AWS intrusion: exposed credentials lead from S3 to Bedrock
In an article published on February 4, 2026, Sysdig describes an AWS intrusion that began with credentials exposed in S3, moved through Lambda, and reached Bedrock access. The article highlights an Elastic rule for detecting external layers added to Lambda functions.
Source: Sysdig detalha invasão na AWS de credenciais expostas no S3 ao Bedrock (sysdig.com). Text prepared with AI from this source.
What happened and what to do
In an article dated February 4, 2026, Sysdig describes an AWS intrusion that began with credentials exposed in S3. The activity moved through Lambda and escalated to access to Bedrock. The article also points to an Elastic rule that detects external layers being added to Lambda functions.
A company can respond by reviewing credential exposure, monitoring changes to Lambda functions, and alerting on the addition of external layers. An incident-response workflow can correlate these signals, preserve evidence, and guide investigations into possible privilege escalation in the cloud.
How the consultancy can help
Wendelmaques can diagnose credential exposure and cloud monitoring controls, define an implementation scope, and deliver event collection, alerts, and response procedures, as well as support ongoing operations.
Next step
Send a short description of your environment and needs to receive a scoped proposal.
Let's assess your project
I reply with scope and a proposal.