AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata

Last updated 2 months ago on 2026-07-08

Created 2 months ago on 2026-07-08

About

Identifies prompts sent to an Amazon Bedrock AgentCore runtime that attempt to harvest credentials or coerce the agent into exfiltrating data. The runtime application logs capture the caller-supplied prompt; this rule flags prompts that reference the cloud instance metadata service (169.254.169.254, the ECS task metadata address, or the "latest/meta-data" / "security-credentials" paths), prompts that name AWS access or secret keys directly, and prompt-injection or jailbreak language ("ignore previous instructions", "developer mode", "do anything now") combined with intent to reveal secrets, system prompts, or send data to an external endpoint. Asking an agent to read instance metadata credentials or to exfiltrate secrets is rarely legitimate and indicates an attempt to weaponize the agent for credential theft, even when the model refuses the request.

Tags

Domain: CloudData Source: AWSData Source: Amazon Web ServicesData Source: Amazon BedrockUse Case: Threat DetectionTactic: Credential AccessLanguage: esql

Severity

high

Risk Score

MITRE ATT&CK™

Credential Access (TA0006)(external, opens in a new tab or window)

↳ Unsecured Credentials (T1552)(external, opens in a new tab or window)

False Positive Examples

Security testing, red-team exercises, or guardrail validation may intentionally send prompt-injection or credential-harvesting payloads to an agent. Confirm the source session and caller, and exclude approved testing identities after validation. Developer or documentation content that legitimately discusses the instance metadata service or AWS key formats could match. Review the prompt in "aws.bedrock_agentcore.request_payload.prompt" to confirm intent.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack: Prebuilt Security Detection Rules
Related Integrations: aws_bedrock_agentcore(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗from logs-aws_bedrock_agentcore.runtime_application_logs-* metadata _id, _version, _index
| eval Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower = to_lower(aws.bedrock_agentcore.request_payload.prompt)
| where aws.bedrock_agentcore.operation == "InvokeAgentRuntime" and (
    Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(169\.254\.169\.254|169\.254\.170\.2|/latest/meta-data|/latest/api/token|security-credentials).*"""
    or Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(aws_secret_access_key|aws_access_key_id|secret access key|access key id).*"""
    or (
        Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(ignore (all )?(your )?(previous|prior|above) instructions|disregard (your |the )?(previous |above )?instructions|developer mode|do anything now|jailbreak).*"""
        and Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(system prompt|reveal|exfiltrate|credential|secret|password|api key|token|send .* to https?://).*"""
    )
  )
| keep _id, _version, _index, @timestamp, aws.*, cloud.*, event.*

Install detection rules in Elastic Security

Detect AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).