Check ID: bedrock_api_key_no_long_term_credentials
Provider: AWS
Service: bedrock
Severity: HIGH
Categories: secrets, gen-ai
Resource type: AwsIamUser

​
What this check verifies

Bedrock API keys are evaluated for lifetime and expiration. The finding identifies keys that are long-lived, set to expire far in the future, or configured to never expire, and distinguishes them from keys that have already expired.

​
Risk

Long-lived or non-expiring keys enable persistent access if compromised.
  • Confidentiality: unauthorized inference and exposure of prompts/outputs
  • Availability/Cost: uncontrolled usage and spend spikes
  • Integrity: actions can continue without timely revocation or rotation

​
Recommendation

Prefer short-term credentials and IAM roles; avoid never expire. Enforce least privilege, strict rotation, and automatic expiration for any long-term key. Store secrets securely, monitor with audit logs, and revoke unused or stale keys quickly.

​
Remediation

aws iam delete-service-specific-credential —user-name <username> —service-specific-credential-id <credential-id>

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = bedrock_api_key_no_long_term_credentials. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks