Skip to content

Commit 8e37bd8

Browse files
jkpaz525jkpaz525
authored
Merge pull request #20 from jkpaz525/feature-branch
Added detections and cfn solution for Bedrock API Keys
2 parents d55b02f + 0d9c482 commit 8e37bd8

File tree

4 files changed

+380
-41
lines changed

4 files changed

+380
-41
lines changed

‎.vscode/settings.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
{
2+
}

‎detections/Bedrock_Api_Key_Eventbridge_Detection.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
2+
# Bedrock API Security Monitoring
3+
4+
A CloudFormation solution that monitors Amazon Bedrock API activity for security events, specifically tracking service-specific credential creation and bearer token usage through CloudTrail logs.
5+
6+
## Overview
7+
8+
This solution creates two EventBridge rules to monitor CloudTrail logs for specific Bedrock API security events. When events are detected, notifications are sent via SNS to subscribed email addresses.
9+
10+
## Features
11+
12+
- **CreateServiceSpecificCredential Monitoring**: Detects IAM API calls for credential creation
13+
- **Bearer Token Usage Detection**: Monitors API calls using bearer tokens
14+
15+
16+
## Architecture
17+
18+
The solution consists of:
19+
20+
- **EventBridge Rules**: Two rules that monitor CloudTrail for credential creation and bearer token usage
21+
- **SNS Topic**: Delivers encrypted security alerts via email
22+
- **KMS Key**: Encrypts SNS messages
23+
- **IAM Roles**: Provide necessary access for service operations
24+
25+
26+
## Deployment
27+
28+
[Download the template](./cfn/bedrock-eventbridge-monitoring.yaml)
29+
30+
Deploy using AWS CLI:
31+
32+
```bash
33+
aws cloudformation create-stack \
34+
--stack-name bedrock--api-security-monitoring \
35+
--template-body file://bedrock-eventbridge-monitoring.yaml \
36+
--capabilities CAPABILITY_NAMED_IAM
37+
```
38+
39+
Or deploy via AWS Console by uploading the template file.
40+
41+

