Elastic Security Detection Rules

AWS Bedrock Provisioned Model Throughput Tampering

Last updated 3 days ago on 2026-06-04
Created 3 days ago on 2026-06-04

About

Detects creation, modification, or deletion of AWS Bedrock Provisioned Model Throughput via the CreateProvisionedModelThroughput, UpdateProvisionedModelThroughput, and DeleteProvisionedModelThroughput APIs. Provisioned Throughput reserves dedicated, billed model capacity for Amazon Bedrock. An adversary who scales this capacity up can drive large, unauthorized cost (cloud resource/bill hijacking), while deleting reserved throughput can cause denial of service to production workloads that depend on that committed capacity. These control-plane changes should be validated against approved capacity-planning and change-management processes.
Tags
Domain: CloudDomain: LLMData Source: AWSData Source: AWS CloudTrailData Source: Amazon Web ServicesData Source: Amazon BedrockUse Case: Threat DetectionTactic: ImpactLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Impact (TA0040)(external, opens in a new tab or window)

↳ Resource Hijacking (T1496)(external, opens in a new tab or window)

False Positive Examples
Provisioned Throughput changes may be performed by platform, ML, or FinOps teams as part of capacity planning, scaling for production demand, or cost optimization. Infrastructure-as-code pipelines and automation roles may also create, update, or delete provisioned throughput during deployments. Verify that the user identity, user agent, and source IP correspond to known administrators or automation and that a corresponding change request exists. If known behavior is causing false positives, it can be exempted from the rule.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-aws.cloudtrail-*
Related Integrations

aws(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset: "aws.cloudtrail" and
    event.provider: "bedrock.amazonaws.com" and
    event.action: (
        "CreateProvisionedModelThroughput" or
        "UpdateProvisionedModelThroughput" or
        "DeleteProvisionedModelThroughput"
    ) and
    event.outcome: "success"

Install detection rules in Elastic Security

Detect AWS Bedrock Provisioned Model Throughput Tampering in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).