🎯 New Report #3702072: bedrock-mantle.api.aws accepts Bedrock API keys outside the IAM Deny, CloudTrail signal, and invocation logging AWS publishes for Bedrock keys
🔺Severity: Medium
👽 Reporter: mistercloudsec
⭐️ Reputation: 142
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-04-28
⏰ Disclosed: 2026-07-14 18:52:27
📝 Summary: A second Bedrock API key-accepting service plane called "bedrock-mantle" was discovered. This plane was not described in AWS's customer-facing Bedrock documentation. As a result, the AWS-published security controls to detect and prevent Bedrock API key abuse failed to apply to the bedrock-mantle plane. Specifically, the IAM deny policy, CloudTrail detection signal, and model invocation logging configuration were all found to be ineffective against the bedrock-mantle plane.
📂 Report JSON File: 3702072
@hackeronereports