Topic starter
11/11/2026 6:00 pm
TL;DR: Quarantine still stops bedrock:InvokeModel while leaving Bedrock Mantle inference open through bedrock-mantle:CreateInference, according to Plerion research. CloudTrail coverage and deny-list maintenance become the real control boundary for AI model access.
Editorial analysis by NHI Mgmt Group, based on content published by Plerion: “No quarantine for Bedrock Mantle”.
Key questions
Q: Why do quarantine policies miss some cloud AI services?
A: Quarantine policies miss some cloud AI services because access is often mediated by short-lived tokens, service accounts, or API calls that bypass browser-style controls.
Q: How does least privilege apply to model invocation APIs?
A: Least privilege means each caller gets only the minimum permissions needed to invoke specific model operations, such as inference, fine-tuning, or embedding requests.
Q: What signs suggest cloud AI inference has been abused after key exposure?
A: Look for unexpected model-request spend, requests from unfamiliar identities or regions, and inference activity that appears after a key has been quarantined or rotated.
Practitioner guidance
- Validate every AI inference endpoint against current deny policies Inventory all model invocation surfaces, then test whether quarantine policies block each action and service prefix before relying on provider-managed containment.
- Turn on data-event logging for AI inference Enable CloudTrail data events for AWS::BedrockMantle::Project and equivalent resource types so successful requests, failed probes, and spend anomalies are visible.
- Revoke and replace any leaked cloud keys immediately Assume the quarantined credential remains a usable path until you rotate the access key, verify all downstream sessions are dead, and confirm no alternate inference surface is still open.
Bottom line: Cloud AI platforms can expose more than one inference surface, and a quarantine policy that covers only the older path leaves an abuse route open.
Glossary terms: LLMjacking, Service Prefix, Access Key Quarantine, Cloud Credential Compromise
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Cloud quarantine only works when the service map is complete: a deny policy that names one inference API but not the newer one creates a false sense of containment. The control is doing exactly what it was written to do, which is why the failure is governance, not execution. Practitioners should treat new AI endpoints as new authorization domains until proven otherwise.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the best way to monitor cloud AI access paths?
A: The best way to monitor cloud AI access paths is to log every control-plane and data-plane request, then correlate identities, tokens, and source locations. Focus on data events, API calls, service account use, permission changes, and unusual model invocations. That gives a traceable path from the human or workload identity to the AI service it reached.
👉 Read our full editorial: AWS quarantine misses Bedrock Mantle inference on a new prefix