AWS Bedrock Phantom IAM

Overview

Bedrock and Claude API keys that outlive the role or account that minted them are a quiet cloud identity problem. Operators need a path that finds phantom Bedrock IAM, decodes a leaked ABSK offline for IR, and ships prevention and cleanup artifacts you can review before anything mutates AWS.

This is a standing check for exposure management. You run an org or account Bedrock phantom scan when AWS credentials are present, decode a demo or seized ABSK without calling the cloud, and correlate scan evidence with SCP, detection, and dry-run cleanup packs. Without AWS credentials the scan path reports that creds are required instead of inventing an empty clean bill.

It sits next to cloud exposure graphs such as Cloud Bucket Finder. This Collection unit is the Arsenal Bedrock identity path: inventory and IR first, then prevention packs you can take into change review.

Pipeline

1. Discover · Org/Account phantom scan inventories Bedrock phantom IAM when org mode and AWS credentials are set.
2. IR · Decode leaked ABSK/AEAA runs offline key decode on a demo or seized key material.
3. Prevent · SCP + detection pack emits guardrail artifacts for review.
4. Respond · Cleanup plan (dry-run) drafts remediation steps without applying them.
5. Results · Correlate merges scan and IR folders into findings, inventory, and retest outputs.

Inputs

• AWS credentials (vault). Required for the live org/account scan. Leave unset for decode-only smoke.
• org mode. Set when you mean to walk organization accounts.
• ABSK / AEAA material. Demo key for offline decode, or paste a seized key. Vault chips are wired on Discover; you can also set values on the node.

Outputs

• findings.jsonl. Phantom IAM and key-decode evidence rows.
• inventory.jsonl. Accounts and Bedrock surfaces observed.
• SCP / detection pack. Prevention artifacts for change review.
• cleanup plan. Dry-run remediation text; nothing is applied by default.
• retest_delta.jsonl. Schedule-as-diff scaffold when IAM or keys change.

Integrations

• bedrock-keys-security (BHUSA 2026 Arsenal)
• Bedrock key decode (private vault tool)

Sample output

Sample shape from the correlate pack (illustrative, not a live KPI).

kind	title	severity	note
finding	Phantom Bedrock IAM principal	high	null
decode	null	null	Offline ABSK decode row for IR triage
retest_delta	null	null	Schedule re-runs after IAM or key rotation

FAQ

Does the default smoke call my AWS org?

No. Without vault AWS credentials the scan fail-closes. Offline ABSK decode runs on demo or seized material you supply.

Will cleanup mutate my account?

No. The cleanup plan is dry-run text for review. Apply changes through your own change process.

Why schedule this?

Correlate emits a retest delta so scheduled re-runs can surface IAM or key posture change after rotations and offboarding.

Related workflows

• Multi-Cloud Dangling DNS. Reach for this instead when the job is cloud DNS takeover risk, not Bedrock IAM.
• GitHub Secret Scanner. Reach for this instead when you need leaked keys in git history, not Bedrock phantom inventory.