‎detections/cfn/bedrock-eventbridge-monitoring.yaml‎

Lines changed: 292 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,292 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: 'CloudFormation template to monitor CloudTrail events using EventBridge rules for CreateServiceSpecificCredential and Bearer Token usage'
3+
4+
Parameters:
5+
NotificationEmail:
6+
Type: String
7+
AllowedPattern: '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
8+
ConstraintDescription: Must be a valid email address
9+
EventBusName:
10+
Type: String
11+
Description: Name of the EventBridge Event Bus (use 'default' for default bus)
12+
Default: default
13+
14+
Resources:
15+
# KMS Key for SNS Topic encryption
16+
SNSEncryptionKey:
17+
Type: AWS::KMS::Key
18+
Properties:
19+
Description: KMS key for encrypting Bedrock security alerts SNS topic
20+
EnableKeyRotation: true
21+
KeyPolicy:
22+
Version: '2012-10-17'
23+
Statement:
24+
- Effect: Allow
25+
Principal:
26+
AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
27+
Action: "kms:*"
28+
Resource: "*"
29+
# Allow EventBridge to use the key for SNS publishing
30+
- Effect: Allow
31+
Principal:
32+
Service: events.amazonaws.com
33+
Action:
34+
- kms:Encrypt
35+
- kms:Decrypt
36+
- kms:ReEncrypt*
37+
- kms:GenerateDataKey*
38+
- kms:DescribeKey
39+
Resource: "*"
40+
Condition:
41+
StringEquals:
42+
'kms:ViaService': !Sub "sns.${AWS::Region}.amazonaws.com"
43+
# Allow SNS service to use the key
44+
- Effect: Allow
45+
Principal:
46+
Service: sns.amazonaws.com
47+
Action:
48+
- kms:Encrypt
49+
- kms:Decrypt
50+
- kms:ReEncrypt*
51+
- kms:GenerateDataKey*
52+
- kms:DescribeKey
53+
Resource: "*"
54+
55+
# KMS Key Alias for easier reference
56+
SNSEncryptionKeyAlias:
57+
Type: AWS::KMS::Alias
58+
Properties:
59+
AliasName: !Sub "alias/${AWS::StackName}-sns-encryption-key"
60+
TargetKeyId: !Ref SNSEncryptionKey
61+
62+
# IAM Role for EventBridge to publish to SNS
63+
EventBridgeServiceRole:
64+
Type: AWS::IAM::Role
65+
Metadata:
66+
guard:
67+
SuppressedRules:
68+
- rule: cfn_no_explicit_resource_names
69+
reason: "This bucket has a name inherited by the stack name"
70+
Properties:
71+
RoleName: !Sub "${AWS::StackName}-EventBridge-ServiceRole"
72+
AssumeRolePolicyDocument:
73+
Version: '2012-10-17'
74+
Statement:
75+
- Effect: Allow
76+
Principal:
77+
Service: events.amazonaws.com
78+
Action: sts:AssumeRole
79+
Path: /
80+
81+
# IAM Policy for EventBridge SNS operations
82+
EventBridgeSNSPolicy:
83+
Type: AWS::IAM::Policy
84+
Properties:
85+
PolicyName: !Sub "${AWS::StackName}-EventBridge-SNS-Policy"
86+
PolicyDocument:
87+
Version: '2012-10-17'
88+
Statement:
89+
# Allow publishing to the specific SNS topic only
90+
- Effect: Allow
91+
Action:
92+
- sns:Publish
93+
Resource: !Ref BedrockAlertsTopic
94+
# Allow reading SNS topic attributes for the specific topic
95+
- Effect: Allow
96+
Action:
97+
- sns:GetTopicAttributes
98+
Resource: !Ref BedrockAlertsTopic
99+
# Allow KMS operations for the specific key
100+
- Effect: Allow
101+
Action:
102+
- kms:Encrypt
103+
- kms:Decrypt
104+
- kms:ReEncrypt*
105+
- kms:GenerateDataKey*
106+
- kms:DescribeKey
107+
Resource: !GetAtt SNSEncryptionKey.Arn
108+
Condition:
109+
StringEquals:
110+
'kms:ViaService': !Sub "sns.${AWS::Region}.amazonaws.com"
111+
Roles:
112+
- !Ref EventBridgeServiceRole
113+
114+
# SNS Topic for notifications
115+
BedrockAlertsTopic:
116+
Type: AWS::SNS::Topic
117+
Properties:
118+
TopicName: !Sub "${AWS::StackName}-BedrockAlertsNotifications"
119+
DisplayName: Security Events Monitoring via EventBridge
120+
KmsMasterKeyId: !Ref SNSEncryptionKey
121+
122+
# SNS Topic Policy to allow EventBridge to publish
123+
BedrockAlertsTopicPolicy:
124+
Type: AWS::SNS::TopicPolicy
125+
Properties:
126+
Topics:
127+
- !Ref BedrockAlertsTopic
128+
PolicyDocument:
129+
Version: '2012-10-17'
130+
Statement:
131+
- Effect: Allow
132+
Principal:
133+
Service: events.amazonaws.com
134+
Action:
135+
- sns:Publish
136+
Resource: !Ref BedrockAlertsTopic
137+
Condition:
138+
StringEquals:
139+
'aws:SourceAccount': !Ref 'AWS::AccountId'
140+
141+
# SNS Subscription for email notifications
142+
EmailSubscription:
143+
Type: AWS::SNS::Subscription
144+
Properties:
145+
Protocol: email
146+
TopicArn: !Ref BedrockAlertsTopic
147+
Endpoint: !Ref NotificationEmail
148+
149+
# EventBridge Rule for CreateServiceSpecificCredential events
150+
CreateServiceSpecificCredentialRule:
151+
Type: AWS::Events::Rule
152+
Properties:
153+
Name: !Sub "${AWS::StackName}-CreateServiceSpecificCredential-Rule"
154+
Description: "EventBridge rule to detect CreateServiceSpecificCredential API calls"
155+
EventBusName: !Ref EventBusName
156+
EventPattern:
157+
source:
158+
- "aws.iam"
159+
detail-type:
160+
- "AWS API Call via CloudTrail"
161+
detail:
162+
eventSource:
163+
- "iam.amazonaws.com"
164+
eventName:
165+
- "CreateServiceSpecificCredential"
166+
State: ENABLED
167+
Targets:
168+
- Arn: !Ref BedrockAlertsTopic
169+
Id: "CreateServiceSpecificCredentialSNSTarget"
170+
RoleArn: !GetAtt EventBridgeServiceRole.Arn
171+
InputTransformer:
172+
InputPathsMap:
173+
account: "$.account"
174+
region: "$.region"
175+
time: "$.time"
176+
user: "$.detail.userIdentity.userName"
177+
sourceIP: "$.detail.sourceIPAddress"
178+
userAgent: "$.detail.userAgent"
179+
eventName: "$.detail.eventName"
180+
awsRegion: "$.detail.awsRegion"
181+
InputTemplate: |
182+
{
183+
"alertType": "SECURITY_ALERT",
184+
"severity": "HIGH",
185+
"eventName": "<eventName>",
186+
"description": "CreateServiceSpecificCredential API call detected",
187+
"details": {
188+
"account": "<account>",
189+
"region": "<region>",
190+
"time": "<time>",
191+
"user": "<user>",
192+
"sourceIP": "<sourceIP>",
193+
"userAgent": "<userAgent>",
194+
"awsRegion": "<awsRegion>"
195+
},
196+
"recommendations": [
197+
"Review the legitimacy of this service-specific credential creation",
198+
"Verify the user identity and source IP address",
199+
"Check if this action aligns with your security policies"
200+
]
201+
}
202+
203+
# EventBridge Rule for Bearer Token usage events
204+
BearerTokenUsageRule:
205+
Type: AWS::Events::Rule
206+
Properties:
207+
Name: !Sub "${AWS::StackName}-BearerTokenUsage-Rule"
208+
Description: "EventBridge rule to detect Bedrock API calls with bearer tokens"
209+
EventPattern:
210+
detail-type:
211+
- "AWS API Call via CloudTrail"
212+
detail:
213+
additionalEventData:
214+
callWithBearerToken:
215+
- true
216+
State: ENABLED
217+
Targets:
218+
- Arn: !Ref BedrockAlertsTopic
219+
Id: "BearerTokenUsageSNSTarget"
220+
RoleArn: !GetAtt EventBridgeServiceRole.Arn
221+
InputTransformer:
222+
InputPathsMap:
223+
account: "$.account"
224+
region: "$.region"
225+
time: "$.time"
226+
user: "$.detail.userIdentity.userName"
227+
sourceIP: "$.detail.sourceIPAddress"
228+
userAgent: "$.detail.userAgent"
229+
eventName: "$.detail.eventName"
230+
awsRegion: "$.detail.awsRegion"
231+
requestID: "$.detail.requestID"
232+
InputTemplate: |
233+
{
234+
"alertType": "SECURITY_ALERT",
235+
"severity": "CRITICAL",
236+
"eventName": "<eventName>",
237+
"description": "Bedrock API call with bearer token detected",
238+
"details": {
239+
"account": "<account>",
240+
"region": "<region>",
241+
"time": "<time>",
242+
"user": "<user>",
243+
"sourceIP": "<sourceIP>",
244+
"userAgent": "<userAgent>",
245+
"awsRegion": "<awsRegion>",
246+
"requestID": "<requestID>",
247+
"bearerTokenUsed": true
248+
},
249+
"recommendations": [
250+
"IMMEDIATE ACTION REQUIRED: Bearer token usage detected",
251+
"Review and validate the source of this API call",
252+
"Check if bearer token usage is authorized in your environment",
253+
"Consider implementing SCPs to prevent bearer token usage",
254+
"Audit all recent Bedrock API activities from this user/source"
255+
]
256+
}
257+
Outputs:
258+
SNSTopicArn:
259+
Description: ARN of the SNS Topic for security alerts
260+
Value: !Ref BedrockAlertsTopic
261+
Export:
262+
Name: !Sub "${AWS::StackName}-SNSTopicArn"
263+
264+
SNSEncryptionKeyArn:
265+
Description: ARN of the KMS key used for SNS topic encryption
266+
Value: !GetAtt SNSEncryptionKey.Arn
267+
Export:
268+
Name: !Sub "${AWS::StackName}-SNSEncryptionKeyArn"
269+
270+
SNSEncryptionKeyAlias:
271+
Description: Alias of the KMS key used for SNS topic encryption
272+
Value: !Ref SNSEncryptionKeyAlias
273+
Export:
274+
Name: !Sub "${AWS::StackName}-SNSEncryptionKeyAlias"
275+
276+
EventBridgeServiceRoleArn:
277+
Description: ARN of the IAM Service Role for EventBridge operations
278+
Value: !GetAtt EventBridgeServiceRole.Arn
279+
Export:
280+
Name: !Sub "${AWS::StackName}-EventBridgeServiceRoleArn"
281+
282+
CreateServiceSpecificCredentialRuleArn:
283+
Description: ARN of the CreateServiceSpecificCredential EventBridge rule
284+
Value: !GetAtt CreateServiceSpecificCredentialRule.Arn
285+
Export:
286+
Name: !Sub "${AWS::StackName}-CreateServiceSpecificCredentialRule"
287+
288+
BearerTokenUsageRuleArn:
289+
Description: ARN of the Bearer Token usage EventBridge rule
290+
Value: !GetAtt BearerTokenUsageRule.Arn
291+
Export:
292+
Name: !Sub "${AWS::StackName}-BearerTokenUsageRule"

0 commit comments

Comments
 (0)