting a guardrail, deleting a custom or imported model, removing provisioned throughput, or disabling model invocation logging. Bedrock API keys are bearer credentials intended for model invocation (InvokeModel, Converse); using one to delete Bedrock resources or disable logging is inconsistent with that purpose and is characteristic of LLMjacking or sabotage following key theft. Every Bedrock API key call is identifiable in CloudTrail by "additionalEventData.callWithBearerToken" being true. The rule matches regardless of outcome, because a destructive attempt via a bearer token is suspicious even when denied.T1485, T1562, T1562.001↳ also matches DeleteGuardrail, DeleteModelInvocationLoggingConfiguration, PutModelInvocationLoggingConfiguration, DeleteCustomModel, DeleteImportedModel, DeleteMarketplaceModelEndpoint
AWS Bedrock Provisioned Model Throughput Tampering source medium: Detects creation, modification, or deletion of AWS Bedrock Provisioned Model Throughput via the CreateProvisionedModelThroughput, UpdateProvisionedModelThroughput, and DeleteProvisionedModelThroughput APIs. Provisioned Throughput reserves dedicated, billed model capacity for Amazon Bedrock. An adversary who scales this capacity up can drive large, unauthorized cost (cloud resource/bill hijacking), while deleting reserved throughput can cause denial of service to production workloads that depend on that committed capacity. These control-plane changes should be validated against approved capacity-planning and change-management processes.T1496, T1496.004↳ also matches CreateProvisionedModelThroughput, UpdateProvisionedModelThroughput

DeleteResourcePolicy

Service: bedrock

Description

Deletes a resource-based policy attached to a Bedrock resource, removing the access permissions it granted.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "eventCategory": "Management",
  "eventID": "c19d5111-9586-4f34-b104-10ba079b1b62",
  "eventName": "DeleteResourcePolicy",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "2797f5e9-5f54-41dc-9aba-6f1efe3d34a9",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::errorCode` (elastic rule field)	in	`accessdenied`	1 rule	elastic
`aws::errorCode` (elastic rule field)	in	`accessdeniedexception`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt source low: Detects failed, access-denied attempts to modify or delete resource-based access policies on AWS Bedrock resources via the PutResourcePolicy and DeleteResourcePolicy API calls. Resource-based policies govern which principals (including external accounts) may access Bedrock resources such as agents, knowledge bases, and custom models. A principal that is repeatedly denied when attempting to attach or remove these policies may be a compromised or under-privileged identity probing for the ability to grant external or cross-account access, or to weaken existing access controls. Unlike the companion rule that detects successful changes, this rule surfaces the attempt itself, which is a high-signal indicator of credential boundary-testing even though no change occurred.T1098↳ also matches PutResourcePolicy
AWS Bedrock Resource-Based Policy Modified or Deleted source medium: Detects modification or deletion of resource-based access policies on AWS Bedrock resources via the PutResourcePolicy and DeleteResourcePolicy API calls. Resource-based policies govern which principals (including external accounts) may access Bedrock resources such as agents, knowledge bases, and custom models. An adversary may attach a resource policy granting an external or unexpected principal access to a Bedrock resource to establish persistence or enable cross-account access, or may delete an existing policy to weaken access controls. These changes should be validated for principal ownership and least-privilege intent.T1098↳ also matches PutResourcePolicy

IngestKnowledgeBaseDocuments

Service: bedrock

Description

Directly ingests documents into a Bedrock knowledge base data source without starting a full ingestion job.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Knowledge Base or RAG Data Source Tampering source medium: Detects control-plane mutations to AWS Bedrock knowledge bases and their backing RAG data sources via CloudTrail. An adversary with access to Bedrock Agent APIs can poison the corpus that RAG-enabled models treat as authoritative by ingesting attacker-controlled documents (IngestKnowledgeBaseDocuments, StartIngestionJob), deleting legitimate documents (DeleteKnowledgeBaseDocuments), or repointing/altering the data source itself (CreateDataSource, UpdateDataSource, DeleteDataSource, UpdateKnowledgeBase). Because downstream applications and users trust model answers grounded in this stored data, tampering with the corpus is a stored data manipulation that can drive misinformation, fraud, or manipulated decisions at inference time. This is a New Terms rule that looks for the first time a given identity ARN performs one of these knowledge base or data source mutations within the history window.T1565, T1565.001↳ also matches CreateDataSource, DeleteDataSource, DeleteKnowledgeBase, DeleteKnowledgeBaseDocuments, StartIngestionJob, UpdateDataSource, UpdateKnowledgeBase

InvokeModel

Service: bedrock

Description

Invokes an Amazon Bedrock foundation, imported, or provisioned model with a single synchronous request payload.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "errorCode": "AccessDenied",
  "errorMessage": "You don't have access to the model with the specified model ID.",
  "eventCategory": "Management",
  "eventID": "77aff6ab-7f71-404c-aadc-3ff69662f34b",
  "eventName": "InvokeModel",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2025-04-03T23:33:54Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "111111111111111",
  "requestID": "a9a17112-2e26-44fa-aad0-f6aed72ee081",
  "requestParameters": {
    "modelId": "arn:aws:bedrock:us-west-2::foundation-model/amazon.titan-embed-text-v2:0"
  },
  "responseElements": null,
  "sourceIPAddress": "bedrock.amazonaws.com",
  "userAgent": "bedrock.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLHPS75WT7",
    "accountId": "111111111111111",
    "arn": "arn:aws:sts::111111111111111:assumed-role/AmazonBedrockExecutionRoleForKnowledgeBase_dwrx4/BKB-CP-T9PFUXGAPO-IeEjZHDYvHcEamQ=",
    "invokedBy": "bedrock.amazonaws.com",
    "principalId": "AROOOOOOOOOOOOOOO:BKB-CP-T9PFUXGAPO-IeEjZHDYvHcEamQ=",
    "sessionContext": {
      "attributes": {
        "creationDate": "2025-04-03T23:33:54Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111111",
        "arn": "arn:aws:iam::111111111111111:role/service-role/AmazonBedrockExecutionRoleForKnowledgeBase_dwrx4",
        "principalId": "AROOOOOOOOOOOOOOO",
        "type": "Role",
        "userName": "AmazonBedrockExecutionRoleForKnowledgeBase_dwrx4"
      }
    },
    "type": "AssumedRole"
  },
  "vpcEndpointId": "vpce-021c8cd79f64c2f84"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::requestParameters` (elastic rule field)	is_not_null		1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock High-Frequency Single-Model Inference API Probing source medium: Identifies an AWS principal performing a high volume of Amazon Bedrock inference API calls against a single model within a short window. Membership inference attacks require hundreds to thousands of statistically similar queries whose prompts and responses are intentionally content-benign, making guardrail- and content-based rules ineffective. This rule detects the high-frequency single-model probing pattern that precedes membership inference and related exfiltration via the inference API. It is a behavioral / volumetric precursor: it does not observe model confidence scores and a fixed call-count threshold only catches the loud variant, so paced, low-and-slow, or credential-distributed probing will evade it. Definitive membership inference detection requires ML anomaly analysis over per-entity inference-rate and response-distribution baselines.↳ also matches Converse, ConverseStream, InvokeModelWithResponseStream

Splunk #

AWS Bedrock Invoke Model Access Denied source: The following analytic identifies access denied error when attempting to invoke AWS Bedrock models. It leverages AWS CloudTrail logs to detect when a user or service receives an AccessDenied error when calling the InvokeModel API. This…T1078, T1550

References #

Sample log: splunk/attack_data

InvokeModelWithResponseStream

Service: bedrock

Description

Invokes an Amazon Bedrock model and streams the response back as a series of chunks using the response body.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "The provided model identifier is invalid.",
  "eventCategory": "Management",
  "eventID": "c7a24098-8eb1-4de3-84c4-17d427c9f557",
  "eventName": "InvokeModelWithResponseStream",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:42Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "84fb422d-554e-47e7-8b75-d6722337acf2",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock-runtime.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::requestParameters` (elastic rule field)	is_not_null		1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock High-Frequency Single-Model Inference API Probing source medium: Identifies an AWS principal performing a high volume of Amazon Bedrock inference API calls against a single model within a short window. Membership inference attacks require hundreds to thousands of statistically similar queries whose prompts and responses are intentionally content-benign, making guardrail- and content-based rules ineffective. This rule detects the high-frequency single-model probing pattern that precedes membership inference and related exfiltration via the inference API. It is a behavioral / volumetric precursor: it does not observe model confidence scores and a fixed call-count threshold only catches the loud variant, so paced, low-and-slow, or credential-distributed probing will evade it. Definitive membership inference detection requires ML anomaly analysis over per-entity inference-rate and response-distribution baselines.↳ also matches Converse, ConverseStream, InvokeModel

