[New Check]: Bedrock Agent roles should have least privilege

[danibarranqueroo]

Existing check search

• I have searched existing issues, Prowler Hub, and the public roadmap, and this check does not already exist.

Provider

AWS

Service or product area

bedrock

Suggested check name

bedrock_agent_roles_least_privilege

Context and goal

Amazon Bedrock Agents execute on behalf of users via an IAM service role exposed as agentResourceRoleArn. When that role is overly permissive, a compromised or prompt-injected agent can perform actions far beyond its intended task — exfiltrating data, invoking unrelated AWS APIs, or escalating privileges. AWS's Well-Architected Generative AI Lens (GENSEC05-BP01) explicitly recommends least-privilege roles, scoped resource ARNs, condition keys, and permission boundaries for agentic workflows.

This check should detect Bedrock Agent execution roles that violate least-privilege principles, mirroring the heuristics in aws-samples/sample-aiml-security-assessment rule BR-08 (check_bedrock_agent_roles).

Expected behavior

Scope: every Bedrock Agent in every region where the Bedrock Agent API is available. The role evaluated is the one returned by bedrock-agent:GetAgent → agentResourceRoleArn.

PASS when the agent execution role meets all of:

• The AWS-managed policy AmazonBedrockFullAccess is not attached.
• No Allow statement (in any attached managed policy or inline policy) uses Resource: "*".
• A PermissionsBoundary is set on the role.
• At least one Allow statement has a Condition that constrains access by VPC (e.g. aws:SourceVpc, aws:SourceVpce).

FAIL when any of the four conditions above is violated. The finding message should list which condition(s) failed.

MANUAL: not needed.

Edge cases:

• list_agents returns empty in a region → skip silently.
• Service-linked roles (AWSServiceRoleForAmazonBedrock*) → exclude (AWS-managed, immutable).
• Deny statements must not be treated as permissive.
• Multiple agents commonly share one role — deduplicate by agentResourceRoleArn before evaluating.

References

• AWS Well-Architected Generative AI Lens — GENSEC05-BP01 "Implement least privilege access and permissions boundaries for agentic workflows": https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec05-bp01.html
• Bedrock IAM identity-based policy examples for agents: https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html
• Reference implementation (BR-08, check_bedrock_agent_roles, lines 1921–2098): https://github.com/aws-samples/sample-aiml-security-assessment/blob/main/aiml-security-assessment/functions/security/bedrock_assessments/app.py
• Rule description in source repo: https://github.com/aws-samples/sample-aiml-security-assessment/blob/main/docs/SECURITY_CHECKS.md
• boto3 SDK:
  • bedrock-agent.list_agents: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/bedrock-agent/client/list_agents.html
  • bedrock-agent.get_agent: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/bedrock-agent/client/get_agent.html

Suggested severity

medium

Additional implementation notes

No response