Is the key decode offline?

Yes. decode-key parses the ABSK or AEAA string locally and sends nothing outbound, which is what makes it usable on a key pasted into an incident channel.

How do I scan a whole organization?

Set --mode org-scan with --org true. The tool assumes the cross-account role named by --org-role, defaulting to OrganizationAccountAccessRole, and you can narrow the sweep with --org-accounts.

Using someone else's inference credentials to run models on their account. Stolen Bedrock and Claude Platform keys are the usual route, and the bill is often the first signal the owner sees.

How are AWS credentials supplied?

Through the vault secret ports for access key, secret key, and optional session token, or with --profile when a named AWS profile is available. Treat every key port as a secret and keep it out of committed configuration.

Where is the upstream project?

BeyondTrust publishes bedrock-keys-security at github.com/BeyondTrust/bedrock-keys-security, with the CLI plus service control policies and SIEM detection rules. It appeared in the Black Hat USA 2026 Arsenal.

Updated Aug 27, 2026

Scanners

Hunt phantom IAM users left by Bedrock API keys

Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.

Decode a leaked key without sending it anywhere Find phantom IAM users in one account Sweep an entire organization

overview

What bedrock-keys-security does

Long-lived API keys for AWS Bedrock and the Claude Platform are backed by IAM principals that do not look like the users an operator creates. They sit outside the normal review, they are rarely rotated, and they are the credential class behind LLMjacking, where someone else runs inference on your account and you meet the bill at the end of the month.

The tool covers three jobs through --mode. decode-key parses a leaked ABSK or AEAA string offline, so an incident responder can learn which account and principal a pasted key belongs to without sending it anywhere. scan enumerates one account, and org-scan walks an organization by assuming a cross-account role, with --org-accounts to narrow the sweep and --org-role when the role name is not the default.

Credentials arrive as vault secrets on the aws ports or as an AWS profile, and output is findings.jsonl. The AWS Bedrock Phantom IAM workflow pairs the scan with an offline decode, a service control policy and detection pack, and a dry-run cleanup plan, so response is planned in the same run that found the problem.

source github.com/BeyondTrust/bedrock-keys-security

use cases

Where bedrock-keys-security fits

Decode a leaked key without sending it anywhere

Run decode-key on a pasted ABSK or AEAA string to learn the account and principal behind it during an incident, entirely offline.

Find phantom IAM users in one account

Scan an account for the principals that Bedrock and Claude Platform key creation leaves behind, which ordinary IAM review tends to skip.

Sweep an entire organization

Use org-scan with a cross-account role to cover every account, or narrow the pass with an explicit account list.

Catch LLMjacking before the invoice does

Schedule the scan so an unfamiliar inference principal is a finding rather than a line item you reconcile at month end.

reference

bedrock-keys-security inputs and flags

11 inputs

Name	Type	Flag	Description
mode	STRING	--mode	decode-key (offline IR) \| scan \| org-scan
key	STRING	--key	Optional ABSK paste for IR decode, or vault secret BH_BEDROCK_API_KEY
service	STRING	--service	bedrock \| claude-platform \| all (scan)
org	BOOLEAN	--org	Set to true for an org-wide AssumeRole scan

Showing key inputs. bedrock-keys-security exposes 11 inputs in total.

Full flag reference (11 inputs)

Name	Type	Flag	Description
mode	STRING	--mode	decode-key (offline IR) \| scan \| org-scan
key	STRING	--key	Optional ABSK paste for IR decode, or vault secret BH_BEDROCK_API_KEY
service	STRING	--service	bedrock \| claude-platform \| all (scan)
region	STRING	--region	AWS region (default us-east-1)
profile	STRING	--profile	AWS profile name for scan or org-scan (alternative to key ports)
org	BOOLEAN	--org	Set to true for an org-wide AssumeRole scan
org-role	STRING	--org-role	Cross-account role name (default OrganizationAccountAccessRole)
org-accounts	STRING	--org-accounts	Comma-separated account IDs to include
aws-access-key-id	STRING	--aws-access-key-id	Vault secret BH_AWS_ACCESS_KEY_ID (Library default)
aws-secret-access-key	STRING	--aws-secret-access-key	Vault secret BH_AWS_SECRET_ACCESS_KEY (Library default)
aws-session-token	STRING	--aws-session-token	Vault secret BH_AWS_SESSION_TOKEN (Library default, optional)

example

Run bedrock-keys-security

bedrock-keys-security · command

# offline incident response on a pasted keybedrock-keys-security --mode decode-key --key ABSK... # sweep every account in the organizationbedrock-keys-security --mode org-scan --org true --service all

sample output

{  "tool": "bedrock-keys-security",  "mode": "scan",  "account": "123456789012",  "principal": "BedrockAPIKey-a1b2c3",  "service": "bedrock",  "finding": "phantom IAM user with no rotation and no owner tag",  "severity": "high",  "remediation": "Revoke the key, then apply the SCP from the prevention pack"}

guidance

Choosing bedrock-keys-security

Reach for bedrock-keys-security when the question is which IAM principals your Bedrock and Claude Platform keys created, or what a leaked key belongs to. Use cloudlist for general cloud asset inventory, and use trufflehog when you are looking for the key strings themselves in code.