ListFoundationModels

Service: bedrock

Description

Returns a list of Amazon Bedrock foundation models available for use, including their providers, modalities, and inference types.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::111111111111111:user/daftpunk is not authorized to perform: bedrock:ListFoundationModels because no identity-based policy allows the bedrock:ListFoundationModels action",
  "eventCategory": "Management",
  "eventID": "5b517f80-fa2d-47be-9102-bd78fcec69c6",
  "eventName": "ListFoundationModels",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2025-04-01T23:48:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "111111111111111",
  "requestID": "775b0834-402e-44dc-be92-739f46996685",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "7.6.5.4",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "aws-cli/2.24.22 md/awscrt#0.23.8 ua/2.1 os/macos#24.3.0 md/arch#arm64 lang/python#3.12.9 md/pyimpl#CPython cfg/retry-mode#standard md/installer#source md/prompt#off md/command#bedrock.list-foundation-models",
  "userIdentity": {
    "accessKeyId": "AKIAYTOGP2RLD45A4NGA",
    "accountId": "111111111111111",
    "arn": "arn:aws:iam::111111111111111:user/daftpunk",
    "principalId": "AIDAAAAAAAAAAAAAAAA",
    "type": "IAMUser",
    "userName": "daftpunk"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::userIdentity.accessKeyId` (elastic rule field)	starts_with	`AKIA`	1 rule	elastic
`aws::userIdentity.arn` (elastic rule field)	is_not_null		1 rule	elastic
`count` (splunk rule field)	gt	`9`	1 rule	splunk
`source.as.number` (elastic rule field)	in	`9009`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key source high: Detects when an AWS principal using long-term IAM user credentials (AKIA* access key) enumerates available Bedrock foundation models and then invokes a model within the same 15-minute window. Most legitimate Bedrock workloads run under IAM roles with short-lived credentials; the combination of model enumeration followed by direct model invocation from a long-term IAM user key is unusual in production environments and consistent with an adversary using stolen credentials to discover and exploit available AI model capabilities. This pattern is associated with LLMjacking attacks where threat actors abuse compromised cloud credentials to run high-volume or high-cost model inference at the account owner's expense.T1078, T1078.004, T1526
AWS Discovery API Calls from VPN ASN for the First Time by Identity source high: Flags the first time a given IAM principal invokes a narrow set of high-signal discovery APIs (credential check, account and IAM enumeration, bucket and compute inventory, logging introspection) from a source IP whose autonomous system number (ASN) matches a curated set commonly associated with consumer VPN brands, VPN-heavy hosting, and provider networks referenced in public reporting on TeamPCP activity (for example 31173 Services AB AS39351 and Oy Crea Nova Hosting Solution Ltd). Broad List*/Describe* patterns are intentionally omitted to reduce noise. Hosting ASNs are heavily dual-use; validate source.as.number in your data and extend event.action only when your baseline allows it.T1526, T1580

Splunk #

AWS Bedrock High Number List Foundation Model Failures source: The following analytic identifies an high number of AccessDenied attempts to list AWS Bedrock foundation models. It leverages AWS CloudTrail logs to detect when a user or service experiences multiple failures when calling the…T1580

References #

Sample log: splunk/attack_data

PrepareAgent

Service: bedrock

Description

Prepares a Bedrock agent for use by packaging its latest configuration and creating a working draft version ready for testing or deployment.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "eeeed2de-e196-4f93-9a08-7ace04f84594",
  "eventName": "PrepareAgent",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T21:54:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "e7584d1f-456e-41eb-b5be-0d97eb1b4f14",
  "requestParameters": {
    "agentId": "1CK9WOCX18"
  },
  "responseElements": {
    "message": "Agent roleArn cannot be null"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Agent or Action Group Manipulation source medium: Detects modification of deployed Amazon Bedrock agents and their action groups, collaborators, or aliases via the Bedrock Agent control plane. Adversaries with access to an AWS account can tamper with an existing, trusted agent by altering its instructions (UpdateAgent), adding or changing action groups that wire the agent to Lambda functions or APIs (CreateAgentActionGroup, UpdateAgentActionGroup), attaching or modifying collaborators (AssociateAgentCollaborator, UpdateAgentCollaborator), or repointing an alias to a tampered version (CreateAgentAlias, UpdateAgentAlias). A PrepareAgent call is required to make a tampered configuration live. By implanting malicious behavior into an agent that legitimate users continue to invoke, an attacker can maintain durable access through a trusted component. Creation of brand-new agents (CreateAgent) is intentionally excluded as lower-signal activity.T1505↳ also matches AssociateAgentCollaborator, CreateAgentActionGroup, CreateAgentAlias, UpdateAgent, UpdateAgentActionGroup, UpdateAgentAlias, UpdateAgentCollaborator

PutEnforcedGuardrailConfiguration

Service: bedrock

Description

Sets an enforced guardrail configuration that mandates a specific guardrail be applied to all model invocations in the account.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T20:58:25Z",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "PutEnforcedGuardrailConfiguration",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#bedrock.put-enforced-guardrail-configuration",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "The configId specified in the request does not exist.",
  "requestParameters": {
    "configId": "dweb7866",
    "guardrailInferenceConfig": {
      "guardrailIdentifier": "0000000000",
      "guardrailVersion": "1",
      "modelEnforcement": {
        "includedModels": [
          "ALL"
        ],
        "excludedModels": []
      }
    }
  },
  "responseElements": null,
  "requestID": "5f224a0a-ba2f-41bc-a30e-8918d9328f88",
  "eventID": "e223954b-7255-4665-beae-da3e7656e417",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Guardrail Deleted or Weakened source medium: Detects deletion, weakening, or version management of AWS Bedrock guardrails via the DeleteGuardrail, UpdateGuardrail, DeleteEnforcedGuardrailConfiguration, or PutEnforcedGuardrailConfiguration APIs. Bedrock guardrails enforce content, topic, word, and sensitive-information policies on model invocations. Deleting a guardrail, loosening its policies, removing or overwriting the organization-enforced guardrail configuration, or creating a new version to enforce a weakened configuration allows an adversary to bypass these protections — the cloud control-plane equivalent of disabling a security tool. This activity should be validated against approved change management and the responsible identity.T1562, T1562.001↳ also matches DeleteEnforcedGuardrailConfiguration, DeleteGuardrail, UpdateGuardrail

PutFoundationModelEntitlement

Service: bedrock

Description

Sets the entitlement for a foundation model, granting access rights to the specified model for the account.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::errorCode` (elastic rule field)	in	`accessdenied`	1 rule	elastic
`aws::errorCode` (elastic rule field)	in	`accessdeniedexception`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Unauthorized Foundation Model Access Attempt source low: Identifies failed, access-denied attempts to enable account-level access to an Amazon Bedrock foundation model, either by granting a foundation-model entitlement, submitting a use case for model access, or creating a foundation-model agreement (accepting the EULA). These account-level "model access" actions unlock a foundation model so that it can subsequently be invoked. A principal that is repeatedly denied when attempting these actions may be a compromised or under-privileged identity probing for the ability to unlock expensive models (LLMjacking) or to establish a durable ability to invoke models. Unlike the companion rule that detects successful model-access grants, this rule surfaces the attempt itself, which is a high-signal indicator of credential boundary-testing even though access was not granted.T1098↳ also matches CreateFoundationModelAgreement, PutUseCaseForModelAccess
AWS Bedrock Foundation Model Access Enabled or Entitlement Granted source medium: Identifies when access to an Amazon Bedrock foundation model is enabled at the account level, either by granting a foundation-model entitlement, submitting a use case for model access, or creating a foundation-model agreement (accepting the EULA). These account-level "model access" actions unlock a foundation model so that it can subsequently be invoked. Adversaries or a compromised principal may enable model access to abuse expensive models (LLMjacking), to establish a durable ability to invoke models within the account, or to bypass organizational controls. This activity is distinct from changes to a resource-based model invocation policy and is identified by the Bedrock control-plane API calls that grant model entitlements and agreements.T1098↳ also matches CreateFoundationModelAgreement, PutUseCaseForModelAccess

PutModelInvocationLoggingConfiguration

Service: bedrock

Description

Configures logging for Amazon Bedrock model invocations, directing request and response data to CloudWatch Logs or S3.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "At least one logging config must be specified.",
  "eventCategory": "Management",
  "eventID": "3ea94e57-d7d3-4770-bdd0-5ae7202c6bab",
  "eventName": "PutModelInvocationLoggingConfiguration",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T21:53:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "44cba63e-d841-4d44-b0ac-0c8882552ec3",
  "requestParameters": {
    "loggingConfig": {
      "audioDataDeliveryEnabled": false,
      "embeddingDataDeliveryEnabled": false,
      "imageDataDeliveryEnabled": false,
      "textDataDeliveryEnabled": false,
      "videoDataDeliveryEnabled": false
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Model Invocation Logging Disabled or Modified source high: Detects when an AWS Bedrock model invocation logging configuration is deleted or overwritten via the DeleteModelInvocationLoggingConfiguration or PutModelInvocationLoggingConfiguration API calls. Model invocation logging is the source that feeds the logs-aws_bedrock.invocation-* dataset relied upon by all data-plane Bedrock detections. An adversary who has gained access to a Bedrock environment can blind defenders by deleting this configuration, or by using the Put API to redirect logs to an attacker-controlled or non-monitored S3 bucket or CloudWatch log group. Because this single control-plane action can neutralize the entire data-plane detection stack, it is a high-value evasion technique that should be validated against expected administrative change activity.T1562, T1562.008↳ also matches DeleteModelInvocationLoggingConfiguration
AWS Bedrock API Key Used for Destructive or Anti-Recovery Action source high: Identifies an Amazon Bedrock API key (bearer token) being used to perform a destructive or anti-recovery control-plane action, such as deleting a guardrail, deleting a custom or imported model, removing provisioned throughput, or disabling model invocation logging. Bedrock API keys are bearer credentials intended for model invocation (InvokeModel, Converse); using one to delete Bedrock resources or disable logging is inconsistent with that purpose and is characteristic of LLMjacking or sabotage following key theft. Every Bedrock API key call is identifiable in CloudTrail by "additionalEventData.callWithBearerToken" being true. The rule matches regardless of outcome, because a destructive attempt via a bearer token is suspicious even when denied.T1485, T1562, T1562.001↳ also matches DeleteGuardrail, DeleteModelInvocationLoggingConfiguration, DeleteProvisionedModelThroughput, DeleteCustomModel, DeleteImportedModel, DeleteMarketplaceModelEndpoint

