BEDROCK'N'ROLL: ANNOYING TRUST RELATIONSHIPS IN BEDROCK SERVICE ROLES

Summary from the TLDR InfoSec newsletter

Amazon Bedrock provides a wizard for creating execution roles using the Agent Builder UI. The trust policy on the created role allows any agent in the account to assume the role by default via a wildcard aws:SourceArn condition. Users should ensure that this condition is scoped to their specific agent.