Detects the creation of AWS Bedrock AgentCore resources (Code Interpreter, AgentRuntime, Browser, or Harness) with an IAM execution role attached. If an attacker with iam:PassRole creates an AgentCore resource and attaches a privileged role, subsequent invocations inside that resource execute as the attached role, enabling privilege escalation to roles trusted by bedrock-agentcore.amazonaws.com. The rule flags management-plane events (CreateCodeInterpreter, CreateAgentRuntime, CreateBrowser, CreateHarness) that succeed and include an executionRoleArn or roleArn in aws.cloudtrail.request_parameters. It excludes certain automated invocations (e.g., invoked_by bedrock-agentcore.amazonaws.com or cloudformation.amazonaws.com) to reduce false positives. Note that post-creation activity (Start*/Invoke* data-plane events) is not captured by default CloudTrail management events; data-plane logging must be enabled to see those actions. False positives may include legitimate provisioning by CI/CD or platform engineers; investigate caller identity and the attached role’s permissions. Recommended responses include suspending the caller’s iam:PassRole, deleting the AgentCore resource, rotating the execution role’s credentials if exploitation is suspected, and enabling bedrock-agentcore data-plane logging to detect subsequent sessions. The rule maps to MITRE ATT&CK techniques such as Privilege Escalation (T1078/T1078.004) and Account Manipulation (T1098).