huntrule

AWS Bedrock Guardrail Updated (UpdateGuardrail API via CloudTrail)

Alerts on CloudTrail-reported Amazon Bedrock guardrail updates, which may signal attempts to weaken safety controls.

FreeUnreviewedSigmamediumv1
title: AWS Bedrock Guardrail Updated (UpdateGuardrail API via CloudTrail)
id: 0e648035-0ef6-4d02-8b82-470f58681428
status: experimental
description: This rule flags CloudTrail events where Amazon Bedrock guardrails are updated using the UpdateGuardrail API. Changes to guardrails can indicate an effort to weaken safety or access controls, potentially enabling disallowed or unsafe model outputs. The detection relies on CloudTrail telemetry capturing eventName and eventSource for Bedrock guardrail update activity. It also accounts for false positives from legitimate updates performed by authorized identities.
references:
  - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_bedrock_guardrail_updated.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-07-10
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: UpdateGuardrail
    eventSource: bedrock.amazonaws.com
  condition: selection
falsepositives:
  - Legitimate guardrail updates by authorized identities.
level: medium
license: DRL-1.1
related:
  - id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f
    type: derived

What it detects

This rule flags CloudTrail events where Amazon Bedrock guardrails are updated using the UpdateGuardrail API. Changes to guardrails can indicate an effort to weaken safety or access controls, potentially enabling disallowed or unsafe model outputs. The detection relies on CloudTrail telemetry capturing eventName and eventSource for Bedrock guardrail update activity. It also accounts for false positives from legitimate updates performed by authorized identities.

Known false positives

  • Legitimate guardrail updates by authorized identities.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.