---
title: AWS Bedrock Enumeration via ValidationException
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > AWS Bedrock Enumeration via
  ValidationException
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# AWS Bedrock Enumeration via ValidationException
Classification:attackTactic:[TA0007-discovery](https://attack.mitre.org/tactics/TA0007)Technique:[T1526-cloud-service-discovery](https://attack.mitre.org/techniques/T1526) 
## Goal{% #goal %}

Detects potential enumeration of AWS Bedrock models through a spike in failed `InvokeModel` calls.

## Strategy{% #strategy %}

This rule monitors CloudTrail for failed `InvokeModel` API requests to `bedrock.amazonaws.com`, where the error code is `ValidationException` and the error message references `max_tokens_to_sample`. Repeated failures of this kind resemble automated tools probing model token limits and parameter boundaries. This is a reconnaissance technique used to enumerate available models and their input constraints ahead of abuse or data exfiltration. This error is also possibly related to misconfigured applications, especially when it's high-volume and repetitive from a known principal.

## Triage and Response{% #triage-and-response %}

- Determine whether `{{@userIdentity.accessKeyId}}` maps to a trusted application or user, and whether Bedrock access is expected for that principal.
- Review the full set of `InvokeModel` calls from this access key to gauge the range of models probed and the volume of errors generated.
- Check for signs that this key is compromised, such as recent key rotation or calls originating from unexpected IPs or regions.
- Identify any successful `InvokeModel` calls within the same time window as the errors, which may indicate the enumeration was partially successful.
- Pivot to other CloudTrail activity from this principal for potentially related discovery behaviors, such as `ListFoundationModels` or `GetFoundationModel` calls.