Bedrock Agent Service Roles Should Prevent Cross Service Confused Deputy

Using Console

To prevent a cross‑service confused deputy for Amazon Bedrock Agents, you need to lock down the trust policy on the IAM service role used by your agents.Below are step‑by‑step instructions using the AWS Management Console.

1. Identify the Bedrock Agent service role(s)

Sign in to the AWS Management Console.
Open Amazon Bedrock.
In the left navigation, choose Agents.
For each agent:
- Click the agent name.
- Go to the Agent configuration or Permissions section.
- Note the IAM role shown as the service role used by the agent.
  Example: AmazonBedrockAgentExecutionRole or similar.

You’ll need to update the trust policy for each such role.

2. Open the role in IAM

Open the IAM console.
In the left navigation, choose Roles.
Search for the role name you noted (e.g., AmazonBedrockAgentExecutionRole).
Click the role name.

3. Restrict the trusted principal to Bedrock only

In the role details, go to the Trust relationships tab.
Click Edit trust policy.
Make sure the Principal is only Amazon Bedrock, not a broader service list.
It should look like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:bedrock:*:123456789012:agent/*"
        }
      }
    }
  ]
}

Replace 123456789012 with your AWS account ID.If your agent is in a single Region and you want to be stricter, you can use:

"ArnLike": {
  "aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:agent/*"
}

Make sure:

There is no other service listed in Principal.Service.
There is no wildcard * principal.

4. Save the trust policy

After editing, click Update policy (or Save changes).
Repeat steps 2–4 for every Bedrock Agent service role you use.

5. (Optional) Re‑associate or test agents

Return to the Amazon Bedrock console.
Open an agent that uses this role.
Run a test invocation (e.g., “Test agent” or “Invoke”) to verify the agent still functions.
Watch CloudWatch Logs for any access‑denied issues if you changed other permissions.

This remediation (adding aws:SourceAccount and aws:SourceArn conditions and limiting Principal.Service to bedrock.amazonaws.com) is what prevents a confused deputy scenario for Bedrock Agent service roles.

Using CLI

To prevent confused‑deputy issues for Amazon Bedrock Agents, you must restrict the IAM role trust policy that Bedrock assumes, using aws:SourceAccount and aws:SourceArn conditions.Below are step‑by‑step AWS CLI instructions.

1. Identify the Bedrock Agent service role

If you already know the role name, skip to step 2.Common patterns:

AmazonBedrockExecutionRoleForAgents_*
A custom role specified when you created the agent.

List roles and filter:

aws iam list-roles --query "Roles[?contains(RoleName, 'Bedrock') || contains(RoleName, 'Agent')].RoleName"

Assume the role name is:

BEDROCK_ROLE_NAME="AmazonBedrockExecutionRoleForAgents_MyAgent"

2. Get the current trust policy

aws iam get-role \
  --role-name "$BEDROCK_ROLE_NAME" \
  --query "Role.AssumeRolePolicyDocument" \
  --output json > bedrock-agent-trust-policy-original.json

You’ll edit a new file instead of overwriting this backup.

3. Construct a secure trust policy

You must:

Keep the correct service principal:
bedrock.amazonaws.com
Add both:
- aws:SourceAccount – your AWS account ID
- aws:SourceArn (or ArnLike/ArnEquals) – specific Bedrock Agent ARN(s)

First, get your account ID:

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

Get the Agent ARN(s). For example (Agents API):

aws bedrock-agent list-agents \
  --query "agentSummaries[].agentArn" \
  --output text

Pick the relevant ARN or use a prefix pattern. Example agent ARN:

arn:aws:bedrock:us-east-1:123456789012:agent/abc123

Create a new file bedrock-agent-trust-policy.json with content like:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:agent/*"
        }
      }
    }
  ]
}

Adjust:

Region: us-east-1 → your region
Account: 123456789012 → $ACCOUNT_ID
agent/* → specific agent ID if you want to restrict to one:

"aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:agent/abc123"

If this role is also used by other Bedrock features (e.g., knowledge bases), add separate statements for each service/ARN pattern instead of broadening the existing one.