PutResourcePolicy

Service: bedrock

Description

Attaches or replaces a resource-based policy on a Bedrock resource, controlling cross-account or cross-service access.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDAEXAMPLE00000000",
    "arn": "arn:aws:iam::123456789012:user/dw-sample-collector",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "userName": "dw-sample-collector"
  },
  "eventTime": "2026-07-02T16:27:12Z",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "PutResourcePolicy",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#bedrock.put-resource-policy",
  "requestParameters": {
    "resourceArn": "arn:aws:bedrock:us-west-1:123456789012:guardrail/5o8pkust4fuo",
    "resourcePolicy": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "123456789012"
          },
          "Action": "bedrock:ApplyGuardrail",
          "Resource": "arn:aws:bedrock:us-west-1:123456789012:guardrail/5o8pkust4fuo"
        }
      ]
    }
  },
  "responseElements": {
    "resourceArn": "arn:aws:bedrock:us-west-1:123456789012:guardrail/5o8pkust4fuo"
  },
  "requestID": "575d0a0b-765f-41d0-b324-ccc54bceaa07",
  "eventID": "76926b07-15cd-4519-8d6e-81b716412717",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::errorCode` (elastic rule field)	in	`accessdenied`	1 rule	elastic
`aws::errorCode` (elastic rule field)	in	`accessdeniedexception`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt source low: Detects failed, access-denied attempts to modify or delete resource-based access policies on AWS Bedrock resources via the PutResourcePolicy and DeleteResourcePolicy API calls. Resource-based policies govern which principals (including external accounts) may access Bedrock resources such as agents, knowledge bases, and custom models. A principal that is repeatedly denied when attempting to attach or remove these policies may be a compromised or under-privileged identity probing for the ability to grant external or cross-account access, or to weaken existing access controls. Unlike the companion rule that detects successful changes, this rule surfaces the attempt itself, which is a high-signal indicator of credential boundary-testing even though no change occurred.T1098↳ also matches DeleteResourcePolicy
AWS Bedrock Resource-Based Policy Modified or Deleted source medium: Detects modification or deletion of resource-based access policies on AWS Bedrock resources via the PutResourcePolicy and DeleteResourcePolicy API calls. Resource-based policies govern which principals (including external accounts) may access Bedrock resources such as agents, knowledge bases, and custom models. An adversary may attach a resource policy granting an external or unexpected principal access to a Bedrock resource to establish persistence or enable cross-account access, or may delete an existing policy to weaken access controls. These changes should be validated for principal ownership and least-privilege intent.T1098↳ also matches DeleteResourcePolicy

PutUseCaseForModelAccess

Service: bedrock

Description

Submits a use case description to request access to Amazon Bedrock foundation models that require justification.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::errorCode` (elastic rule field)	in	`accessdenied`	1 rule	elastic
`aws::errorCode` (elastic rule field)	in	`accessdeniedexception`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Unauthorized Foundation Model Access Attempt source low: Identifies failed, access-denied attempts to enable account-level access to an Amazon Bedrock foundation model, either by granting a foundation-model entitlement, submitting a use case for model access, or creating a foundation-model agreement (accepting the EULA). These account-level "model access" actions unlock a foundation model so that it can subsequently be invoked. A principal that is repeatedly denied when attempting these actions may be a compromised or under-privileged identity probing for the ability to unlock expensive models (LLMjacking) or to establish a durable ability to invoke models. Unlike the companion rule that detects successful model-access grants, this rule surfaces the attempt itself, which is a high-signal indicator of credential boundary-testing even though access was not granted.T1098↳ also matches CreateFoundationModelAgreement, PutFoundationModelEntitlement
AWS Bedrock Foundation Model Access Enabled or Entitlement Granted source medium: Identifies when access to an Amazon Bedrock foundation model is enabled at the account level, either by granting a foundation-model entitlement, submitting a use case for model access, or creating a foundation-model agreement (accepting the EULA). These account-level "model access" actions unlock a foundation model so that it can subsequently be invoked. Adversaries or a compromised principal may enable model access to abuse expensive models (LLMjacking), to establish a durable ability to invoke models within the account, or to bypass organizational controls. This activity is distinct from changes to a resource-based model invocation policy and is identified by the Bedrock control-plane API calls that grant model entitlements and agreements.T1098↳ also matches CreateFoundationModelAgreement, PutFoundationModelEntitlement

RegisterMarketplaceModelEndpoint

Service: bedrock

Description

Registers an existing AWS Marketplace model endpoint with Amazon Bedrock, enabling it to be used for Bedrock inference.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered source medium: Detects when an AWS Bedrock custom model is imported or deployed, or when a marketplace model endpoint is created or registered, via the CreateModelImportJob, CreateCustomModelDeployment, CreateMarketplaceModelEndpoint, or RegisterMarketplaceModelEndpoint API calls. These actions introduce a model artifact from outside the organization's trusted training and approval pipeline. A backdoored, poisoned, or attacker-supplied model that downstream applications subsequently invoke represents a software supply-chain compromise. New model imports and marketplace endpoint registrations should be validated for artifact provenance (S3 source ownership), the registering identity, and whether the model originates from an approved internal pipeline.T1525↳ also matches CreateCustomModelDeployment, CreateMarketplaceModelEndpoint, CreateModelImportJob

StartIngestionJob

Service: bedrock

Description

Starts an ingestion job to sync documents from a data source into a Bedrock knowledge base vector store.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Knowledge Base or RAG Data Source Tampering source medium: Detects control-plane mutations to AWS Bedrock knowledge bases and their backing RAG data sources via CloudTrail. An adversary with access to Bedrock Agent APIs can poison the corpus that RAG-enabled models treat as authoritative by ingesting attacker-controlled documents (IngestKnowledgeBaseDocuments, StartIngestionJob), deleting legitimate documents (DeleteKnowledgeBaseDocuments), or repointing/altering the data source itself (CreateDataSource, UpdateDataSource, DeleteDataSource, UpdateKnowledgeBase). Because downstream applications and users trust model answers grounded in this stored data, tampering with the corpus is a stored data manipulation that can drive misinformation, fraud, or manipulated decisions at inference time. This is a New Terms rule that looks for the first time a given identity ARN performs one of these knowledge base or data source mutations within the history window.T1565, T1565.001↳ also matches CreateDataSource, DeleteDataSource, DeleteKnowledgeBase, DeleteKnowledgeBaseDocuments, IngestKnowledgeBaseDocuments, UpdateDataSource, UpdateKnowledgeBase

UpdateAgent

Service: bedrock

Description

Updates the configuration of an existing Bedrock agent, such as its foundation model, instructions, or session timeout.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "4ca879d2-7ad9-4d24-8697-ebd20d627493",
  "eventName": "UpdateAgent",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ce3bba19-7068-4fc3-9275-95e203df00cc",
  "requestParameters": {
    "agentId": "dw-probe",
    "agentName": "***",
    "agentResourceRoleArn": "arn:aws:iam::123456789012:role/dw-probe",
    "foundationModel": "ddddd"
  },
  "responseElements": {
    "Access-Control-Expose-Headers": "x-amzn-errortype,x-amzn-requestid,x-amzn-trace-id",
    "message": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: bedrock:UpdateAgent"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Agent or Action Group Manipulation source medium: Detects modification of deployed Amazon Bedrock agents and their action groups, collaborators, or aliases via the Bedrock Agent control plane. Adversaries with access to an AWS account can tamper with an existing, trusted agent by altering its instructions (UpdateAgent), adding or changing action groups that wire the agent to Lambda functions or APIs (CreateAgentActionGroup, UpdateAgentActionGroup), attaching or modifying collaborators (AssociateAgentCollaborator, UpdateAgentCollaborator), or repointing an alias to a tampered version (CreateAgentAlias, UpdateAgentAlias). A PrepareAgent call is required to make a tampered configuration live. By implanting malicious behavior into an agent that legitimate users continue to invoke, an attacker can maintain durable access through a trusted component. Creation of brand-new agents (CreateAgent) is intentionally excluded as lower-signal activity.T1505↳ also matches AssociateAgentCollaborator, CreateAgentActionGroup, CreateAgentAlias, PrepareAgent, UpdateAgentActionGroup, UpdateAgentAlias, UpdateAgentCollaborator

