AWS Bedrock Guardrail Updated

Title: AWS Bedrock Guardrail Updated
Status: experimental
Description:Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses.
References:
  -https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Date: 2026-07-10
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection:
    eventName: 'UpdateGuardrail'
    eventSource: 'bedrock.amazonaws.com'
  condition:selection
Falsepositives:
  -Legitimate guardrail updates by authorized identities.
Level: medium