Introduction Following the release of Amazon Bedrock Powered by AWS Mantle, I discovered a mechanism to bypass Service Control Policy (SCP) statements limiting the use of bedrock-mantle IAM permissions. By leveraging long-lived API keys backed by Service Specific Credentials, I was able to successfully leverage bedrock-mantle:CreateInference despite an SCP statement denying that action. SCPs are…
First seen on securityboulevard.com
Jump to article: securityboulevard.com/2026/02/cracks-in-the-bedrock-bypassing-scp-enforcement-with-long-lived-api-keys/
