c1.1 Scope model access with least-privilege IAM

Why least privilege matters for model access

Amazon Bedrock exposes powerful foundation models behind a small set of IAM actions. If an application role is granted bedrock: on Resource: , a single leaked credential can invoke any model in the account, reconfigure guardrails, or start costly customization jobs. Scoping access to the exact actions and model ARNs a workload needs turns a broad compromise into a contained one.

Separate invoking a model from administering it

Treat these as two different jobs with two different roles:

• Invoke — the runtime application only needs bedrock:InvokeModel (and bedrock:InvokeModelWithResponseStream for streaming) on the specific model ARNs it is approved to call.
• Administer — creating or updating guardrails, custom models, and model access belongs to a platform/operator role that the runtime application never assumes.

Keeping these apart means a compromised application identity can call its approved models but cannot change how the models are governed.

Scope to explicit model ARNs

Foundation models are addressable by ARN in the form arn:aws:bedrock:<region>::foundation-model/<model-id>. List the exact model ARNs in the policy Resource block instead of *, so the role cannot reach models it was never approved for. The example below grants invoke-only access to two specific models and nothing else:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeApprovedModelsOnly",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-5-sonnet-20240620-v1:0",
        "arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2:0"
      ]
    }
  ]
}

Bind invocation to the approved network path

Layer condition keys onto the invoke policy so the credential is only usable from where the workload actually runs — for example, require calls to arrive through your Bedrock VPC endpoint with aws:SourceVpce. This means an exfiltrated credential is useless from the public internet:

{
  "Effect": "Allow",
  "Action": "bedrock:InvokeModel",
  "Resource": "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-5-sonnet-20240620-v1:0",
  "Condition": {
    "StringEquals": { "aws:SourceVpce": "vpce-0abc123456789def0" }
  }
}

Prefer temporary credentials

Have the application assume a role (task role, instance profile, or cross-account role) rather than embedding long-lived access keys. Temporary credentials rotate automatically and are far easier to revoke if a workload is compromised.

Naming note: replace the example model IDs and VPC endpoint ID with the values for your region and account. Model IDs differ by Region and change as new model versions are released.