AWS Bedrock Vulnerability - Agent God Mode Exposed

What Happened

Unit 42 has uncovered a significant vulnerability in Amazon Bedrock's AgentCore, dubbed Agent God Mode. This flaw arises from the overly broad Identity and Access Management (IAM) permissions automatically granted by the AgentCore starter toolkit. These permissions enable an AI agent to escalate its privileges and potentially compromise other agents within the AWS account.

Who's Affected

This vulnerability primarily impacts organizations utilizing Amazon Bedrock's AgentCore for deploying AI agents. Any user or organization relying on the default IAM roles generated by the starter toolkit is at risk of exposure.

What Data Was Exposed

The excessive permissions could allow attackers to:

• Exfiltrate proprietary Elastic Container Registry (ECR) images
• Access other agents’ memory
• Invoke code interpreters
• Extract sensitive data This means that if an attacker compromises one agent, they could potentially access a wealth of sensitive information across the entire AWS account.

What You Should Do

Organizations using AWS Bedrock should take immediate action by:

• Creating custom IAM roles that adhere to the principle of least privilege for production environments.
• Reviewing existing IAM roles and permissions to identify any that may be overly permissive.
• Monitoring agent activities for any unauthorized access or suspicious behavior.
• Consulting AWS documentation for updated security practices and guidelines.

Technical Analysis

The default IAM roles generated by the AgentCore starter toolkit are designed for ease of deployment but fail to enforce strict permission boundaries. This oversight creates a high-risk environment where agents can potentially access and manipulate each other's data and resources.

Cross-Agent Data Access

The default policy allows agents to read the memories of all other agents in the account. An attacker with read access could exfiltrate sensitive interaction data, leading to significant data breaches.

Indirect Privilege Escalation

The Code Interpreter utilized by the AgentCore operates under its own IAM roles, allowing an attacker to exploit this separation. By compromising an agent, an attacker could execute code with elevated privileges, further compromising the environment.

ECR Exfiltration

The unrestricted access to ECR repositories poses a severe risk, as attackers can pull images from any repository, gaining access to sensitive data and proprietary algorithms.

Conclusion

The findings from Unit 42 highlight the critical need for organizations to understand the implications of using the default IAM roles provided by AWS. The AWS Security team has acknowledged the issue and recommends that users create custom IAM roles tailored to their specific needs. Failing to do so could expose organizations to significant security risks, including data breaches and unauthorized access.