UpdateAgentActionGroup

Service: bedrock

Description

Updates an action group associated with a Bedrock agent, modifying its API schema or Lambda function configuration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "d4484d4b-1ca4-4679-a4b4-22486c78db7f",
  "eventName": "UpdateAgentActionGroup",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "688cbbd3-aeb6-4dfc-ba32-bfee57064b22",
  "requestParameters": {
    "actionGroupId": "dw-probe",
    "actionGroupName": "***",
    "agentId": "dw-probe",
    "agentVersion": "ddddd"
  },
  "responseElements": {
    "Access-Control-Expose-Headers": "x-amzn-errortype,x-amzn-requestid,x-amzn-trace-id",
    "message": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: bedrock:UpdateAgentActionGroup"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Agent or Action Group Manipulation source medium: Detects modification of deployed Amazon Bedrock agents and their action groups, collaborators, or aliases via the Bedrock Agent control plane. Adversaries with access to an AWS account can tamper with an existing, trusted agent by altering its instructions (UpdateAgent), adding or changing action groups that wire the agent to Lambda functions or APIs (CreateAgentActionGroup, UpdateAgentActionGroup), attaching or modifying collaborators (AssociateAgentCollaborator, UpdateAgentCollaborator), or repointing an alias to a tampered version (CreateAgentAlias, UpdateAgentAlias). A PrepareAgent call is required to make a tampered configuration live. By implanting malicious behavior into an agent that legitimate users continue to invoke, an attacker can maintain durable access through a trusted component. Creation of brand-new agents (CreateAgent) is intentionally excluded as lower-signal activity.T1505↳ also matches AssociateAgentCollaborator, CreateAgentActionGroup, CreateAgentAlias, PrepareAgent, UpdateAgent, UpdateAgentAlias, UpdateAgentCollaborator

UpdateAgentAlias

Service: bedrock

Description

Updates a Bedrock agent alias to point to a different agent version or update its description.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "17971056-877c-41b2-b379-2b55bbf00d48",
  "eventName": "UpdateAgentAlias",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a258a94a-56a1-41c1-add4-f6469c25cda5",
  "requestParameters": {
    "agentAliasId": "dddddddddd",
    "agentAliasName": "***",
    "agentId": "dw-probe"
  },
  "responseElements": {
    "Access-Control-Expose-Headers": "x-amzn-errortype,x-amzn-requestid,x-amzn-trace-id",
    "message": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: bedrock:UpdateAgentAlias"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Agent or Action Group Manipulation source medium: Detects modification of deployed Amazon Bedrock agents and their action groups, collaborators, or aliases via the Bedrock Agent control plane. Adversaries with access to an AWS account can tamper with an existing, trusted agent by altering its instructions (UpdateAgent), adding or changing action groups that wire the agent to Lambda functions or APIs (CreateAgentActionGroup, UpdateAgentActionGroup), attaching or modifying collaborators (AssociateAgentCollaborator, UpdateAgentCollaborator), or repointing an alias to a tampered version (CreateAgentAlias, UpdateAgentAlias). A PrepareAgent call is required to make a tampered configuration live. By implanting malicious behavior into an agent that legitimate users continue to invoke, an attacker can maintain durable access through a trusted component. Creation of brand-new agents (CreateAgent) is intentionally excluded as lower-signal activity.T1505↳ also matches AssociateAgentCollaborator, CreateAgentActionGroup, CreateAgentAlias, PrepareAgent, UpdateAgent, UpdateAgentActionGroup, UpdateAgentCollaborator

UpdateAgentCollaborator

Service: bedrock

Description

Updates the configuration of a collaborator agent associated with a supervisor agent.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "29be27d6-3b4b-4c6f-a10e-c4caf2cf8890",
  "eventName": "UpdateAgentCollaborator",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9a488ddc-caff-4452-82f9-43c3e10d4cc4",
  "requestParameters": {
    "agentDescriptor": {},
    "agentId": "dw-probe",
    "agentVersion": "ddddd",
    "collaborationInstruction": "***",
    "collaboratorId": "dw-probe",
    "collaboratorName": "***"
  },
  "responseElements": {
    "Access-Control-Expose-Headers": "x-amzn-errortype,x-amzn-requestid,x-amzn-trace-id",
    "message": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: bedrock:UpdateAgentCollaborator"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Agent or Action Group Manipulation source medium: Detects modification of deployed Amazon Bedrock agents and their action groups, collaborators, or aliases via the Bedrock Agent control plane. Adversaries with access to an AWS account can tamper with an existing, trusted agent by altering its instructions (UpdateAgent), adding or changing action groups that wire the agent to Lambda functions or APIs (CreateAgentActionGroup, UpdateAgentActionGroup), attaching or modifying collaborators (AssociateAgentCollaborator, UpdateAgentCollaborator), or repointing an alias to a tampered version (CreateAgentAlias, UpdateAgentAlias). A PrepareAgent call is required to make a tampered configuration live. By implanting malicious behavior into an agent that legitimate users continue to invoke, an attacker can maintain durable access through a trusted component. Creation of brand-new agents (CreateAgent) is intentionally excluded as lower-signal activity.T1505↳ also matches AssociateAgentCollaborator, CreateAgentActionGroup, CreateAgentAlias, PrepareAgent, UpdateAgent, UpdateAgentActionGroup, UpdateAgentAlias

UpdateAgentKnowledgeBase

Service: bedrock

Description

Updates the configuration of a knowledge base associated with a Bedrock agent, such as its instruction or retrieval settings.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "e459272c-45b7-4d88-b235-6a8b9138c24c",
  "eventName": "UpdateAgentKnowledgeBase",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f8283dea-3211-4c73-b562-91ecdf65b58b",
  "requestParameters": {
    "agentId": "dw-probe",
    "agentVersion": "ddddd",
    "knowledgeBaseId": "dw-probe"
  },
  "responseElements": {
    "Access-Control-Expose-Headers": "x-amzn-errortype,x-amzn-requestid,x-amzn-trace-id",
    "message": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: bedrock:UpdateAgentKnowledgeBase"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Third-Party or External Knowledge Base Associated to Agent source medium: Detects when an Amazon Bedrock agent is associated with, or updated to use, a knowledge base via the AssociateAgentKnowledgeBase, or UpdateAgentKnowledgeBase API actions. Bedrock agents consume knowledge base (RAG) content as trusted context for the model. By wiring an agent to an externally controlled or third-party knowledge base, or by swapping in an attacker-controlled knowledge base, an adversary can redraw the agent's trust boundary toward an untrusted source. This is a software-supply-chain compromise and an indirect prompt-injection delivery vector: poisoned or adversarial content served from the associated knowledge base is treated as authoritative by the agent. Validate that the associated knowledge base, and any underlying data source, is owned and controlled by your organization.T1505↳ also matches AssociateAgentKnowledgeBase

UpdateAutomatedReasoningPolicy

Service: bedrock

Description

Updates an existing automated reasoning policy in Amazon Bedrock, modifying its rules or constraints.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Automated Reasoning Safety Policy Tampering source medium: Detects deletion or modification of AWS Bedrock Automated Reasoning policies via the DeleteAutomatedReasoningPolicy, UpdateAutomatedReasoningPolicy, or UpdateAutomatedReasoningPolicyAnnotations CloudTrail actions. Automated Reasoning policies are a Bedrock safety and validation control that constrains model outputs against formal rules. An adversary who deletes a policy or alters the policy definition or its annotations weakens an enforced output-validation defense, potentially allowing unsafe or non-compliant model responses to pass unchecked. Benign build, test-workflow, and test-case CRUD operations are intentionally excluded as they have no coherent abuse path.T1562, T1562.001↳ also matches DeleteAutomatedReasoningPolicy, UpdateAutomatedReasoningPolicyAnnotations

UpdateAutomatedReasoningPolicyAnnotations

Service: bedrock

Description

Updates the annotations on an automated reasoning policy, revising human-authored labels or metadata on its rules.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Automated Reasoning Safety Policy Tampering source medium: Detects deletion or modification of AWS Bedrock Automated Reasoning policies via the DeleteAutomatedReasoningPolicy, UpdateAutomatedReasoningPolicy, or UpdateAutomatedReasoningPolicyAnnotations CloudTrail actions. Automated Reasoning policies are a Bedrock safety and validation control that constrains model outputs against formal rules. An adversary who deletes a policy or alters the policy definition or its annotations weakens an enforced output-validation defense, potentially allowing unsafe or non-compliant model responses to pass unchecked. Benign build, test-workflow, and test-case CRUD operations are intentionally excluded as they have no coherent abuse path.T1562, T1562.001↳ also matches DeleteAutomatedReasoningPolicy, UpdateAutomatedReasoningPolicy

