AWS Bedrock Agent Configuration Modification

Lacey Cochrane@NullVectorX

•updated Sep 28, 2026•1•0•2

Detects unauthorized modifications to AWS Bedrock Agent configurations, specifically identifying high-risk activities such as rewriting system prompts for potential prompt injection or attaching cross-account Lambda functions. The rule monitors for UpdateAgent, CreateAgentActionGroup, UpdateAgentActionGroup, and PrepareAgent events.