Bedrock service roles prevent crossservice confused deputy remediation

Using Console

To prevent a cross‑service confused deputy for Amazon Bedrock Agents, you need to lock down the trust policy on the IAM service role used by your agents.Below are step‑by‑step instructions using the AWS Management Console.

1. Identify the Bedrock Agent service role(s)

Sign in to the AWS Management Console.
Open Amazon Bedrock.
In the left navigation, choose Agents.
For each agent:
- Click the agent name.
- Go to the Agent configuration or Permissions section.
- Note the IAM role shown as the service role used by the agent.
  Example: AmazonBedrockAgentExecutionRole or similar.

You’ll need to update the trust policy for each such role.

2. Open the role in IAM

Open the IAM console.
In the left navigation, choose Roles.
Search for the role name you noted (e.g., AmazonBedrockAgentExecutionRole).
Click the role name.

3. Restrict the trusted principal to Bedrock only

In the role details, go to the Trust relationships tab.
Click Edit trust policy.
Make sure the Principal is only Amazon Bedrock, not a broader service list.
It should look like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:bedrock:*:123456789012:agent/*"
        }
      }
    }
  ]
}

Replace 123456789012 with your AWS account ID.If your agent is in a single Region and you want to be stricter, you can use:

"ArnLike": {
  "aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:agent/*"
}

Make sure:

There is no other service listed in Principal.Service.
There is no wildcard * principal.

4. Save the trust policy

After editing, click Update policy (or Save changes).
Repeat steps 2–4 for every Bedrock Agent service role you use.

5. (Optional) Re‑associate or test agents

Return to the Amazon Bedrock console.
Open an agent that uses this role.
Run a test invocation (e.g., “Test agent” or “Invoke”) to verify the agent still functions.
Watch CloudWatch Logs for any access‑denied issues if you changed other permissions.

This remediation (adding aws:SourceAccount and aws:SourceArn conditions and limiting Principal.Service to bedrock.amazonaws.com) is what prevents a confused deputy scenario for Bedrock Agent service roles.

Using CLI

To prevent confused‑deputy issues for Amazon Bedrock Agents, you must restrict the IAM role trust policy that Bedrock assumes, using aws:SourceAccount and aws:SourceArn conditions.Below are step‑by‑step AWS CLI instructions.

1. Identify the Bedrock Agent service role

If you already know the role name, skip to step 2.Common patterns:

AmazonBedrockExecutionRoleForAgents_*
A custom role specified when you created the agent.

List roles and filter:

aws iam list-roles --query "Roles[?contains(RoleName, 'Bedrock') || contains(RoleName, 'Agent')].RoleName"

Assume the role name is:

BEDROCK_ROLE_NAME="AmazonBedrockExecutionRoleForAgents_MyAgent"

2. Get the current trust policy

aws iam get-role \
  --role-name "$BEDROCK_ROLE_NAME" \
  --query "Role.AssumeRolePolicyDocument" \
  --output json > bedrock-agent-trust-policy-original.json

You’ll edit a new file instead of overwriting this backup.

3. Construct a secure trust policy

You must:

Keep the correct service principal:
bedrock.amazonaws.com
Add both:
- aws:SourceAccount – your AWS account ID
- aws:SourceArn (or ArnLike/ArnEquals) – specific Bedrock Agent ARN(s)

First, get your account ID:

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

Get the Agent ARN(s). For example (Agents API):

aws bedrock-agent list-agents \
  --query "agentSummaries[].agentArn" \
  --output text

Pick the relevant ARN or use a prefix pattern. Example agent ARN:

arn:aws:bedrock:us-east-1:123456789012:agent/abc123

Create a new file bedrock-agent-trust-policy.json with content like:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:agent/*"
        }
      }
    }
  ]
}

Adjust:

Region: us-east-1 → your region
Account: 123456789012 → $ACCOUNT_ID
agent/* → specific agent ID if you want to restrict to one:

"aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:agent/abc123"

If this role is also used by other Bedrock features (e.g., knowledge bases), add separate statements for each service/ARN pattern instead of broadening the existing one.

4. Apply the updated trust policy

aws iam update-assume-role-policy \
  --role-name "$BEDROCK_ROLE_NAME" \
  --policy-document file://bedrock-agent-trust-policy.json

5. (Optional) Verify the applied trust policy

aws iam get-role \
  --role-name "$BEDROCK_ROLE_NAME" \
  --query "Role.AssumeRolePolicyDocument" \
  --output json

Confirm:

Principal.Service is bedrock.amazonaws.com
Condition includes:
- aws:SourceAccount = your account ID
- aws:SourceArn restricted to your Agent ARN(s)

If you share the exact current trust policy JSON, I can give you a precise before/after version tailored to your account, region, and agent IDs.

Using Python

To prevent cross-service confused deputy issues for AWS Bedrock Agents, you must tighten the trust policy of the Agent’s service role so that only your account and your Bedrock agents can assume it. Below is how to do that with Python (boto3).

1. Decide the correct trust policy

Replace 123456789012 with your AWS account ID and set the Region(s) as needed (* is fine if you use multiple Regions):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:bedrock:*:123456789012:agent/*"
        }
      }
    }
  ]
}

This ensures:

Only Bedrock in your account can assume the role.
Only ARNs that match your Bedrock agents can use it (prevents confused deputy).

