Regular Bedrock access ensures IAM users retain only actively used permissions
iam_user_access_not_stale_to_bedrock
IAM users granted Bedrock permissions are evaluated for recent service usage.
Users whose last Bedrock access exceeds the configured threshold (default 60 days) or that have never accessed Bedrock are flagged, indicating stale permissions that should be reviewed.
Risk
Stale Bedrock permissions widen the blast radius of a credential compromise.
An attacker who gains access to a user with unused Bedrock permissions can invoke foundation models, exfiltrate data through model responses, or incur significant costs — all without triggering expected usage patterns.
prowler aws --checks iam_user_access_not_stale_to_bedrock
arn:partition:iam::account-id:user/resource-id
Recommendation
Apply the principle of least privilege by regularly reviewing IAM Access Advisor data and revoking Bedrock permissions that are no longer actively used.
Establish a periodic access review process and automate alerts for stale permissions to maintain a minimal attack surface.
Remediation
- Open the IAM console and select the user
- Review the Access Advisor tab to confirm Bedrock has not been accessed recently
- Remove or detach any policies granting Bedrock permissions that are no longer needed
- If the user still requires Bedrock access, verify usage and reduce scope to least privilege
Source Code
Resource Type
AwsIamUser
References
Related To
- bedrock_api_key_no_administrative_privileges
- bedrock_api_key_no_long_term_credentials