🔶 Cracks in the Bedrock: Bypassing SCP Enforcement with Long-Lived API Keys

Sonrai Security researcher discovered that AWS "bedrock-mantle" IAM permissions could bypass SCP enforcement when using long-lived Service Specific Credential API keys. IAM policy denials worked correctly, but SCP denials were bypassed. AWS patched this between Jan–Feb 2026; no customer action required.

https://sonraisecurity.com/blog/cracks-in-the-bedrock

#aws