Amazon Bedrock access control & privilege security checks
Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.
On Amazon Bedrock, Black Cat runs 4 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Amazon Bedrock connector needs.
Checks (4)
severity: critical Bedrock Agent Overprivileged Execution Role fix difficulty: medium #
Apply least-privilege policies to the agent execution role
- Open AWS IAM Console > Roles
- Find the agent's execution role
- Replace wildcard actions/resources with specific permissions
Satisfies: NIS2 Directive NIS2-21.i.4 DORA (SaaS Security) DORA-9.3
severity: high Bedrock Agent Cross-Account Role fix difficulty: medium #
Remove cross-account resource references from the execution role
- Open AWS IAM Console > Roles
- Review policy statements for external account ARNs
- Replace with same-account resources or remove
Satisfies: NIS2 Directive NIS2-21.i.4 DORA (SaaS Security) DORA-9.3
severity: high Bedrock Agent No Guardrail fix difficulty: medium #
Attach a Bedrock Guardrail to this agent
- Open AWS Bedrock Console > Guardrails
- Create or select an appropriate guardrail
- Attach it to the agent configuration
Satisfies: NIS2 Directive NIS2-21.i.4 DORA (SaaS Security) DORA-9.3
severity: medium Bedrock Agent Excessive Action Groups fix difficulty: medium #
Reduce the number of action groups to 3 or fewer
- Open AWS Bedrock Console > Agents
- Review action groups and consolidate or remove unnecessary ones
Satisfies: NIS2 Directive NIS2-21.i.4 DORA (SaaS Security) DORA-9.3