UpdateDataSource

Service: bedrock

Description

Updates the configuration of a data source in a Bedrock knowledge base, such as its S3 location or chunking strategy.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "01884489-df5a-417f-be7a-4c42d847b6e2",
  "eventName": "UpdateDataSource",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "32558feb-78f6-4170-b262-6566be638a69",
  "requestParameters": {
    "dataSourceConfiguration": {
      "type": "S3"
    },
    "dataSourceId": "dw-probe",
    "knowledgeBaseId": "dw-probe",
    "name": "***"
  },
  "responseElements": {
    "Access-Control-Expose-Headers": "x-amzn-errortype,x-amzn-requestid,x-amzn-trace-id",
    "message": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: bedrock:UpdateDataSource"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Knowledge Base or RAG Data Source Tampering source medium: Detects control-plane mutations to AWS Bedrock knowledge bases and their backing RAG data sources via CloudTrail. An adversary with access to Bedrock Agent APIs can poison the corpus that RAG-enabled models treat as authoritative by ingesting attacker-controlled documents (IngestKnowledgeBaseDocuments, StartIngestionJob), deleting legitimate documents (DeleteKnowledgeBaseDocuments), or repointing/altering the data source itself (CreateDataSource, UpdateDataSource, DeleteDataSource, UpdateKnowledgeBase). Because downstream applications and users trust model answers grounded in this stored data, tampering with the corpus is a stored data manipulation that can drive misinformation, fraud, or manipulated decisions at inference time. This is a New Terms rule that looks for the first time a given identity ARN performs one of these knowledge base or data source mutations within the history window.T1565, T1565.001↳ also matches CreateDataSource, DeleteDataSource, DeleteKnowledgeBase, DeleteKnowledgeBaseDocuments, IngestKnowledgeBaseDocuments, StartIngestionJob, UpdateKnowledgeBase

UpdateGuardrail

Service: bedrock

Description

Updates an existing Bedrock guardrail, modifying its content filters, topic denials, or sensitive information policies.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value 'dw-probe' at 'guardrailIdentifier' failed to satisfy constraint: Member must satisfy regular expression pattern: (([a-z0-9]+)|(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:guardrail/[a-z0-9]+))",
  "eventCategory": "Management",
  "eventID": "aa29b0be-6384-47e2-9aec-3a35881756eb",
  "eventName": "UpdateGuardrail",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9854309c-ad40-4ddd-b0d5-f59fd179f55e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

AWS Bedrock Guardrail Updated source medium: Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses.T1685

Elastic #

AWS Bedrock Guardrail Deleted or Weakened source medium: Detects deletion, weakening, or version management of AWS Bedrock guardrails via the DeleteGuardrail, UpdateGuardrail, DeleteEnforcedGuardrailConfiguration, or PutEnforcedGuardrailConfiguration APIs. Bedrock guardrails enforce content, topic, word, and sensitive-information policies on model invocations. Deleting a guardrail, loosening its policies, removing or overwriting the organization-enforced guardrail configuration, or creating a new version to enforce a weakened configuration allows an adversary to bypass these protections — the cloud control-plane equivalent of disabling a security tool. This activity should be validated against approved change management and the responsible identity.T1562, T1562.001↳ also matches DeleteEnforcedGuardrailConfiguration, DeleteGuardrail, PutEnforcedGuardrailConfiguration

Panther #

AWS Bedrock Guardrail Updated or Deleted source medium: An Amazon Bedrock Guardrail was updated or deleted. Amazon Bedrock Guardrails are used to implement application-specific safeguards based on your use cases and responsible AI policies. Updating or deleting a guardrail can have security implications to your AI workloads.T1562.001↳ also matches DeleteGuardrail

UpdateKnowledgeBase

Service: bedrock

Description

Updates the configuration of a Bedrock knowledge base, such as its description, role ARN, or storage configuration.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "d9538576-6be6-4e93-bf9d-1c2e06d9c0f5",
  "eventName": "UpdateKnowledgeBase",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "43014a70-0147-47fa-aa7e-cfe415df31f0",
  "requestParameters": {
    "knowledgeBaseConfiguration": {
      "type": "VECTOR"
    },
    "knowledgeBaseId": "dw-probe",
    "name": "***",
    "roleArn": "arn:aws:iam::123456789012:role/dw-probe"
  },
  "responseElements": {
    "Access-Control-Expose-Headers": "x-amzn-errortype,x-amzn-requestid,x-amzn-trace-id",
    "message": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to perform: bedrock:UpdateKnowledgeBase"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Knowledge Base or RAG Data Source Tampering source medium: Detects control-plane mutations to AWS Bedrock knowledge bases and their backing RAG data sources via CloudTrail. An adversary with access to Bedrock Agent APIs can poison the corpus that RAG-enabled models treat as authoritative by ingesting attacker-controlled documents (IngestKnowledgeBaseDocuments, StartIngestionJob), deleting legitimate documents (DeleteKnowledgeBaseDocuments), or repointing/altering the data source itself (CreateDataSource, UpdateDataSource, DeleteDataSource, UpdateKnowledgeBase). Because downstream applications and users trust model answers grounded in this stored data, tampering with the corpus is a stored data manipulation that can drive misinformation, fraud, or manipulated decisions at inference time. This is a New Terms rule that looks for the first time a given identity ARN performs one of these knowledge base or data source mutations within the history window.T1565, T1565.001↳ also matches CreateDataSource, DeleteDataSource, DeleteKnowledgeBase, DeleteKnowledgeBaseDocuments, IngestKnowledgeBaseDocuments, StartIngestionJob, UpdateDataSource

UpdateProvisionedModelThroughput

Service: bedrock

Description

Updates a provisioned throughput commitment for a Bedrock model, modifying its model units or model ID.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock Provisioned Model Throughput Tampering source medium: Detects creation, modification, or deletion of AWS Bedrock Provisioned Model Throughput via the CreateProvisionedModelThroughput, UpdateProvisionedModelThroughput, and DeleteProvisionedModelThroughput APIs. Provisioned Throughput reserves dedicated, billed model capacity for Amazon Bedrock. An adversary who scales this capacity up can drive large, unauthorized cost (cloud resource/bill hijacking), while deleting reserved throughput can cause denial of service to production workloads that depend on that committed capacity. These control-plane changes should be validated against approved capacity-planning and change-management processes.T1496, T1496.004↳ also matches CreateProvisionedModelThroughput, DeleteProvisionedModelThroughput

BatchDeleteAdvancedPromptOptimizationJob

Service: bedrock

Description

Deletes one or more advanced prompt optimization jobs.

BatchDeleteEvaluationJob

Service: bedrock

Description

Deletes a batch of evaluation jobs.

CancelAutomatedReasoningPolicyBuildWorkflow

Service: bedrock

Description

Cancels a running Automated Reasoning policy build workflow.

CreateAdvancedPromptOptimizationJob

Service: bedrock

Description

Creates an advanced prompt optimization job.

CreateAutomatedReasoningPolicy

Service: bedrock

Description

Creates an Automated Reasoning policy for Amazon Bedrock Guardrails.

CreateAutomatedReasoningPolicyTestCase

Service: bedrock

Description

Creates a test for an Automated Reasoning policy.

CreateAutomatedReasoningPolicyVersion

Service: bedrock

Description

Creates a new version of an existing Automated Reasoning policy.

CreateCustomModel

Service: bedrock

Description

Creates a new custom model in Amazon Bedrock.

CreateEvaluationJob

Service: bedrock

Description

Creates an evaluation job.

CreateGuardrail

Service: bedrock

Description

Creates a guardrail to block topics and to implement safeguards for your generative AI applications.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "Guardrail must have at least one policy.",
  "eventCategory": "Management",
  "eventID": "cc6e3cae-f0f6-4abf-9113-253cb69d01e6",
  "eventName": "CreateGuardrail",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T21:53:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "75bd7b3a-9b5d-4c20-b575-65916e2803e5",
  "requestParameters": {
    "description": "HIDDEN_DUE_TO_SECURITY_REASONS",
    "name": "HIDDEN_DUE_TO_SECURITY_REASONS"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateGuardrailVersion

Service: bedrock

Description

Creates a version of the guardrail.

CreateInferenceProfile

Service: bedrock

Description

Creates an application inference profile to track metrics and costs when invoking a model.

CreateModelCopyJob

Service: bedrock

Description

Copies a model to another region so that it can be used there.

CreateModelCustomizationJob

Service: bedrock

Description

Creates a fine-tuning job to customize a base model.

CreateModelInvocationJob

Service: bedrock

Description

Creates a batch inference job to invoke a model on multiple prompts.

CreatePromptRouter

Service: bedrock

Description

Creates a prompt router that manages the routing of requests between multiple foundation models based on the routing criteria.

DeleteAutomatedReasoningPolicyBuildWorkflow

Service: bedrock

Description

Deletes an Automated Reasoning policy build workflow and its associated artifacts.

DeleteAutomatedReasoningPolicyTestCase

Service: bedrock

Description

Deletes an Automated Reasoning policy test.