4. Apply the updated trust policy

aws iam update-assume-role-policy \
  --role-name "$BEDROCK_ROLE_NAME" \
  --policy-document file://bedrock-agent-trust-policy.json

5. (Optional) Verify the applied trust policy

aws iam get-role \
  --role-name "$BEDROCK_ROLE_NAME" \
  --query "Role.AssumeRolePolicyDocument" \
  --output json

Confirm:

Principal.Service is bedrock.amazonaws.com
Condition includes:
- aws:SourceAccount = your account ID
- aws:SourceArn restricted to your Agent ARN(s)

If you share the exact current trust policy JSON, I can give you a precise before/after version tailored to your account, region, and agent IDs.

Using Python

To prevent cross-service confused deputy issues for AWS Bedrock Agents, you must tighten the trust policy of the Agent’s service role so that only your account and your Bedrock agents can assume it. Below is how to do that with Python (boto3).

1. Decide the correct trust policy

Replace 123456789012 with your AWS account ID and set the Region(s) as needed (* is fine if you use multiple Regions):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:bedrock:*:123456789012:agent/*"
        }
      }
    }
  ]
}

This ensures:

Only Bedrock in your account can assume the role.
Only ARNs that match your Bedrock agents can use it (prevents confused deputy).

2. Python script to update an existing Bedrock Agent service role

Install dependencies:

pip install boto3

Python script (e.g., fix_bedrock_agent_trust.py):

import boto3
import json
import boto3.session

def get_account_id():
    sts = boto3.client("sts")
    return sts.get_caller_identity()["Account"]

def update_bedrock_agent_role_trust(role_name, account_id=None, region_wildcard="*"):
    if account_id is None:
        account_id = get_account_id()

    iam = boto3.client("iam")

    # Build secure trust policy
    trust_policy = {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "Service": "bedrock.amazonaws.com"
                },
                "Action": "sts:AssumeRole",
                "Condition": {
                    "StringEquals": {
                        "aws:SourceAccount": account_id
                    },
                    "ArnLike": {
                        "aws:SourceArn": f"arn:aws:bedrock:{region_wildcard}:{account_id}:agent/*"
                    }
                }
            }
        ]
    }

    # Apply the new assume role policy
    iam.update_assume_role_policy(
        RoleName=role_name,
        PolicyDocument=json.dumps(trust_policy)
    )

    print(f"Updated trust policy for role: {role_name}")

if __name__ == "__main__":
    # Replace with the actual Bedrock Agent service role name
    ROLE_NAME = "YourBedrockAgentServiceRoleName"

    update_bedrock_agent_role_trust(ROLE_NAME)

Run:

python fix_bedrock_agent_trust.py

3. Verify the change

In the AWS console, go to IAM → Roles → your Bedrock Agent role.
Check the Trust relationships tab.
Confirm:
- Principal: Service: bedrock.amazonaws.com
- Conditions include aws:SourceAccount and aws:SourceArn as shown above.

If you share the exact role name(s) or how you create Bedrock Agents (CDK, CloudFormation, console, etc.), I can adapt the Python example to generate/create the role as well, not just update it.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Bedrock Agent Service Roles Should Prevent Cross Service Confused Deputy

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify the Bedrock Agent service role(s)

2. Open the role in IAM

3. Restrict the trusted principal to Bedrock only

4. Save the trust policy

5. (Optional) Re‑associate or test agents

1. Identify the Bedrock Agent service role

2. Get the current trust policy

3. Construct a secure trust policy

4. Apply the updated trust policy

5. (Optional) Verify the applied trust policy

1. Decide the correct trust policy

2. Python script to update an existing Bedrock Agent service role

3. Verify the change

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Identify the Bedrock Agent service role(s)

​2. Open the role in IAM

​3. Restrict the trusted principal to Bedrock only

​4. Save the trust policy

​5. (Optional) Re‑associate or test agents

​1. Identify the Bedrock Agent service role

​2. Get the current trust policy

​3. Construct a secure trust policy

​4. Apply the updated trust policy

​5. (Optional) Verify the applied trust policy

​1. Decide the correct trust policy

​2. Python script to update an existing Bedrock Agent service role

​3. Verify the change

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify the Bedrock Agent service role(s)

2. Open the role in IAM

3. Restrict the trusted principal to Bedrock only

4. Save the trust policy

5. (Optional) Re‑associate or test agents

1. Identify the Bedrock Agent service role

2. Get the current trust policy

3. Construct a secure trust policy

4. Apply the updated trust policy

5. (Optional) Verify the applied trust policy

1. Decide the correct trust policy

2. Python script to update an existing Bedrock Agent service role

3. Verify the change