Amazon Bedrock AI governance security checks
AI assistants, agents and model access inside the tenant — what they can read, who can publish them, and how autonomously they act.
On Amazon Bedrock, Black Cat runs 5 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Amazon Bedrock connector needs.
Checks (5)
severity: high Bedrock Action Group Code Interpreter fix difficulty: medium #
Review if code interpreter capability is necessary
- Assess the agent's use case and whether code execution is required
- If not needed, disable or remove the code interpreter action group
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-28.4
severity: critical Bedrock Action Group Computer Use / Bash fix difficulty: medium #
Remove or restrict computer use and bash execution capabilities
- Open AWS Bedrock Console > Agents
- Remove the Computer or Bash action group
- If required, implement strict guardrails
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-28.4
severity: low Bedrock Agent Custom Orchestration fix difficulty: hard #
Review custom orchestration logic for security implications
- Review the Lambda function implementing the custom orchestration
- Verify input validation and output sanitization
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-28.4
severity: medium Bedrock Agent Supervisor Mode fix difficulty: medium #
Review the supervisor's sub-agent delegation and scope
- Open AWS Bedrock Console > Agents
- Review which sub-agents the supervisor can invoke
- Ensure sub-agents follow least-privilege
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-28.4
severity: high Bedrock Agent High Risk Unblocked fix difficulty: easy #
Block or restrict high-risk agents with scores above 70
- Navigate to AI Agent Governance in SSPM
- Review the agent risk factors
- Block the agent until risks are mitigated
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-28.4