huntrule

AWS Bedrock Guardrail Deletion via CloudTrail DeleteGuardrail API Call

Alerts on CloudTrail DeleteGuardrail events indicating an AWS Bedrock guardrail was removed.

FreeUnreviewedSigmamediumv1
title: AWS Bedrock Guardrail Deletion via CloudTrail DeleteGuardrail API Call
id: 5bcde200-5145-4008-9c58-e3a489daf4c6
status: experimental
description: This rule flags Amazon Bedrock guardrail deletions by matching CloudTrail events where the API action is DeleteGuardrail for bedrock.amazonaws.com. Deleting a guardrail can remove model safety and governance controls, potentially enabling unsafe or unauthorized responses. The detection relies on CloudTrail telemetry capturing the eventName and eventSource for the deletion request.
references:
  - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_bedrock_guardrail_deleted.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-07-10
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: DeleteGuardrail
    eventSource: bedrock.amazonaws.com
  condition: selection
falsepositives:
  - Legitimate guardrail deletion by authorized identities.
level: medium
license: DRL-1.1
related:
  - id: 59b70e4d-dd17-44a9-b740-acf07ae3eb6a
    type: derived

What it detects

This rule flags Amazon Bedrock guardrail deletions by matching CloudTrail events where the API action is DeleteGuardrail for bedrock.amazonaws.com. Deleting a guardrail can remove model safety and governance controls, potentially enabling unsafe or unauthorized responses. The detection relies on CloudTrail telemetry capturing the eventName and eventSource for the deletion request.

Known false positives

  • Legitimate guardrail deletion by authorized identities.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.