Bedrock makes shipping an AI agent straightforward. Guardrails, IAM integration, CloudTrail invocation logging, knowledge bases, action groups. The building blocks are there, the docs are solid, and a working agent can be in production in a weekend.

The security primitives around those building blocks are still catching up. This session covers six attack paths against a Bedrock agent, tested against a reference implementation built to model the kind of production deployment a compliance-constrained SaaS would ship. Prompt injection through document ingestion pipelines. Tool invocation abuse via action groups. Secrets leaking from agent context into CloudWatch and X-Ray.

Credential escalation through execution role misconfiguration. Memory poisoning via OpenSearch-backed knowledge bases. And the one most teams miss, inference-time exfiltration of sensitive prompt context into the model provider's own observability.

For each I show the chain, the CloudWatch or CloudTrail signal that reveals it, and the AWS-native control that stops it where one exists. Some attacks have clean controls. Some do not yet, and I am honest about which is which. I cover what to build at the IAM, VPC, and KMS layers to close the gaps that Bedrock Guardrails alone do not cover, and how to keep agentic workloads inside the same ISO 27001 and SOC 2 evidence envelope as the rest of an AWS estate.

This is a practitioner talk drawn from hands-on work with agentic systems in regulated environments, presented on a sanitised reference architecture.

Attendees leave with a Bedrock threat model, a CloudWatch and CloudTrail detection ruleset, an honest view of what Guardrails covers, and a concrete list of controls to layer on top.