DeleteCustomModel

Service: bedrock

Description

Deletes a custom model that you created earlier.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action source high: Identifies an Amazon Bedrock API key (bearer token) being used to perform a destructive or anti-recovery control-plane action, such as deleting a guardrail, deleting a custom or imported model, removing provisioned throughput, or disabling model invocation logging. Bedrock API keys are bearer credentials intended for model invocation (InvokeModel, Converse); using one to delete Bedrock resources or disable logging is inconsistent with that purpose and is characteristic of LLMjacking or sabotage following key theft. Every Bedrock API key call is identifiable in CloudTrail by "additionalEventData.callWithBearerToken" being true. The rule matches regardless of outcome, because a destructive attempt via a bearer token is suspicious even when denied.T1485, T1562, T1562.001↳ also matches DeleteGuardrail, DeleteModelInvocationLoggingConfiguration, DeleteProvisionedModelThroughput, PutModelInvocationLoggingConfiguration, DeleteImportedModel, DeleteMarketplaceModelEndpoint

DeleteCustomModelDeployment

Service: bedrock

Description

Deletes a custom model deployment.

DeleteFoundationModelAgreement

Service: bedrock

Description

Delete the model access agreement for the specified model.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "eventCategory": "Management",
  "eventID": "be786c92-18dc-4bea-a9a1-c90a4eed3aff",
  "eventName": "DeleteFoundationModelAgreement",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "1977210d-d420-4855-a1cc-f1a3b18d6456",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteImportedModel

Service: bedrock

Description

Deletes a custom model that you imported earlier.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "03d17386-39af-4b29-aab6-48adc28d4095",
  "eventName": "DeleteImportedModel",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:52Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "127ec70d-65e9-45da-a571-2d4840b9b431",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action source high: Identifies an Amazon Bedrock API key (bearer token) being used to perform a destructive or anti-recovery control-plane action, such as deleting a guardrail, deleting a custom or imported model, removing provisioned throughput, or disabling model invocation logging. Bedrock API keys are bearer credentials intended for model invocation (InvokeModel, Converse); using one to delete Bedrock resources or disable logging is inconsistent with that purpose and is characteristic of LLMjacking or sabotage following key theft. Every Bedrock API key call is identifiable in CloudTrail by "additionalEventData.callWithBearerToken" being true. The rule matches regardless of outcome, because a destructive attempt via a bearer token is suspicious even when denied.T1485, T1562, T1562.001↳ also matches DeleteGuardrail, DeleteModelInvocationLoggingConfiguration, DeleteProvisionedModelThroughput, PutModelInvocationLoggingConfiguration, DeleteCustomModel, DeleteMarketplaceModelEndpoint

DeleteInferenceProfile

Service: bedrock

Description

Deletes an application inference profile.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Inference profile not found.",
  "eventCategory": "Management",
  "eventID": "897e077f-1d0d-4c77-bf83-2f0bdcdd93e4",
  "eventName": "DeleteInferenceProfile",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9dc47e81-876a-4e10-9e8b-2f385edc5568",
  "requestParameters": {
    "inferenceProfileIdentifier": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteMarketplaceModelEndpoint

Service: bedrock

Description

Deletes an endpoint for a model from Amazon Bedrock Marketplace.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "70f4fc52-9947-4465-b489-0ed4f707830f",
  "eventName": "DeleteMarketplaceModelEndpoint",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "faa67eb6-76d9-40db-a3b5-9ec2dcf12411",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action source high: Identifies an Amazon Bedrock API key (bearer token) being used to perform a destructive or anti-recovery control-plane action, such as deleting a guardrail, deleting a custom or imported model, removing provisioned throughput, or disabling model invocation logging. Bedrock API keys are bearer credentials intended for model invocation (InvokeModel, Converse); using one to delete Bedrock resources or disable logging is inconsistent with that purpose and is characteristic of LLMjacking or sabotage following key theft. Every Bedrock API key call is identifiable in CloudTrail by "additionalEventData.callWithBearerToken" being true. The rule matches regardless of outcome, because a destructive attempt via a bearer token is suspicious even when denied.T1485, T1562, T1562.001↳ also matches DeleteGuardrail, DeleteModelInvocationLoggingConfiguration, DeleteProvisionedModelThroughput, PutModelInvocationLoggingConfiguration, DeleteCustomModel, DeleteImportedModel

DeletePromptRouter

Service: bedrock

Description

Deletes a specified prompt router.

DeregisterMarketplaceModelEndpoint

Service: bedrock

Description

Deregisters an endpoint for a model from Amazon Bedrock Marketplace.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "bbfe20cd-0367-4498-8354-2570d555207e",
  "eventName": "DeregisterMarketplaceModelEndpoint",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d92873ee-a05a-49d0-943b-101601dd3f5d",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ExportAutomatedReasoningPolicyVersion

Service: bedrock

Description

Exports the policy definition for an Automated Reasoning policy version.

GetAccountDataRetention

Service: bedrock

Description

Returns the account-wide data retention mode for Amazon Bedrock.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "51f595ae-57f8-4e40-b603-befcabdb7090",
  "eventName": "GetAccountDataRetention",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "2a5c2ae3-0b1e-44e3-8289-1edf3e857103",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAdvancedPromptOptimizationJob

Service: bedrock

Description

Gets information about an advanced prompt optimization job.

GetAutomatedReasoningPolicy

Service: bedrock

Description

Retrieves details about an Automated Reasoning policy or policy version.

GetAutomatedReasoningPolicyAnnotations

Service: bedrock

Description

Retrieves the current annotations for an Automated Reasoning policy build workflow.

GetAutomatedReasoningPolicyBuildWorkflow

Service: bedrock

Description

Retrieves detailed information about an Automated Reasoning policy build workflow, including its status, configuration, and metadata.

GetAutomatedReasoningPolicyBuildWorkflowResultAssets

Service: bedrock

Description

Retrieves the resulting assets from a completed Automated Reasoning policy build workflow, including build logs, quality reports, and generated policy artifacts.

GetAutomatedReasoningPolicyNextScenario

Service: bedrock

Description

Retrieves the next test scenario for validating an Automated Reasoning policy.

GetAutomatedReasoningPolicyTestCase

Service: bedrock

Description

Retrieves details about a specific Automated Reasoning policy test.

GetAutomatedReasoningPolicyTestResult

Service: bedrock

Description

Retrieves the test result for a specific Automated Reasoning policy test.

GetCustomModel

Service: bedrock

Description

Get the properties associated with a Amazon Bedrock custom model that you have created.

GetCustomModelDeployment

Service: bedrock

Description

Retrieves information about a custom model deployment, including its status, configuration, and metadata.

GetEvaluationJob

Service: bedrock

Description

Gets information about an evaluation job, such as the status of the job.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "87f5dece-55a2-446b-afb7-ad2dfb1c1f60",
  "eventName": "GetEvaluationJob",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "93460199-dd6d-42e7-b444-2d39c5ab3089",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFoundationModel

Service: bedrock

Description

Get details about a Amazon Bedrock foundation model.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "eventCategory": "Management",
  "eventID": "fa19a589-15b0-4700-9bf5-2b9411adf4ab",
  "eventName": "GetFoundationModel",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "d6f9670f-a1a0-4767-b960-7f339b496f85",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetFoundationModelAvailability

Service: bedrock

Description

Get information about the Foundation model availability.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "eventCategory": "Management",
  "eventID": "87a675af-ec74-4fc6-8ceb-9f2443c344cc",
  "eventName": "GetFoundationModelAvailability",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "415dfc62-3546-427d-b235-494c7a19e503",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetGuardrail

Service: bedrock

Description

Gets details about a guardrail.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value 'dw-probe' at 'guardrailIdentifier' failed to satisfy constraint: Member must satisfy regular expression pattern: (([a-z0-9]+)|(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:guardrail/[a-z0-9]+))",
  "eventCategory": "Management",
  "eventID": "a8753cec-148f-4239-8465-54014e7e61d4",
  "eventName": "GetGuardrail",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "a0b69a0f-7407-47ce-8008-2eff7c53049a",
  "requestParameters": {
    "guardrailIdentifier": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetImportedModel

Service: bedrock

Description

Gets properties associated with a customized model you imported.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "267e9278-377f-4c4a-a673-5051124f8901",
  "eventName": "GetImportedModel",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "5dbab154-1175-44f4-a15a-fd469e78a906",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetInferenceProfile

Service: bedrock

Description

Gets information about an inference profile.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Inference profile not found.",
  "eventCategory": "Management",
  "eventID": "0256211a-d98d-4421-956e-80f7fa8ff46f",
  "eventName": "GetInferenceProfile",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "0a13addd-7c7c-44c7-a8f7-04d2821525bc",
  "requestParameters": {
    "inferenceProfileIdentifier": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetMarketplaceModelEndpoint

Service: bedrock

Description

Retrieves details about a specific endpoint for a model from Amazon Bedrock Marketplace.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "26103d93-3cea-4e18-ac28-f2f1c3b88351",
  "eventName": "GetMarketplaceModelEndpoint",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "254b535b-60a0-42db-863b-122fa536fba4",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetModelCopyJob

Service: bedrock

Description

Retrieves information about a model copy job.

