feat(aws): add checks for Bedrock logging configuration and CloudTrail LLM Jacking detection

[sergargar]

Context

This pull request introduces two new security checks aimed at enhancing AWS Bedrock and CloudTrail monitoring to detect and prevent LLMJacking attacks.

These attacks involve the exploitation of stolen credentials to hijack cloud-hosted large language models (LLMs), such as those provided by AWS Bedrock, leading to unauthorized access, excessive financial costs, and potential data exfiltration.

The two proposed checks bedrock_model_invocation_logging_enabled and cloudtrail_threat_detection_llm_jacking are designed to ensure proper logging configurations are in place and monitor for suspicious activities related to potential LLMJacking threats.

Description

1. bedrock_model_invocation_logging_enabled:

This check ensures that AWS Bedrock model invocation logging is properly enabled across all active regions. Logging model usage is essential for visibility into AI operations, capturing inputs and outputs, and detecting unauthorized access or misuse of resources. It ensures that logs are being routed to CloudWatch or S3 for detailed monitoring and analysis.

2. cloudtrail_threat_detection_llm_jacking:

This check monitors CloudTrail logs for suspicious API calls related to AWS Bedrock, such as InvokeModel, PutUseCaseForModelAccess, and GetFoundationModelAvailability. These API calls can be used by attackers in LLMJacking attempts to hijack AI model resources. This check helps detect unauthorized access attempts, abnormal usage patterns, and possible resource hijacking incidents.

Together, these checks provide a comprehensive approach to securing AI model operations in AWS, ensuring proper logging and detecting threats in real-time.

Checklist

• Are there new checks included in this PR? Yes / No
  • If so, do we need to update permissions for the provider? Please review this carefully.
• Review if the code is being covered by tests.
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[github-actions]

You can check the documentation for this PR here -> Prowler Documentation

[github-actions]

You can check the documentation for this PR here -> Prowler Documentation

[github-actions]

You can check the documentation for this PR here -> Prowler Documentation

[codecov]

Codecov Report

Attention: Patch coverage is 95.78947% with 4 lines in your changes missing coverage. Please review.

Project coverage is 89.38%. Comparing base (4181ca5) to head (b79f056).
Report is 13 commits behind head on master.

Files with missing lines	Patch %	Lines
.../providers/aws/services/bedrock/bedrock_service.py	90.90%	2 Missing ⚠️
...jacking/cloudtrail_threat_detection_llm_jacking.py	95.74%	2 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5314   +/-   ##
=======================================
  Coverage   89.38%   89.38%           
=======================================
  Files        1018     1022    +4     
  Lines       31278    31373   +95     
=======================================
+ Hits        27959    28044   +85     
- Misses       3319     3329   +10     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

You can check the documentation for this PR here -> Prowler Documentation

[puchy22]

LGTM! 👍