AWS Bedrock Guardrail Deleted

Title: AWS Bedrock Guardrail Deleted
Status: experimental
Description:Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow unsafe or unauthorized model responses.
References:
  -https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Date: 2026-07-10
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection:
    eventName: 'DeleteGuardrail'
    eventSource: 'bedrock.amazonaws.com'
  condition:selection
Falsepositives:
  -Legitimate guardrail deletion by authorized identities.
Level: medium