Merge PR #6123 from @marcopedrinazzi - Add 2 new AWS Bedrock Guardrail rules for Update or Deletion

new: AWS Bedrock Guardrail Deleted
new: AWS Bedrock Guardrail Updated

Author: marcopedrinazzi

rules/cloud/aws/cloudtrail/aws_cloudtrail_bedrock_guardrail_deleted.yml

@@ -0,0 +1,24 @@
+title: AWS Bedrock Guardrail Deleted
+id: 59b70e4d-dd17-44a9-b740-acf07ae3eb6a
+status: experimental
+description: |
+    Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
+    model safety controls and allow unsafe or unauthorized model responses.
+references:
+    - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html
+author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
+date: 2026-07-10
+tags:
+    - attack.defense-impairment
+    - attack.t1685
+logsource:
+    product: aws
+    service: cloudtrail
+detection:
+    selection:
+        eventName: 'DeleteGuardrail'
+        eventSource: 'bedrock.amazonaws.com'
+    condition: selection
+falsepositives:
+    - Legitimate guardrail deletion by authorized identities.
+level: medium

rules/cloud/aws/cloudtrail/aws_cloudtrail_bedrock_guardrail_updated.yml

@@ -0,0 +1,24 @@
+title: AWS Bedrock Guardrail Updated
+id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f
+status: experimental
+description: |
+    Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
+    model safety controls and allow unsafe or unauthorized model responses.
+references:
+    - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html
+author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
+date: 2026-07-10
+tags:
+    - attack.defense-impairment
+    - attack.t1685
+logsource:
+    product: aws
+    service: cloudtrail
+detection:
+    selection:
+        eventName: 'UpdateGuardrail'
+        eventSource: 'bedrock.amazonaws.com'
+    condition: selection
+falsepositives:
+    - Legitimate guardrail updates by authorized identities.
+level: medium