IAM role does not have AmazonBedrockFullAccess managed policy attached
bedrock_full_access_policy_attached
IAM roles (excluding service roles) are evaluated for attachment of the AWS-managed AmazonBedrockFullAccess policy.
This policy grants unrestricted access to all Amazon Bedrock actions and resources.
Risk
The AmazonBedrockFullAccess policy grants broad permissions across all Bedrock resources. If a role with this policy is compromised, an attacker could:
- Invoke any model to exfiltrate data or generate harmful content
- Modify guardrails, logging, and security configurations
- Incur significant costs through unrestricted model invocations
prowler aws --checks bedrock_full_access_policy_attached
Recommendation
Apply least privilege: replace AmazonBedrockFullAccess with a custom policy granting only the specific Bedrock actions required.
Use permissions boundaries and SCPs to limit the scope of Bedrock permissions. Regularly review access with IAM Access Analyzer to identify and remove unused privileges.
Remediation
aws iam detach-role-policy --role-name <ROLE_NAME> --policy-arn arn:aws:iam::aws:policy/AmazonBedrockFullAccess
- Open the AWS Console and go to IAM > Roles
- Select the role flagged by the check
- On the Permissions tab, find "AmazonBedrockFullAccess" under Attached policies
- Click Detach next to "AmazonBedrockFullAccess"
- Confirm the detach
- Attach a scoped policy granting only required Bedrock actions
Source Code
Resource Type
AwsIamRole
References
Related To
- iam_role_administratoraccess_policy