Regular Bedrock access ensures IAM roles retain only actively used permissions
iam_role_access_not_stale_to_bedrock
IAM roles granted Bedrock permissions are evaluated for recent service usage.
Roles whose last Bedrock access exceeds the configured threshold (default 60 days) or that have never accessed Bedrock are flagged, indicating stale permissions that should be reviewed.
Risk
Stale Bedrock permissions widen the blast radius of a credential compromise.
An attacker who assumes a role with unused Bedrock permissions can invoke foundation models, exfiltrate data through model responses, or incur significant costs — all without triggering expected usage patterns.
prowler aws --checks iam_role_access_not_stale_to_bedrock
arn:partition:iam::account-id:role/resource-id
Recommendation
Apply the principle of least privilege by regularly reviewing IAM Access Advisor data and revoking Bedrock permissions that are no longer actively used.
Establish a periodic access review process and automate alerts for stale permissions to maintain a minimal attack surface.
Remediation
- Open the IAM console and select the role
- Review the Access Advisor tab to confirm Bedrock has not been accessed recently
- Remove or detach any policies granting Bedrock permissions that are no longer needed
- If the role still requires Bedrock access, verify usage and reduce scope to least privilege
Source Code
Resource Type
AwsIamRole
References
Related To
- bedrock_api_key_no_administrative_privileges
- bedrock_api_key_no_long_term_credentials