A new type of long-lived key on AWS: Bedrock API keys

This report examines AWS Bedrock API keys (long-term service-specific credentials and client-generated short-term bearer tokens), documents that long-term keys have been found leaked in public GitHub repositories, explains how the keys are formatted and detected (secret scanning and CloudTrail events), and recommends mitigations including preventing IAM Users, denying the bedrock:CallWithBearerToken privilege, and relying on existing authentication flows.