Skip to content

fix(bedrock-005): remove memory permissions not required when memory is disabled #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sethsec merged 1 commit into from
Sep 4, 2026
Merged

fix(bedrock-005): remove memory permissions not required when memory is disabled #39

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 4 additions & 7 deletions data/paths/bedrock/bedrock-005.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
id: bedrock-005
name: iam:PassRole + bedrock-agentcore:CreateHarness + bedrock-agentcore:CreateAgentRuntime + bedrock-agentcore:CreateAgentRuntimeEndpoint + bedrock-agentcore:CreateWorkloadIdentity + bedrock-agentcore:CreateMemory + bedrock-agentcore:GetMemory + bedrock-agentcore:GetAgentRuntime + bedrock-agentcore:GetHarness + bedrock-agentcore:InvokeAgentRuntimeCommand
name: iam:PassRole + bedrock-agentcore:CreateHarness + bedrock-agentcore:CreateAgentRuntime + bedrock-agentcore:CreateAgentRuntimeEndpoint + bedrock-agentcore:CreateWorkloadIdentity + bedrock-agentcore:GetAgentRuntime + bedrock-agentcore:GetHarness + bedrock-agentcore:InvokeAgentRuntimeCommand
category: new-passrole
services:
- iam
Expand All @@ -16,10 +16,6 @@ permissions:
resourceConstraints: Required to create the runtime endpoint the harness uses
- permission: bedrock-agentcore:CreateWorkloadIdentity
resourceConstraints: Required to create the workload identity the underlying runtime needs
- permission: bedrock-agentcore:CreateMemory
resourceConstraints: AWS requires this permission on every CreateHarness call regardless of the memory configuration chosen, including when memory is explicitly disabled
- permission: bedrock-agentcore:GetMemory
resourceConstraints: Required alongside CreateMemory as part of CreateHarness's managed-memory provisioning
- permission: bedrock-agentcore:GetAgentRuntime
resourceConstraints: Required to resolve the runtime that CreateHarness provisions before invoking it
- permission: bedrock-agentcore:GetHarness
Expand Down Expand Up @@ -62,7 +58,7 @@ exploitationSteps:
--memory '{"disabled":{}}')
HARNESS_ARN=$(echo "$CREATE_OUTPUT" | jq -r .harness.arn)
HARNESS_ID=$(echo "$CREATE_OUTPUT" | jq -r .harness.harnessId)
description: Create a harness with the privileged execution role. CreateHarness provisions a runtime, endpoint, workload identity and memory resource under the hood, hence the longer permission chain. Memory is disabled since this attack never uses the managed agent loop, but AWS still requires the memory-related permissions on every CreateHarness call
description: Create a harness with the privileged execution role. CreateHarness provisions a runtime, endpoint and workload identity under the hood, hence the longer permission chain. Memory is disabled because the attack never uses the managed agent loop
- step: 3
command: |
while true; do
Expand Down Expand Up @@ -255,7 +251,8 @@ attackVisualization:
aws bedrock-agentcore-control create-harness \
--harness-name atk_harness \
--execution-role-arn $EXECUTION_ROLE \
--model '{"bedrockModelConfig":{"modelId":"<model-id>"}}'
--model '{"bedrockModelConfig":{"modelId":"<model-id>"}}' \
--memory '{"disabled":{}}'
```
- from: harness
to: target_role
Expand Down
Loading