Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access

What it is

Datadog Security Labs documents how stolen AWS keys are tested for Amazon Bedrock access. The post covers the KMON_NOC harvesting platform (active since 31 August 2026, probing over 80 Datadog Cloud SIEM customers) and two unrelated Python checkers found on VirusTotal. Credentials that can invoke models are worth more because LLM access can be resold. The post cites Unit 42 research on "token-jacking" proxy services that sell stolen model capacity below retail price.

How it works

The checker Datadog walks through (SHA-256 923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608) runs these steps per credential, across multiple regions:

1. sts:GetCallerIdentity to get the account ID, ARN and user ID.
2. bedrock:ListFoundationModels to confirm the endpoint is reachable and to learn model IDs and providers.
3. ListInferenceProfiles, when invocation testing is on.
4. Bedrock runtime Converse with the prompt "ping" and maxTokens of 4, which keeps cost near zero. Any successful response counts as usable access. If a model rejects the request, it retries once with no inferenceConfig.
5. Optionally billing:GetCredits (the -credit option, a 364-day lookback). It reads remaining balance, expiry and whether the credits cover Bedrock, which gives the account a financial value. The second script (c9335bb8a21bd2c568d03b040fb86a0e72145691e54a33495ee0cfaac55835dc) lacks this step.

The script defaults to cheap models (haiku, nova-lite, titan-text-lite), and --models overrides this. Its --anthropic mode targets Claude models. If AWS returns the "use case details" error, it stops trying Claude models in that region, because the error blocks every Claude model on the account. Successful credentials are stored in plaintext.

KMON_NOC's frontend validates keys with SigV4-signed GetCallerIdentity (through a proxy), then runs a separate Bedrock check. It counts a keysWithBedrock statistic. It also extracts AWS_BEARER_TOKEN_BEDROCK (regex: 40 or more characters of A-Za-z0-9/+=) and offers reveal and copy controls.

What to do

• Investigate unexpected Bedrock activity, especially from a new source or an identity with no AI usage history.
• Watch both Converse and InvokeModel. Earlier harvesting platforms called InvokeModel repeatedly against different Anthropic models.
• Look for ListFoundationModels calls across several regions, particularly failed ones with no later ListInferenceProfiles or Converse. This was the most common pattern across 12 organizations in the last 30 days.
• Look for Converse calls returning AccessDenied on Anthropic models. One case targeted anthropic.claude-opus-5, anthropic.claude-fable-5 and anthropic.claude-fable-5-1.
• Treat AWS_BEARER_TOKEN_BEDROCK values as credentials to rotate if exposed.
• Datadog lists IOC IPs seen since 31 August 2026 (residential proxies, VPNs, hosting). It advises using them only alongside the AWS activity above, because they are low confidence alone.

Caveats

• Datadog could not see KMON_NOC's validation logic or its AWS activity. The platform's behavior is inferred from frontend code only.
• Datadog cannot link the VirusTotal scripts to the telemetry from the 12 organizations. It describes a recurring pattern, not attribution.
• The fetched text shows no list of Cloud SIEM rules or the IP list, so those are not reproduced here.