Classification:

detection-engine

Tactic:

TA0007-discovery

Technique:

T1526-cloud-service-discovery

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when an IAM principal has successful calls or access denied calls to both ListInferenceProfiles and ListModelInvocationJobs Bedrock control-plane APIs from the same ARN within a short time period using a long term access key.

Strategy

This rule monitors AWS CloudTrail logs for a two-step sequence indicating deliberate AI-resource reconnaissance. The first step detects identity verification through GetCallerIdentity against sts.amazonaws.com, a common technique attackers use after obtaining compromised credentials to confirm which IAM principal they are operating as.

The second step requires successful calls to both ListInferenceProfiles and ListModelInvocationJobs against bedrock.amazonaws.com, which reveal available inference endpoints, model regions, and active invocation jobs. The detection also monitors for AccessDenied errors where an attacker may not have appropriate identity-based policy to access these Bedrock functions.

Successful access to these APIs means the attacker has confirmed which Bedrock resources they can exploit for LLMjacking or model abuse campaigns.

Triage and response

• Examine the IAM principal {{@userIdentity.arn}} and determine whether the identity is a human user, service account, or assumed role that should legitimately be querying Bedrock infrastructure.
• Check CloudTrail logs for additional Bedrock API calls from the same ARN such as InvokeModel, CreateModelInvocationJob, or GetFoundationModelAvailability that would indicate progression beyond discovery.
• Identify the source IP address {{@network.client.ip}} and determine whether it originates from expected corporate infrastructure or an anomalous location.
• Review whether the GetCallerIdentity call was preceded by other STS operations like AssumeRole or GetSessionToken that could indicate lateral movement or credential chaining.
• Determine which AWS regions were targeted by the Bedrock discovery calls and whether the principal has legitimate business reasons to enumerate inference profiles across those regions.