cloudlist

Multi-cloud asset inventory. Broad coverage of what exists; no model of the phantom principals a Bedrock key creates.

trufflehog

Finds and verifies secrets in repositories and other sources. It locates the leaked key; this tool tells you what the key is attached to.

cloud-enum

Enumerates public cloud resources from outside. Different vantage point, and it does not read IAM at all.

workflows

Workflows using bedrock-keys-security

1 workflow

AWS Bedrock Phantom IAM
Scan Bedrock phantom IAM, decode leaked ABSK keys offline, emit SCP and detection packs, and a dry-run cleanup plan.

faq

bedrock-keys-security questions

An IAM principal created as a side effect of issuing a Bedrock or Claude Platform API key rather than by an operator. It does not appear in the usual user review, so it tends to outlive the person who made it.

Run bedrock-keys-security yourself

An account or organization scope feeds bedrock-keys-security, which reports phantom IAM principals and decodes leaked keys offline.

Open bedrock-keys-security in the library View the workflow

Facts on this page come from the live Trickest tool library.

Hunt phantom IAM users left by Bedrock API keys

Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.

Name

Type

Flag

Description

mode

STRING

--mode

decode-key (offline IR) | scan | org-scan

key

STRING

--key

Optional ABSK paste for IR decode, or vault secret BH_BEDROCK_API_KEY

service

STRING

--service

bedrock | claude-platform | all (scan)

org

BOOLEAN

--org

Set to true for an org-wide AssumeRole scan

Name

Type

Flag

Description

mode

STRING

--mode

decode-key (offline IR) | scan | org-scan

key

STRING

--key

Optional ABSK paste for IR decode, or vault secret BH_BEDROCK_API_KEY

service

STRING

--service

bedrock | claude-platform | all (scan)

region

STRING

--region

AWS region (default us-east-1)

profile

STRING

--profile

AWS profile name for scan or org-scan (alternative to key ports)

org

BOOLEAN

--org

Set to true for an org-wide AssumeRole scan

org-role

STRING

--org-role

Cross-account role name (default OrganizationAccountAccessRole)

org-accounts

STRING

--org-accounts

Comma-separated account IDs to include

aws-access-key-id

STRING

--aws-access-key-id

Vault secret BH_AWS_ACCESS_KEY_ID (Library default)

aws-secret-access-key

STRING

--aws-secret-access-key

Vault secret BH_AWS_SECRET_ACCESS_KEY (Library default)

aws-session-token

STRING

--aws-session-token

Vault secret BH_AWS_SESSION_TOKEN (Library default, optional)

# offline incident response on a pasted keybedrock-keys-security --mode decode-key --key ABSK... # sweep every account in the organizationbedrock-keys-security --mode org-scan --org true --service all

{ "tool": "bedrock-keys-security", "mode": "scan", "account": "123456789012", "principal": "BedrockAPIKey-a1b2c3", "service": "bedrock", "finding": "phantom IAM user with no rotation and no owner tag", "severity": "high", "remediation": "Revoke the key, then apply the SCP from the prevention pack"}

Hunt phantom IAM users left by Bedrock API keys

What bedrock-keys-security does

Where bedrock-keys-security fits

Decode a leaked key without sending it anywhere

Find phantom IAM users in one account

Sweep an entire organization

Catch LLMjacking before the invoice does

bedrock-keys-security inputs and flags

Run bedrock-keys-security

Choosing bedrock-keys-security

cloudlist

trufflehog

cloud-enum

Workflows using bedrock-keys-security

AWS Bedrock Phantom IAM

bedrock-keys-security questions

More Scanners tools

ac-scanner

airixss

cmseek

jaeles

joomscan

nikto

Run bedrock-keys-security yourself

Hunt phantom IAM users left by Bedrock API keys

What bedrock-keys-security does

Where bedrock-keys-security fits

Decode a leaked key without sending it anywhere

Find phantom IAM users in one account

Sweep an entire organization

Catch LLMjacking before the invoice does

bedrock-keys-security inputs and flags

Run bedrock-keys-security

Choosing bedrock-keys-security

cloudlist

trufflehog

cloud-enum

Workflows using bedrock-keys-security

AWS Bedrock Phantom IAM

bedrock-keys-security questions

More Scanners tools

ac-scanner

airixss

cmseek

jaeles

joomscan

nikto

Run bedrock-keys-security yourself