bedrock:InvokeModelWithResponseStream

Read

bedrock:InvokeModelWithResponseStream is a Read access-level action in the bedrock service. Grants permission to invoke the specified Bedrock model to run inference using the input provided in the request body with streaming response

Resource types

ARNs that bedrock:InvokeModelWithResponseStream can be scoped to in an IAM policy.

arn:${Partition}:bedrock:${Region}:${Account}:application-inference-profile/${ResourceId}

application-inference-profile

arn:${Partition}:bedrock:${Region}:${Account}:marketplace/model-endpoint/all-access

bedrock-marketplace-model-endpoint

arn:${Partition}:bedrock:${Region}:${Account}:custom-model-deployment/${ResourceId}

custom-model-deployment

arn:${Partition}:bedrock:${Region}:${Account}:default-prompt-router/${ResourceId}

default-prompt-router

arn:${Partition}:bedrock:${Region}::foundation-model/${ResourceId}

foundation-model

arn:${Partition}:bedrock:${Region}:${Account}:imported-model/${ResourceId}

imported-model

arn:${Partition}:bedrock:${Region}:${Account}:inference-profile/${ResourceId}

inference-profile

arn:${Partition}:bedrock:${Region}:${Account}:prompt-router/${ResourceId}

prompt-router

arn:${Partition}:bedrock:${Region}:${Account}:provisioned-model/${ResourceId}

provisioned-model

arn:${Partition}:bedrock::${Account}:system-tool/${ResourceId}

system-tool

Condition keys

Keys you can use in the Condition block of a policy that grants bedrock:InvokeModelWithResponseStream.

aws:ResourceTag/${TagKey} String

Filters access by having actions based on the tag value associated with the resource

Example IAM policy

A minimal policy that allows bedrock:InvokeModelWithResponseStream. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowBedrockInvokeModelWithResponseStream",
      "Effect": "Allow",
      "Action": "bedrock:InvokeModelWithResponseStream",
      "Resource": "*"
    }
  ]
}

Related actions in bedrock

bedrock:AgenticRetrieveStream Read bedrock:AllowVendedLogDeliveryForResource Permissions management bedrock:ApplyGuardrail Read bedrock:AssociateAgentCollaborator Write bedrock:AssociateAgentKnowledgeBase Write bedrock:AssociateThirdPartyKnowledgeBase Write bedrock:BatchDeleteAdvancedPromptOptimizationJob Write bedrock:BatchDeleteEvaluationJob Write bedrock:CallWithBearerToken Read bedrock:CancelAutomatedReasoningPolicyBuildWorkflow Write bedrock:CopyBlueprintStage Write bedrock:CountTokens Read

View all bedrock actions →