IAM roles retain only actively used Bedrock permissions

​

What this check verifies

IAM roles granted Bedrock permissions are evaluated for recent service usage. Roles whose last Bedrock access exceeds the configured threshold (default 60 days) or that have never accessed Bedrock are flagged, indicating stale permissions that should be reviewed.

​

Risk

Stale Bedrock permissions widen the blast radius of a credential compromise. An attacker who assumes a role with unused Bedrock permissions can invoke foundation models, exfiltrate data through model responses, or incur significant costs — all without triggering expected usage patterns.

​

Recommendation

Apply the principle of least privilege by regularly reviewing IAM Access Advisor data and revoking Bedrock permissions that are no longer actively used. Establish a periodic access review process and automate alerts for stale permissions to maintain a minimal attack surface.

​

Remediation

Dashboard steps

1. Open the IAM console and select the role
2. Review the Access Advisor tab to confirm Bedrock has not been accessed recently
3. Remove or detach any policies granting Bedrock permissions that are no longer needed
4. If the role still requires Bedrock access, verify usage and reduce scope to least privilege

​

References

• https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html
• https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html
• https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#remove-credentials

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_role_access_not_stale_to_bedrock. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks