[New Rule] AWS Bedrock AgentCore Resource Created with IAM Execution Role

[bryans3c]

Pull Request

Issue link(s):

• https://github.com/elastic/ia-trade-team/issues/955

Summary - What I changed

Added a KQL query rule that detects the creation of an AWS Bedrock AgentCore resource (code interpreter, agent runtime, browser, or harness) with an IAM execution role attached via iam:PassRole.

Why it matters

AWS Bedrock AgentCore resources run user workloads inside isolated MicroVMs. When an IAM role is attached at creation time, all code executing inside the resource assumes that role's identity. An attacker with iam:PassRole and bedrock-agentcore:Create* permissions can attach a privileged role to a new AgentCore resource and then invoke it to operate as that role, escalating privileges to any role that trusts bedrock-agentcore.amazonaws.com as a service principal.

• https://www.beyondtrust.com/blog/entry/aws-agentcore-privilege-escalation

How To Test

Query to verify in our TRaDE stack:

event.dataset: "aws.cloudtrail" and
  event.provider: "bedrock-agentcore.amazonaws.com" and
  event.action: (
    "CreateCodeInterpreter" or
    "CreateAgentRuntime" or
    "CreateBrowser" or
    "CreateHarness"
  ) and
  event.outcome: "success" and
  aws.cloudtrail.request_parameters: (*executionRoleArn* or *roleArn*) and
  not user_agent.original: (*Terraform* or *Pulumi*)

Checklist

• Added a label for the type of pr: Rule: New
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[Copilot]

Pull request overview

Adds a new AWS CloudTrail KQL detection rule aimed at identifying potential privilege escalation via AWS Bedrock AgentCore resource creation when an IAM execution role is attached at creation time.

Changes:

• Introduces a new query rule targeting bedrock-agentcore.amazonaws.com Create* actions where executionRoleArn/roleArn appears in request parameters.
• Adds an investigation guide describing triage, false positives, and response/remediation guidance.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[terrancedejesus]

Looks good, added a suggestion.