bedrock:InvokeModelWithResponseStream

Read

bedrock:InvokeModelWithResponseStream is a Read access-level action in the bedrock service. Grants permission to invoke the specified Bedrock model to run inference using the input provided in the request body with streaming response

Resource types

ARNs that bedrock:InvokeModelWithResponseStream can be scoped to in an IAM policy.

arn:${Partition}:bedrock:${Region}:${Account}:application-inference-profile/${ResourceId} required
application-inference-profile
arn:${Partition}:bedrock:${Region}:${Account}:marketplace/model-endpoint/all-access required
bedrock-marketplace-model-endpoint
arn:${Partition}:bedrock:${Region}:${Account}:custom-model-deployment/${ResourceId} required
custom-model-deployment
arn:${Partition}:bedrock:${Region}:${Account}:default-prompt-router/${ResourceId} required
default-prompt-router
arn:${Partition}:bedrock:${Region}::foundation-model/${ResourceId} required
foundation-model
arn:${Partition}:bedrock:${Region}:${Account}:imported-model/${ResourceId} required
imported-model
arn:${Partition}:bedrock:${Region}:${Account}:inference-profile/${ResourceId} required
inference-profile
arn:${Partition}:bedrock:${Region}:${Account}:prompt-router/${ResourceId} required
prompt-router
arn:${Partition}:bedrock:${Region}:${Account}:provisioned-model/${ResourceId} required
provisioned-model
arn:${Partition}:bedrock::${Account}:system-tool/${ResourceId} required
system-tool

Condition keys

Keys you can use in the Condition block of a policy that grants bedrock:InvokeModelWithResponseStream.

bedrock:GuardrailIdentifier ARN

Filters access by the GuardrailIdentifier containing the GuardrailArn or the GuardrailArn:NumericVersion

bedrock:InferenceProfileArn ARN

Filters access by the specified inference profile

bedrock:PromptRouterArn ARN

Filters access by the specified prompt router

bedrock:ServiceTier String

Filters access by the specified ServiceTier

aws:ResourceTag/${TagKey} String

Filters access by having actions based on the tag value associated with the resource

Example IAM policy

A minimal policy that allows bedrock:InvokeModelWithResponseStream. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowBedrockInvokeModelWithResponseStream",
      "Effect": "Allow",
      "Action": "bedrock:InvokeModelWithResponseStream",
      "Resource": "*"
    }
  ]
}

Related actions in bedrock

bedrock:AgenticRetrieveStream Read bedrock:AllowVendedLogDeliveryForResource Permissions management bedrock:ApplyGuardrail Read bedrock:AssociateAgentCollaborator Write bedrock:AssociateAgentKnowledgeBase Write bedrock:AssociateThirdPartyKnowledgeBase Write bedrock:BatchDeleteAdvancedPromptOptimizationJob Write bedrock:BatchDeleteEvaluationJob Write bedrock:CallWithBearerToken Read bedrock:CancelAutomatedReasoningPolicyBuildWorkflow Write bedrock:CancelInvoke Write bedrock:CheckIngestedDocumentAcl Read

View all bedrock actions →