GetModelCustomizationJob

Service: bedrock

Description

Retrieves the properties associated with a model-customization job, including the status of the job.

GetModelImportJob

Service: bedrock

Description

Retrieves the properties associated with import model job, including the status of the job.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "627b6daf-f104-408b-a4ed-221d99cf7e9d",
  "eventName": "GetModelImportJob",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "a764b684-8a1a-4fc1-862d-ca05921813e4",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetModelInvocationJob

Service: bedrock

Description

Gets details about a batch inference job.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "eventCategory": "Management",
  "eventID": "e3fff0f0-f3b3-42d6-a7c2-97f651659926",
  "eventName": "GetModelInvocationJob",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "47fe692a-3043-4607-b124-968440180c7c",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetModelInvocationLoggingConfiguration

Service: bedrock

Description

Get the current configuration values for model invocation logging.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "ca75a18c-e68d-4703-9648-3482fe443a38",
  "eventName": "GetModelInvocationLoggingConfiguration",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "d1af11fa-5607-4b72-9eb2-e56a2f56d099",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetPromptRouter

Service: bedrock

Description

Retrieves details about a prompt router.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "eventCategory": "Management",
  "eventID": "a326d622-b406-45da-89cd-65db004f26d4",
  "eventName": "GetPromptRouter",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "8fbe81cf-6ae2-4ed3-bd1f-d8e4485fc2a2",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetProvisionedModelThroughput

Service: bedrock

Description

Returns details for a Provisioned Throughput.

GetResourcePolicy

Service: bedrock

Description

Gets the resource policy document for a Bedrock resource

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "eventCategory": "Management",
  "eventID": "4c884128-e9d0-48b7-939f-6675aeef9e02",
  "eventName": "GetResourcePolicy",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ad5396c1-6068-45b8-84cc-040427200358",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetUseCaseForModelAccess

Service: bedrock

Description

Get usecase for model access.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "You have not filled out the request form. Fill out the form before getting access.",
  "eventCategory": "Management",
  "eventID": "2bdf2aca-6b22-4ee0-9ef7-cebcdae80c44",
  "eventName": "GetUseCaseForModelAccess",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "320bd3c8-6c64-4fbd-9e35-7b5a2749e006",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListAdvancedPromptOptimizationJobs

Service: bedrock

Description

Lists the advanced prompt optimization jobs in your account.

ListAutomatedReasoningPolicies

Service: bedrock

Description

Lists all Automated Reasoning policies in your account, with optional filtering by policy ARN.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "deb40b63-28b5-4196-a8f0-11de5cffbdec",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "ListAutomatedReasoningPolicies",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "cd2e9ff8-4122-45ee-a9f5-f99282c527fe",
  "userAgent": "config.amazonaws.com",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::Bedrock::AutomatedReasoningPolicy",
      "ARN": "arn:aws:bedrock:us-east-1:123456789012:automated-reasoning-policy/EXAMPLE"
    }
  ]
}

ListAutomatedReasoningPolicyBuildWorkflows

Service: bedrock

Description

Lists all build workflows for an Automated Reasoning policy, showing the history of policy creation and modification attempts.

ListAutomatedReasoningPolicyTestCases

Service: bedrock

Description

Lists tests for an Automated Reasoning policy.

ListAutomatedReasoningPolicyTestResults

Service: bedrock

Description

Lists test results for an Automated Reasoning policy, showing how the policy performed against various test scenarios and validation checks.

ListCustomModelDeployments

Service: bedrock

Description

Lists custom model deployments in your account.

ListCustomModels

Service: bedrock

Description

Returns a list of the custom models that you have created with the CreateModelCustomizationJob operation.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROA****************:User",
    "arn": "arn:aws:sts::123456789012:assumed-role/AWSReservedSSO_AdministratorAccess_1b74cd717d47002b/AdanAlvarez",
    "accountId": "123456789012",
    "accessKeyId": "AKIA****************",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROA****************:User",
        "arn": "arn:aws:iam::123456789012:role/aws-reserved/sso.amazonaws.com/us-east-2/AWSReservedSSO_AdministratorAccess_1b74cd717d47002b",
        "accountId": "123456789012",
        "userName": "AWSReservedSSO_AdministratorAccess_1b74cd717d47002b"
      },
      "attributes": {
        "creationDate": "2026-02-08T16:28:43Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-02-08T16:31:09Z",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "ListCustomModels",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "0.0.0.0",
  "userAgent": "aws-cli/2.32.3 md/awscrt#0.28.4 ua/2.1 os/linux#0.0.0.0-microsoft-standard-WSL2 md/arch#x86_64 lang/python#3.13.9 md/pyimpl#CPython m/E,C,Z,b,g cfg/retry-mode#standard md/installer#exe md/distrib#ubuntu.24 md/prompt#off md/command#bedrock.list-custom-models",
  "requestParameters": null,
  "responseElements": null,
  "requestID": "3554ee1d-485d-4756-8ee5-1055c60a5df4",
  "eventID": "81f34fbb-285c-48ed-845d-7d0d1579d1fb",
  "readOnly": true,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "clientProvidedHostHeader": "bedrock.us-east-1.amazonaws.com"
  }
}

References #

Sample log: TrailDiscover (CC-BY-4.0)

ListEnforcedGuardrailsConfiguration

Service: bedrock

Description

Lists the account-level enforced guardrail configurations.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "c68c5fd5-8a9e-4b5b-80ad-2b954e372a3c",
  "eventName": "ListEnforcedGuardrailsConfiguration",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "41b8e21b-a91f-4944-a71a-5c7efbade4a3",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListEvaluationJobs

Service: bedrock

Description

Lists all existing evaluation jobs.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "baa5f008-c498-4624-ad25-2f094326c821",
  "eventName": "ListEvaluationJobs",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "726376ba-e8e4-4e55-a420-0afb93535065",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListFoundationModelAgreementOffers

Service: bedrock

Description

Get the offers associated with the specified model.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "eventCategory": "Management",
  "eventID": "edeea48a-a8f5-4b3e-8d4b-582e8d5caf22",
  "eventName": "ListFoundationModelAgreementOffers",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "c96d0423-5492-47cb-9d6a-9067b8746062",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListGuardrails

Service: bedrock

Description

Lists details about all the guardrails in an account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "92b606e3-7e27-430d-add4-e1cc7ee5e8c1",
  "eventName": "ListGuardrails",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "0c0b4f67-1e59-408a-8344-90b7bfd2f451",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListImportedModels

Service: bedrock

Description

Returns a list of models you've imported.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "5d3d6af8-5f40-4930-8dfa-5a70bf112798",
  "eventName": "ListImportedModels",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "09ddca5e-c7c7-4894-8ede-544d4022d666",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListInferenceProfiles

Service: bedrock

Description

Returns a list of inference profiles that you can use.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "35dfe0ed-a44b-497c-94d8-341e13ac9098",
  "eventName": "ListInferenceProfiles",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "d4180f55-66e3-47e2-b57d-7cd18fd78728",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListMarketplaceModelEndpoints

Service: bedrock

Description

Lists the endpoints for models from Amazon Bedrock Marketplace in your Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "a69648ad-3173-4f90-92ec-1abc6e626c7d",
  "eventName": "ListMarketplaceModelEndpoints",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1c8d1bcf-d0b2-47d0-a428-5c032d3c66a1",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListModelCopyJobs

Service: bedrock

Description

Returns a list of model copy jobs that you have submitted.

ListModelCustomizationJobs

Service: bedrock

Description

Returns a list of model customization jobs that you have submitted.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "9c45ba53-dbb3-4f64-93a9-107279bcd35b",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "ListModelCustomizationJobs",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "dbcbcc69-08e6-40ba-8a51-02befa888340",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/bedrock#1.53.2 m/C,E,i",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-east-1.amazonaws.com"
  }
}

ListModelImportJobs

Service: bedrock

Description

Returns a list of import jobs you've submitted.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "93e976f2-8772-447a-8c38-6c34c4e79402",
  "eventName": "ListModelImportJobs",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "a366ea3f-0a7a-49d4-854a-65c5993fa79b",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListModelInvocationJobs

Service: bedrock

Description

Lists all batch inference jobs in the account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "8a1bbb36-7c89-450b-a168-0fdcc37f0ec0",
  "eventName": "ListModelInvocationJobs",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "351ea0ca-93e6-474f-8565-19bfd6b875f7",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListPromptRouters

Service: bedrock

Description

Retrieves a list of prompt routers.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "The requested operation is not recognized by the service.",
  "eventCategory": "Management",
  "eventID": "7df1a820-216a-4562-b06c-ca5d38458015",
  "eventName": "ListPromptRouters",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1d248173-f870-4977-a93c-1540e137a1d7",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListProvisionedModelThroughputs

Service: bedrock

Description

Lists the Provisioned Throughputs in the account.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "78e23948-7505-44e4-9bab-614d33ede474",
  "eventName": "ListProvisionedModelThroughputs",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:31:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "0643f44c-a5c1-47af-a0bd-66401bab4ec0",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListTagsForResource

Service: bedrock

Description

List the tags associated with the specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "eventCategory": "Management",
  "eventID": "6d4e656a-1af1-4aab-8088-252e884e979b",
  "eventName": "ListTagsForResource",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T18:42:44Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "39008d57-fae6-4605-a635-14b71872fbea",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutAccountDataRetention

Service: bedrock

Description

Sets the account-wide data retention mode for Amazon Bedrock.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "24c80849-7cd6-4d3e-ba79-b45c7ae12ee3",
  "eventName": "PutAccountDataRetention",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T21:53:55Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "77c02ba4-c7fb-46bb-8d31-645c88faa734",
  "requestParameters": {
    "mode": "default"
  },
  "responseElements": {
    "mode": "default",
    "updatedAt": "2026-06-29T21:53:55.774Z"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/n,Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StartAutomatedReasoningPolicyBuildWorkflow

Service: bedrock

Description

Starts a new build workflow for an Automated Reasoning policy.

