Long-lived Bedrock API key in use

Severity: High
Service: Bedrock
Check ID: BEDROCK_API_KEY_LONG_LIVED

What this check finds

An IAM service-specific credential scoped to bedrock.amazonaws.com is active. These "Bedrock API keys" are static, long-term secrets that can invoke models directly — AWS only issues them as long-term credentials, so there is no short-lived variant to fall back on. A leaked key grants model access until someone notices and revokes it, with no session expiry to limit the damage, and the resulting invocations are attributed to the owning IAM user rather than to whoever actually used the key.

Passing looks like: No long-lived Bedrock API keys.

How to fix it

Prefer IAM roles with temporary credentials (STS) over API keys for Bedrock access. If a key is genuinely required, set a short expiry and rotate it: aws iam update-service-specific-credential --user-name USER --service-specific-credential-id ID --status Inactive, then delete it with delete-service-specific-credential.

AWS console

IAM → Users → select user → Security credentials → Bedrock API keys.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Long-lived Bedrock API key in use
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	AC-2 Account Management IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.16 Identity management A.5.17 Authentication information A.5.18 Access rights A.6.5 Responsibilities after termination or change of employment

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Bedrock checks

All Bedrock checks