> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Bedrock Agent Service Roles Should Prevent Cross Service Confused Deputy

### More Info:

Bedrock Agent Service Roles should prevent cross service confused deputy

### Risk Level

High

### Address

Monitoring, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO/IEC 27018
* ISO/IEC 27701
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* StateRAMP
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To prevent a cross‑service confused deputy for Amazon Bedrock Agents, you need to lock down the **trust policy** on the IAM service role used by your agents.

        Below are step‑by‑step instructions using the AWS Management Console.

        ***

        ### 1. Identify the Bedrock Agent service role(s)

        1. Sign in to the **AWS Management Console**.
        2. Open **Amazon Bedrock**.
        3. In the left navigation, choose **Agents**.
        4. For each agent:
           * Click the **agent name**.
           * Go to the **Agent configuration** or **Permissions** section.
           * Note the **IAM role** shown as the service role used by the agent.\
             Example: `AmazonBedrockAgentExecutionRole` or similar.

        You’ll need to update the trust policy for each such role.

        ***

        ### 2. Open the role in IAM

        1. Open the **IAM** console.
        2. In the left navigation, choose **Roles**.
        3. Search for the role name you noted (e.g., `AmazonBedrockAgentExecutionRole`).
        4. Click the **role name**.

        ***

        ### 3. Restrict the trusted principal to Bedrock only

        1. In the role details, go to the **Trust relationships** tab.
        2. Click **Edit trust policy**.
        3. Make sure the `Principal` is **only** Amazon Bedrock, not a broader service list.\
           It should look like this:

        ```json theme={null}
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "bedrock.amazonaws.com"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "aws:SourceAccount": "123456789012"
                },
                "ArnLike": {
                  "aws:SourceArn": "arn:aws:bedrock:*:123456789012:agent/*"
                }
              }
            }
          ]
        }
        ```

        Replace `123456789012` with **your AWS account ID**.

        If your agent is in a single Region and you want to be stricter, you can use:

        ```json theme={null}
        "ArnLike": {
          "aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:agent/*"
        }
        ```

        Make sure:

        * There is **no** other service listed in `Principal.Service`.
        * There is **no** wildcard `*` principal.

        ***

        ### 4. Save the trust policy

        1. After editing, click **Update policy** (or **Save changes**).
        2. Repeat steps 2–4 for every Bedrock Agent service role you use.

        ***

        ### 5. (Optional) Re‑associate or test agents

        1. Return to the **Amazon Bedrock** console.
        2. Open an agent that uses this role.
        3. Run a **test invocation** (e.g., “Test agent” or “Invoke”) to verify the agent still functions.
        4. Watch **CloudWatch Logs** for any access‑denied issues if you changed other permissions.

        ***

        This remediation (adding `aws:SourceAccount` and `aws:SourceArn` conditions and limiting `Principal.Service` to `bedrock.amazonaws.com`) is what prevents a confused deputy scenario for Bedrock Agent service roles.
      </Accordion>

      <Accordion title="Using CLI">
        To prevent confused‑deputy issues for Amazon Bedrock Agents, you must restrict the **IAM role trust policy** that Bedrock assumes, using `aws:SourceAccount` and `aws:SourceArn` conditions.

        Below are step‑by‑step AWS CLI instructions.

        ***

        ## 1. Identify the Bedrock Agent service role

        If you already know the role name, skip to step 2.

        Common patterns:

        * `AmazonBedrockExecutionRoleForAgents_*`
        * A custom role specified when you created the agent.

        List roles and filter:

        ```bash theme={null}
        aws iam list-roles --query "Roles[?contains(RoleName, 'Bedrock') || contains(RoleName, 'Agent')].RoleName"
        ```

        Assume the role name is:

        ```bash theme={null}
        BEDROCK_ROLE_NAME="AmazonBedrockExecutionRoleForAgents_MyAgent"
        ```

        ***

        ## 2. Get the current trust policy

        ```bash theme={null}
        aws iam get-role \
          --role-name "$BEDROCK_ROLE_NAME" \
          --query "Role.AssumeRolePolicyDocument" \
          --output json > bedrock-agent-trust-policy-original.json
        ```

        You’ll edit a new file instead of overwriting this backup.