StartAutomatedReasoningPolicyTestWorkflow

Service: bedrock

Description

Initiates a test workflow to validate Automated Reasoning policy tests.

StopAdvancedPromptOptimizationJob

Service: bedrock

Description

Stops an advanced prompt optimization job that is in progress.

StopEvaluationJob

Service: bedrock

Description

Stops an evaluation job that is current being created or running.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Your account is not authorized to invoke this API operation.",
  "eventCategory": "Management",
  "eventID": "0cf07a3d-7bb9-49c4-a83f-88e10b814c0b",
  "eventName": "StopEvaluationJob",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9c152255-9668-46aa-9eab-228fe40f4fb4",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StopModelCustomizationJob

Service: bedrock

Description

Stops an active model customization job.

StopModelInvocationJob

Service: bedrock

Description

Stops a batch inference job.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "eventCategory": "Management",
  "eventID": "aa60e46a-b953-4c4d-8657-c2714c9e06d0",
  "eventName": "StopModelInvocationJob",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a6815f72-a469-4076-a32a-74987f0f6e1b",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

Service: bedrock

Description

Associate tags with a resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "b5797500-4886-4ec9-9fa3-469e8629a291",
  "eventName": "TagResource",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T21:54:06Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "29dcff32-8a66-4420-813d-eae8c35feb4a",
  "requestParameters": {
    "resourceArn": "arn:aws:bedrock:us-west-1:123456789012:agent/1CK9WOCX18",
    "tags": {
      "Env": "dwfix-test"
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,b,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

Service: bedrock

Description

Remove one or more tags from a resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "HIDDEN_DUE_TO_SECURITY_REASONS",
  "eventCategory": "Management",
  "eventID": "8fbc8901-1388-4812-8bce-d7e57685261b",
  "eventName": "UntagResource",
  "eventSource": "bedrock.amazonaws.com",
  "eventTime": "2026-06-29T19:21:53Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9c243d0f-5ddd-4097-ba24-cdc8da574c9c",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateAutomatedReasoningPolicyTestCase

Service: bedrock

Description

Updates an existing Automated Reasoning policy test.

UpdateCustomModelDeployment

Service: bedrock

Description

Updates a custom model deployment with a new custom model.

UpdateMarketplaceModelEndpoint

Service: bedrock

Description

Updates the configuration of an existing endpoint for a model from Amazon Bedrock Marketplace.

GetAgent

Service: bedrock

Description

GetAgent recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "9c8549f6-42d9-4126-b314-9c590757fce8",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "GetAgent",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "5bf46fd1-1e18-4d9c-bb7c-7352435cfafe",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/bedrockagent#1.44.2 m/E,i"
}

GetAgentActionGroup

Service: bedrock

Description

GetAgentActionGroup recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "43238a98-39b0-40a7-ba52-eddeaaa85ff7",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "GetAgentActionGroup",
  "awsRegion": "ap-southeast-2",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "b99652c9-a5bf-4f01-90a7-8a0ff35dd61e",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/bedrockagent#1.44.2 m/E,i"
}

GetAgentVersion

Service: bedrock

Description

GetAgentVersion recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "c4568063-b868-42bf-96fd-d270346c7880",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "GetAgentVersion",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "c864b2be-483c-4d26-a379-84c889600714",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/bedrockagent#1.44.2 m/E,i"
}

GetDataSource

Service: bedrock

Description

GetDataSource recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "b0c7e4ce-dde6-4eee-8f62-ba2628783345",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "GetDataSource",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "a60d787b-1239-4afa-aeec-289bd01a4083",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/bedrockagent#1.44.2 m/E,i"
}

GetFlowAlias

Service: bedrock

Description

GetFlowAlias recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "d56213a1-6171-456e-9068-cf861c0d137d",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "GetFlowAlias",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "33dc7a40-1ce2-4366-9e78-709911f525b8",
  "userAgent": "config.amazonaws.com"
}

ListAgentActionGroups

Service: bedrock

Description

ListAgentActionGroups recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "562ffdce-064d-4448-844a-e9ccf7ae01ee",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "ListAgentActionGroups",
  "awsRegion": "ap-southeast-2",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "95623cf3-db77-49eb-bd49-948bad699994",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/bedrockagent#1.44.2 m/C,E,i"
}

ListAgentKnowledgeBases

Service: bedrock

Description

ListAgentKnowledgeBases recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "6f75853c-1953-408b-86c9-a4fc2ba849c0",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "ListAgentKnowledgeBases",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "c1b8a818-79af-43ed-aee6-3e4ffd640c37",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/bedrockagent#1.44.2 m/C,E,i"
}

ListAgentVersions

Service: bedrock

Description

ListAgentVersions recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "ece03af2-4284-4b9b-b261-2fe127d0f1d1",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "ListAgentVersions",
  "awsRegion": "ap-southeast-2",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "352cc004-71a4-4b4f-af07-c8e8239b4f82",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/bedrockagent#1.44.2 m/C,E,i"
}

ListDataAutomationProjects

Service: bedrock

Description

ListDataAutomationProjects recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "83cd4a00-138b-4051-afe4-932ef90d2f50",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "ListDataAutomationProjects",
  "awsRegion": "ap-northeast-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "dfc158e4-6ec2-4f19-95b3-822e6d1b8a8e",
  "userAgent": "resource-explorer-2.amazonaws.com"
}

ListFlowAliases

Service: bedrock

Description

ListFlowAliases recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "bd7d07b0-4d4a-435e-922d-d9ead99f2c4e",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "ListFlowAliases",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "1b703f1c-f3b8-4fce-8d8d-238b45ff27ae",
  "userAgent": "config.amazonaws.com"
}

ListFlows

Service: bedrock

Description

ListFlows recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "4dfa4a3b-86e4-418b-ae33-f47d1b07885c",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "ListFlows",
  "awsRegion": "ap-southeast-2",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "d9c8aa8f-871c-4a1c-a0a4-70bcc31f7185",
  "userAgent": "config.amazonaws.com"
}

ListKnowledgeBases

Service: bedrock

Description

ListKnowledgeBases recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "f31c74d0-44ab-4fb7-a10a-a49f8f67db6d",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "ListKnowledgeBases",
  "awsRegion": "ca-central-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "db2a8853-5e65-4e65-b144-53e08188e3c6",
  "userAgent": "aws-sdk-go-v2/1.43.0 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#arm64 api/bedrockagent#1.44.2 m/C,E,i"
}

ListPrompts

Service: bedrock

Description

ListPrompts recorded by CloudTrail for Amazon Bedrock. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "cf167281-0545-4298-9c05-d80d3ccd1260",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "ListPrompts",
  "awsRegion": "eu-west-2",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "96fac298-6c9e-4ec6-9983-5a678c4b814f",
  "userAgent": "config.amazonaws.com",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::Bedrock::Prompt",
      "ARN": "arn:aws:bedrock:eu-west-2:123456789012:prompt/EXAMPLE"
    }
  ]
}

Bedrock

any: Bedrock (catch-all)

Description

AssociateAgentCollaborator

Description

Related events #

Detection Rules #

Elastic #

AssociateAgentKnowledgeBase

Description

Related events #

Detection Rules #

Elastic #

Converse

Description

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Elastic #

ConverseStream

Description

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Elastic #

CreateAgent

Description

Example CloudTrail Event #

Common Indicators #

Detection Rules #

Elastic #

CreateAgentActionGroup

Description

Related events #

Detection Rules #

Elastic #

CreateAgentAlias

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Elastic #

CreateCustomModelDeployment

Description

Related events #

Detection Rules #

Elastic #

CreateDataSource

Description

Related events #

Detection Rules #

Elastic #

CreateFoundationModelAgreement

Description

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Elastic #

CreateMarketplaceModelEndpoint

Description

Related events #

Detection Rules #

Elastic #

CreateModelImportJob

Description

Related events #

Detection Rules #

Elastic #

CreateProvisionedModelThroughput

Description

Related events #

Detection Rules #

Elastic #

DeleteAutomatedReasoningPolicy

Description

Related events #

Detection Rules #