AWS bedrock documentation change
Summary
Removed 'Allow access to third-party model subscriptions' section including example IAM policy
Security assessment
Removal of policy examples for third-party model subscriptions reduces documentation clarity but does not directly address a security vulnerability. No evidence of a security fix in the change.
Diff
diff --git a/bedrock/latest/userguide/security_iam_id-based-policy-examples.md b/bedrock/latest/userguide/security_iam_id-based-policy-examples.md index 4dd832901..09543b9ba 100644 --- a//bedrock/latest/userguide/security_iam_id-based-policy-examples.md +++ b//bedrock/latest/userguide/security_iam_id-based-policy-examples.md @@ -5 +5 @@ -Policy best practicesUse the consoleAllow users to view their own permissionsAllow access to third-party model subscriptionsDeny access for inference of foundation modelsAllow users to invoke a provisioned model +Policy best practicesUse the consoleAllow users to view their own permissionsDeny access for inference of foundation modelsAllow users to invoke a provisioned model @@ -23,2 +22,0 @@ For details about actions and resource types defined by Amazon Bedrock, includin - * Allow access to third-party model subscriptions - @@ -99,83 +96,0 @@ This example shows how you might create a policy that allows IAM users to view t -## Allow access to third-party model subscriptions - -To access the Amazon Bedrock models for the first time, you use the Amazon Bedrock console to subscribe to third-party models. Your IAM user or role requires permission to access the subscription API operations. - -For the `aws-marketplace:Subscribe` action only, you can use the `aws-marketplace:ProductId` [condition key](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplace.html#awsmarketplace-policy-keys) to restrict subscription to specific models. To see a list of product IDs and which foundation models they correspond to, see the table in [Grant IAM permissions to request access to Amazon Bedrock foundation models](./model-access-permissions.html). - -###### Note - -Models from the following providers don't have product keys, so you can't remove request access from them: - - * Amazon - - * DeepSeek - - * Mistral AI - - * Meta - - - - -You can prevent users from making inference calls to these models by using an IAM policy and specifying the model ID. For more information, see Deny access for inference of foundation models. - -The following example shows an identity-based policy to allow a role to subscribe to the Amazon Bedrock foundation models listed in the `Condition` field and to unsubscribe to and view subscriptions to foundation models: - -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "aws-marketplace:Subscribe" - ], - "Resource": "*", - "Condition": { - "Null": { - "aws-marketplace:ProductId": "false" - }, - "ForAllValues:StringEquals": { - "aws-marketplace:ProductId": [ - "1d288c71-65f9-489a-a3e2-9c7f4f6e6a85", - "cc0bdd50-279a-40d8-829c-4009b77a1fcc", - "c468b48a-84df-43a4-8c46-8870630108a7", - "99d90be8-b43e-49b7-91e4-752f3866c8c7", - "b0eb9475-3a2c-43d1-94d3-56756fd43737", - "d0123e8d-50d6-4dba-8a26-3fed4899f388", - "a61c46fe-1747-41aa-9af0-2e0ae8a9ce05", - "216b69fd-07d5-4c7b-866b-936456d68311", - "b7568428-a1ab-46d8-bab3-37def50f6f6a", - "38e55671-c3fe-4a44-9783-3584906e7cad", - "prod-ariujvyzvd2qy", - "prod-2c2yc2s3guhqy", - "prod-6dw3qvchef7zy", - "prod-ozonys2hmmpeu", - "prod-fm3feywmwerog", - "prod-tukx4z3hrewle", - "prod-nb4wqmplze2pm", - "prod-m5ilt4siql27k", - "prod-cx7ovbu5wex7g" - - ] - } - } - }, - { - "Effect": "Allow", - "Action": [ - "aws-marketplace:Unsubscribe", - "aws-marketplace:ViewSubscriptions" - ], - "Resource": "*" - } - ] - } - -