From 3bb329ea16092314d755e94b8c63ef64f407ac33 Mon Sep 17 00:00:00 2001
From: MrCloudSec <sgarcia@beyondtrust.com>
Date: Fri, 28 Aug 2026 11:49:59 -0400
Subject: [PATCH] fix(bedrock-005): remove memory permissions not required when
 memory is disabled

---
 data/paths/bedrock/bedrock-005.yaml | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/data/paths/bedrock/bedrock-005.yaml b/data/paths/bedrock/bedrock-005.yaml
index b9e44c7..a8e7b56 100644
--- a/data/paths/bedrock/bedrock-005.yaml
+++ b/data/paths/bedrock/bedrock-005.yaml
@@ -1,5 +1,5 @@
 id: bedrock-005
-name: iam:PassRole + bedrock-agentcore:CreateHarness + bedrock-agentcore:CreateAgentRuntime + bedrock-agentcore:CreateAgentRuntimeEndpoint + bedrock-agentcore:CreateWorkloadIdentity + bedrock-agentcore:CreateMemory + bedrock-agentcore:GetMemory + bedrock-agentcore:GetAgentRuntime + bedrock-agentcore:GetHarness + bedrock-agentcore:InvokeAgentRuntimeCommand
+name: iam:PassRole + bedrock-agentcore:CreateHarness + bedrock-agentcore:CreateAgentRuntime + bedrock-agentcore:CreateAgentRuntimeEndpoint + bedrock-agentcore:CreateWorkloadIdentity + bedrock-agentcore:GetAgentRuntime + bedrock-agentcore:GetHarness + bedrock-agentcore:InvokeAgentRuntimeCommand
 category: new-passrole
 services:
 - iam
@@ -16,10 +16,6 @@ permissions:
     resourceConstraints: Required to create the runtime endpoint the harness uses
   - permission: bedrock-agentcore:CreateWorkloadIdentity
     resourceConstraints: Required to create the workload identity the underlying runtime needs
-  - permission: bedrock-agentcore:CreateMemory
-    resourceConstraints: AWS requires this permission on every CreateHarness call regardless of the memory configuration chosen, including when memory is explicitly disabled
-  - permission: bedrock-agentcore:GetMemory
-    resourceConstraints: Required alongside CreateMemory as part of CreateHarness's managed-memory provisioning
   - permission: bedrock-agentcore:GetAgentRuntime
     resourceConstraints: Required to resolve the runtime that CreateHarness provisions before invoking it
   - permission: bedrock-agentcore:GetHarness
@@ -62,7 +58,7 @@ exploitationSteps:
         --memory '{"disabled":{}}')
       HARNESS_ARN=$(echo "$CREATE_OUTPUT" | jq -r .harness.arn)
       HARNESS_ID=$(echo "$CREATE_OUTPUT" | jq -r .harness.harnessId)
-    description: Create a harness with the privileged execution role. CreateHarness provisions a runtime, endpoint, workload identity and memory resource under the hood, hence the longer permission chain. Memory is disabled since this attack never uses the managed agent loop, but AWS still requires the memory-related permissions on every CreateHarness call
+    description: Create a harness with the privileged execution role. CreateHarness provisions a runtime, endpoint and workload identity under the hood, hence the longer permission chain. Memory is disabled because the attack never uses the managed agent loop
   - step: 3
     command: |
       while true; do
@@ -255,7 +251,8 @@ attackVisualization:
       aws bedrock-agentcore-control create-harness \
         --harness-name atk_harness \
         --execution-role-arn $EXECUTION_ROLE \
-        --model '{"bedrockModelConfig":{"modelId":"<model-id>"}}'
+        --model '{"bedrockModelConfig":{"modelId":"<model-id>"}}' \
+        --memory '{"disabled":{}}'
       ```
   - from: harness
     to: target_role