2. Python script to update an existing Bedrock Agent service role

Install dependencies:

pip install boto3

Python script (e.g., fix_bedrock_agent_trust.py):

import boto3
import json
import boto3.session

def get_account_id():
    sts = boto3.client("sts")
    return sts.get_caller_identity()["Account"]

def update_bedrock_agent_role_trust(role_name, account_id=None, region_wildcard="*"):
    if account_id is None:
        account_id = get_account_id()

    iam = boto3.client("iam")

    # Build secure trust policy
    trust_policy = {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "Service": "bedrock.amazonaws.com"
                },
                "Action": "sts:AssumeRole",
                "Condition": {
                    "StringEquals": {
                        "aws:SourceAccount": account_id
                    },
                    "ArnLike": {
                        "aws:SourceArn": f"arn:aws:bedrock:{region_wildcard}:{account_id}:agent/*"
                    }
                }
            }
        ]
    }

    # Apply the new assume role policy
    iam.update_assume_role_policy(
        RoleName=role_name,
        PolicyDocument=json.dumps(trust_policy)
    )

    print(f"Updated trust policy for role: {role_name}")

if __name__ == "__main__":
    # Replace with the actual Bedrock Agent service role name
    ROLE_NAME = "YourBedrockAgentServiceRoleName"

    update_bedrock_agent_role_trust(ROLE_NAME)

Run:

python fix_bedrock_agent_trust.py

3. Verify the change

In the AWS console, go to IAM → Roles → your Bedrock Agent role.
Check the Trust relationships tab.
Confirm:
- Principal: Service: bedrock.amazonaws.com
- Conditions include aws:SourceAccount and aws:SourceArn as shown above.

If you share the exact role name(s) or how you create Bedrock Agents (CDK, CloudFormation, console, etc.), I can adapt the Python example to generate/create the role as well, not just update it.

Using Terraform

data "aws_iam_policy_document" "bedrock_agent_trust" {
  statement {
    sid = "BedrockAgentTrust"

    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["bedrock.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]

    # Replace BEDROCK_AGENT_ARN with the specific Bedrock Agent ARN that should assume this role
    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"

      values = [
        "BEDROCK_AGENT_ARN", # e.g. arn:aws:bedrock:us-east-1:123456789012:agent/abc123
      ]
    }
  }

  # If this role is also assumed by other services or principals,
  # add additional `statement` blocks here to preserve that access.
}

resource "aws_iam_role" "bedrock_agent_role" {
  name               = "BEDROCK_AGENT_ROLE_NAME" # replace with your role name
  assume_role_policy = data.aws_iam_policy_document.bedrock_agent_trust.json

  # ... other role arguments (e.g., description, tags) ...
}

This change updates the IAM role’s trust policy to restrict sts:AssumeRole by bedrock.amazonaws.com to a specific Bedrock Agent ARN via the ArnLike aws:SourceArn condition, preventing the cross‑service confused deputy issue. It does not force replacement of the role; Terraform will perform an in‑place update of the trust policy, but you must ensure any other required principals or conditions are also modeled in aws_iam_policy_document to avoid breaking access.Verification: terraform plan should show an in‑place update to aws_iam_role.bedrock_agent_role with a change to assume_role_policy only, adding the Condition -> ArnLike -> aws:SourceArn constraint for the specified Bedrock Agent ARN.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Bedrock service roles prevent crossservice confused deputy remediation

Triage and Remediation

Remediation

1. Identify the Bedrock Agent service role(s)

2. Open the role in IAM

3. Restrict the trusted principal to Bedrock only

4. Save the trust policy

5. (Optional) Re‑associate or test agents

1. Identify the Bedrock Agent service role

2. Get the current trust policy

3. Construct a secure trust policy

4. Apply the updated trust policy

5. (Optional) Verify the applied trust policy

1. Decide the correct trust policy

2. Python script to update an existing Bedrock Agent service role

3. Verify the change

​Triage and Remediation

​Remediation

​1. Identify the Bedrock Agent service role(s)

​2. Open the role in IAM

​3. Restrict the trusted principal to Bedrock only

​4. Save the trust policy

​5. (Optional) Re‑associate or test agents

​1. Identify the Bedrock Agent service role

​2. Get the current trust policy

​3. Construct a secure trust policy

​4. Apply the updated trust policy

​5. (Optional) Verify the applied trust policy

​1. Decide the correct trust policy

​2. Python script to update an existing Bedrock Agent service role

​3. Verify the change

Triage and Remediation

Remediation

1. Identify the Bedrock Agent service role(s)

2. Open the role in IAM

3. Restrict the trusted principal to Bedrock only

4. Save the trust policy

5. (Optional) Re‑associate or test agents

1. Identify the Bedrock Agent service role

2. Get the current trust policy

3. Construct a secure trust policy

4. Apply the updated trust policy

5. (Optional) Verify the applied trust policy

1. Decide the correct trust policy

2. Python script to update an existing Bedrock Agent service role

3. Verify the change