bedrock:InvokeModel is a Read access-level action in the bedrock service. Grants permission to invoke the specified Bedrock model to run inference using the input provided in the request body
ARNs that bedrock:InvokeModel can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants bedrock:InvokeModel.
Filters access by creating requests based on the allowed set of values for each of the mandatory tags
Filters access by creating requests based on the presence of mandatory tags in the request
Filters access by the GuardrailIdentifier containing the GuardrailArn or the GuardrailArn:NumericVersion
Filters access by the specified inference profile
Filters access by the model that a stateful invocation runs, on the authorization whose resource is the project
Filters access by the project that a stateful invocation belongs to, on authorizations whose resource is the inference target it runs
Filters access by the specified prompt router
Filters access by the specified ServiceTier
Filters access by having actions based on the tag value associated with the resource
A minimal policy that allows bedrock:InvokeModel. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowBedrockInvokeModel",
"Effect": "Allow",
"Action": "bedrock:InvokeModel",
"Resource": "*"
}
]
}