Check ID: cloudtrail_threat_detection_llm_jacking
Provider: AWS
Service: cloudtrail
Severity: CRITICAL
Categories: threat-detection, gen-ai
Resource type: AwsCloudTrailTrail

​
What this check verifies

CloudTrail Bedrock activity is analyzed per identity for a high diversity of LLM-related API calls (e.g., InvokeModel, InvokeModelWithResponseStream, GetFoundationModelAvailability). If an identity’s share of these actions exceeds a configured threshold over a recent window, it is surfaced as potential LLM-jacking behavior.

​
Risk

Such patterns suggest stolen credential abuse to drive LLM usage.
  • Availability: cost exhaustion and service disruption
  • Confidentiality: leakage of prompts/outputs and model settings
  • Integrity: misuse of permissions for broader access Attackers may use reverse proxies to resell access and obfuscate sources.

​
Recommendation

Apply least privilege to Bedrock; restrict Invoke* only to required roles and deny broadly via SCPs where unused. Enforce MFA and short-lived creds; rotate/remove exposed keys. Enable model invocation logging and budgets/quotas. Continuously monitor for Bedrock enumeration plus invoke bursts. Use defense in depth across identities and networks.

​
Remediation

# SCP denying all Amazon Bedrock actions; attach it to the root/OU/account to halt LLM jacking
resource "aws_organizations_policy" "main" {
  name = "<example_resource_name>"
  type = "SERVICE_CONTROL_POLICY"

  content = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Sid      = "DenyBedrock"
      Effect   = "Deny"
      Action   = "bedrock:*"   // CRITICAL: blocks all Bedrock APIs (prevents further suspicious activity)
      Resource = "*"            // CRITICAL: deny across all resources
    }]
  })
}

resource "aws_organizations_policy_attachment" "attach" {
  policy_id = aws_organizations_policy.main.id
  target_id = "<example_resource_id>"  // CRITICAL: attach to the affected account/OU/root to enforce the deny
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudtrail_threat_detection_llm_jacking. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks