---
title: AWS Bedrock service quota increase requested
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > AWS Bedrock service quota increase
  requested
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# AWS Bedrock service quota increase requested
Classification:attackTactic:[TA0040-impact](https://attack.mitre.org/tactics/TA0040)Technique:[T1496-resource-hijacking](https://attack.mitre.org/techniques/T1496) 
## Goal{% #goal %}

Detects Amazon Bedrock service quota increase requests, with a higher-severity case when the requested value is the AWS maximum.

## Strategy{% #strategy %}

This rule monitors `RequestServiceQuotaIncrease` calls to `servicequotas.amazonaws.com` where `@ocsf.api.request.data.serviceCode` is `bedrock`.

Quota increases raise the volume of inference an account can run, which attackers use to scale LLMjacking after they obtain AWS credentials.

A Medium case fires when the requested `@ocsf.api.request.data.desiredValue` is the maximum AWS allows. A Low case fires on any other Bedrock quota increase requests from the same identity.

## Triage and response{% #triage-and-response %}

- Verify whether `{{@ocsf.actor.user.uid}}` is authorized to request Bedrock quota changes in this account.
- Review the requested quota code and `{{@ocsf.api.request.data.desiredValue}}` to distinguish a routine capacity request from a maximum-limit request.
- Examine recent Bedrock runtime usage from the same identity, including `InvokeModel` and `Converse`, for a sudden spike that would motivate a quota increase.
- Identify the source IP `{{@network.client.ip}}` and determine whether it matches expected administrative locations for this principal.
- Check Service Quotas and Support activity from `{{@ocsf.actor.user.uid}}` for parallel limit-increase requests against other expensive services.