Wilma - AWS Bedrock Security Checker

What It Does

#

Security auditing tool for AWS Bedrock that combines traditional cloud security checks with GenAI-specific detection. Covers prompt injection, PII exposure, model poisoning, cost anomalies, and guardrail validation across Knowledge Bases, Agents, and Guardrails.

ethanolivertroy/wilma

Wilma - AWS Bedrock Security Configuration Checker

Python

0

0

Install

#

pip install wilma-sec

Or with uv:

uv pip install wilma-sec

Then just run wilma.

Check Categories

#

Wilma runs checks across two categories:

Traditional Security - IAM permission auditing, encryption validation, VPC endpoint checks, CloudTrail logging, resource tagging compliance.

GenAI-Specific Security - Prompt injection pattern detection, PII scanning in model configs, model access pattern analysis, cost anomaly detection, guardrail strength validation.

Knowledge Bases (RAG) - 12 Checks

#

S3 bucket public access, encryption, versioning. Vector store encryption and access control for OpenSearch, Aurora, and RDS. PII pattern detection, prompt injection patterns, IAM role audits, CloudWatch logging, and more.

Agents - 10 Checks

#

Action confirmation requirements (OWASP LLM08), guardrail configuration strength, service role least privilege, Lambda function security, cross-account KB access, memory encryption with KMS, and prompt injection pattern scanning.

Guardrails - 11 Checks

#

Content filter strength validation (LOW-strength filters miss 70% of attacks), automated reasoning for hallucination prevention, PROMPT_ATTACK filter enforcement, PII redaction filters, topic and word filtering, version management, and contextual grounding thresholds.

Risk Scoring

#

Simple 1-10 scale with clear remediation commands:

Each finding includes the exact AWS CLI command to fix it.

Modes

#

• Standard (default) - Clear findings with both simple explanations and technical details
• Learning (wilma --learn) - Educational content explaining each security concept
• JSON (wilma --output json) - Machine-readable output for CI/CD pipelines

# Default check
wilma

# Learning mode
wilma --learn

# JSON for CI/CD
wilma --output json

# Specific region
wilma --region us-west-2

# Specific AWS profile
wilma --profile production

Threat Coverage

#

Based on OWASP Top 10 for LLMs and MITRE ATLAS:

CI/CD Integration

#

Drop it into a GitHub Actions workflow to fail builds on critical findings:

- name: Run Bedrock Security Audit
  run: |
    pip install wilma-sec
    wilma --output json > security-report.json
    if [ $? -eq 2 ]; then
      echo "Critical security issues detected!"
      exit 1
    fi

Disclaimer

#

Not affiliated with AWS. Use responsibly with appropriate IAM permissions.