feat(bedrock): add bedrock_agent_role_least_privilege check

[ARYAN03B]

Context

Implements the new check requested in #11011 — flags AWS Bedrock Agent execution roles that violate least-privilege principles.

The 4th criterion from the issue (VPC condition keys when applicable) is intentionally deferred to a follow-up PR per discussion in the issue thread, so smaller/focused review.

Refs #11011

Description

Adds bedrock_agent_role_least_privilege for the AWS provider. A Bedrock Agent's execution role FAILs the check when any of these are true:

• An AWS-managed *FullAccess policy is attached.
• An inline statement allows broad actions (e.g. s3:*, iam:*, *) on Resource: "*".
• No permissions boundary is configured on the role.

Risk model: a permissive agent role turns successful prompt injection into AWS privilege escalation — the LLM can be coerced into calling any API the role allows. Least privilege + a permissions boundary bounds the blast radius even when guardrails fail.

Service-layer changes (touching shared files):

• iam_service.Role gains a permissions_boundary: Optional[dict] field, populated from the existing list_roles response. Real AWS returns this field on ListRoles, so no extra API call is added in production.
• BedrockAgent service captures each agent's agentResourceRoleArn via a new per-agent GetAgent call (the ListAgents summary doesn't include it).

Check logic:

• Cross-service: imports both bedrock_agent_client and iam_client (same pattern as bedrock_full_access_policy_attached).
• Conservative BROAD_ACTION_PATTERNS heuristic — only flags actions like s3:* / iam:* / * on Resource:*, not narrow actions like s3:GetObject. Happy to widen or narrow based on review.
• Collects all violations per role and reports them in a single FAIL message.

No new dependencies.

Steps to review

1. iam_service.py diff — 2-line addition (new field on Role, populate from list_roles response). Confirms no behaviour change for existing IAM checks.
2. bedrock_service.py diff — new _get_agent method (modelled on _get_prompt) + role_arn field on Agent.
3. New check bedrock_agent_role_least_privilege.py — main logic + BROAD_ACTION_PATTERNS heuristic.
4. bedrock_agent_role_least_privilege.metadata.json — title, severity (high), risk, remediation.
5. Run the new tests:

   pytest tests/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/ -v
   

   6 cases: no agents, compliant role, *FullAccess attached, Resource:* broad action, no permissions boundary, unresolvable role.
6. Regression sanity — locally passing:

   pytest tests/providers/aws/services/iam/ tests/providers/aws/services/bedrock/ -q
   

   (703 tests, all green.)
7. Check is CLI-discoverable:

   prowler aws --list-checks | grep bedrock_agent_role_least_privilege
   

A note on the test mocks: moto's bedrock-agent support is incomplete (GetAgent doesn't echo back agentResourceRoleArn), and moto's ListRoles strips PermissionsBoundary even when set (real AWS returns it). The test file uses the same mock_make_api_call pattern already used by bedrock_agent_guardrail_enabled_test.py to work around these gaps without changing production code.

Checklist

Community Checklist

• This feature/issue is listed in here or roadmap.prowler.com
• Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

• Review if the code is being covered by tests.
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.
• Review if is needed to change the Readme.md
• Ensure new entries are added to CHANGELOG.md, if applicable.

SDK/CLI

• Are there new checks included in this PR? Yes — bedrock_agent_role_least_privilege.
  • Permissions update: No — covered by existing bedrock:Get* wildcard in permissions/prowler-additions-policy.json (the bedrock-agent service uses the bedrock: IAM action prefix). IAM read perms are inherited from the AWS-managed SecurityAudit policy.

UI

N/A — SDK-only change.

API

N/A — SDK-only change.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[github-actions]

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.