        ***

        ## 3. Construct a secure trust policy

        You must:

        * Keep the correct service principal:\
          `bedrock.amazonaws.com`
        * Add **both**:
          * `aws:SourceAccount` – your AWS account ID
          * `aws:SourceArn` (or `ArnLike`/`ArnEquals`) – specific Bedrock Agent ARN(s)

        First, get your account ID:

        ```bash theme={null}
        ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
        ```

        Get the Agent ARN(s). For example (Agents API):

        ```bash theme={null}
        aws bedrock-agent list-agents \
          --query "agentSummaries[].agentArn" \
          --output text
        ```

        Pick the relevant ARN or use a prefix pattern. Example agent ARN:

        ```text theme={null}
        arn:aws:bedrock:us-east-1:123456789012:agent/abc123
        ```

        Create a new file `bedrock-agent-trust-policy.json` with content like:

        ```json theme={null}
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "bedrock.amazonaws.com"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "aws:SourceAccount": "123456789012"
                },
                "ArnLike": {
                  "aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:agent/*"
                }
              }
            }
          ]
        }
        ```

        Adjust:

        * Region: `us-east-1` → your region
        * Account: `123456789012` → `$ACCOUNT_ID`
        * `agent/*` → specific agent ID if you want to restrict to one:

        ```json theme={null}
        "aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:agent/abc123"
        ```

        If this role is also used by other Bedrock features (e.g., knowledge bases), add **separate statements** for each service/ARN pattern instead of broadening the existing one.

        ***

        ## 4. Apply the updated trust policy

        ```bash theme={null}
        aws iam update-assume-role-policy \
          --role-name "$BEDROCK_ROLE_NAME" \
          --policy-document file://bedrock-agent-trust-policy.json
        ```

        ***

        ## 5. (Optional) Verify the applied trust policy

        ```bash theme={null}
        aws iam get-role \
          --role-name "$BEDROCK_ROLE_NAME" \
          --query "Role.AssumeRolePolicyDocument" \
          --output json
        ```

        Confirm:

        * `Principal.Service` is `bedrock.amazonaws.com`
        * `Condition` includes:
          * `aws:SourceAccount` = your account ID
          * `aws:SourceArn` restricted to your Agent ARN(s)

        ***

        If you share the exact current trust policy JSON, I can give you a precise before/after version tailored to your account, region, and agent IDs.
      </Accordion>

      <Accordion title="Using Python">
        To prevent cross-service confused deputy issues for AWS Bedrock Agents, you must **tighten the trust policy of the Agent’s service role** so that only your account and your Bedrock agents can assume it. Below is how to do that with Python (boto3).

        ***

        ## 1. Decide the correct trust policy

        Replace `123456789012` with your AWS account ID and set the Region(s) as needed (`*` is fine if you use multiple Regions):

        ```json theme={null}
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "bedrock.amazonaws.com"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "aws:SourceAccount": "123456789012"
                },
                "ArnLike": {
                  "aws:SourceArn": "arn:aws:bedrock:*:123456789012:agent/*"
                }
              }
            }
          ]
        }
        ```

        This ensures:

        * Only Bedrock in your account can assume the role.
        * Only ARNs that match your Bedrock agents can use it (prevents confused deputy).

        ***

        ## 2. Python script to update an existing Bedrock Agent service role

        Install dependencies:

        ```bash theme={null}
        pip install boto3
        ```

        Python script (e.g., `fix_bedrock_agent_trust.py`):

        ```python theme={null}
        import boto3
        import json
        import boto3.session

        def get_account_id():
            sts = boto3.client("sts")
            return sts.get_caller_identity()["Account"]

        def update_bedrock_agent_role_trust(role_name, account_id=None, region_wildcard="*"):
            if account_id is None:
                account_id = get_account_id()

            iam = boto3.client("iam")

            # Build secure trust policy
            trust_policy = {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "bedrock.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole",
                        "Condition": {
                            "StringEquals": {
                                "aws:SourceAccount": account_id
                            },
                            "ArnLike": {
                                "aws:SourceArn": f"arn:aws:bedrock:{region_wildcard}:{account_id}:agent/*"
                            }
                        }
                    }
                ]
            }

            # Apply the new assume role policy
            iam.update_assume_role_policy(
                RoleName=role_name,
                PolicyDocument=json.dumps(trust_policy)
            )

            print(f"Updated trust policy for role: {role_name}")

        if __name__ == "__main__":
            # Replace with the actual Bedrock Agent service role name
            ROLE_NAME = "YourBedrockAgentServiceRoleName"

            update_bedrock_agent_role_trust(ROLE_NAME)
        ```

        Run:

        ```bash theme={null}
        python fix_bedrock_agent_trust.py
        ```

        ***

        ## 3. Verify the change

        1. In the AWS console, go to IAM → Roles → your Bedrock Agent role.
        2. Check the **Trust relationships** tab.
        3. Confirm:
           * Principal: `Service: bedrock.amazonaws.com`
           * Conditions include `aws:SourceAccount` and `aws:SourceArn` as shown above.

        ***

        If you share the exact role name(s) or how you create Bedrock Agents (CDK, CloudFormation, console, etc.), I can adapt the Python example to generate/create the role as well, not just update it.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>