BEYOND VALID CREDENTIALS: HOW EXPOSED AWS KEYS ARE TESTED FOR BEDROCK ACCESS

Summary from the TLDR InfoSec newsletter

When attackers obtain AWS credentials, they frequently test them for access to other services of interest like SES, SNS, and Bedrock. Datadog examined three credential harvesting platforms and found that they utilize the ListFoundationModels, InvokeModel, and Converse API to determine access. It also found a script that checked for promotional credits available in the account.