Check provider logo

Amazon Bedrock long-term API key has expired

bedrock_api_key_no_long_term_credentials

Severityhigh
Servicebedrock
by Prowler
secretsgen-ai

AWS recommends Amazon Bedrock long-term API keys only for exploration; production workloads should use short-term API keys (session-scoped, valid up to 12 hours). This check fails for any active long-term Bedrock API key, escalating to critical severity when configured to never expire. Already-expired keys pass — they can no longer authenticate.

Risk

Long-term Bedrock API keys persist beyond a session until their stored expiration, and keys set to never expire grant indefinite access until manually revoked, enabling unauthorized inference, uncontrolled usage and spend, and activity that continues past timely revocation.

Run this check with Prowler CLI

prowler aws --checks bedrock_api_key_no_long_term_credentials

Run in Prowler Cloud

Recommendation

Use short-term Amazon Bedrock API keys for any non-exploratory workload — they are bound to the IAM principal's session, valid for at most 12 hours, scoped to a single Region, and can be auto-refreshed by the SDK. For existing long-term keys, delete the underlying IAM service-specific credential. If a long-term key must be retained for an exploration scenario, set an explicit short expiration and never select never expire.

Remediation

CLI

aws iam delete-service-specific-credential --user-name <username> --service-specific-credential-id <credential-id>

Other
  1. Sign in to the AWS Management Console and open IAM
  2. Go to Users > select the IAM user backing the Bedrock API key > Security credentials
  3. In "API keys for Amazon Bedrock", select the active long-term key and click Delete
  4. For workloads that still need Bedrock access, generate a short-term API key from the Bedrock console (Short-term API keys tab), or call the Bedrock API with short-term credentials issued by AWS STS

Source Code

Resource Type

AwsIamUser

References