AWS bedrock documentation change

Service: bedrock · 2025-10-16 · Documentation medium

File: bedrock/latest/userguide/model-access-product-ids.md

Summary

Added new models to exclusion list, included IAM policy template, and updated documentation links

Security assessment

Added Qwen and OpenAI to the list of models requiring explicit access control, included a detailed IAM policy template for managing model subscriptions, and updated references. These changes improve security documentation by clarifying access control requirements but do not address a specific disclosed vulnerability.

Diff

diff --git a/bedrock/latest/userguide/model-access-product-ids.md b/bedrock/latest/userguide/model-access-product-ids.md
index 27bf842f8..d8310a4a4 100644
--- a//bedrock/latest/userguide/model-access-product-ids.md
+++ b//bedrock/latest/userguide/model-access-product-ids.md
@@ -7 +7 @@
-The `aws-marketplace:ProductId` condition key can be used to control the ability to subscribe to Amazon Bedrock serverless models that have a product ID in AWS Marketplace. To learn how to use the product ID condition key, see the examples in [Grant IAM permissions to request access to Amazon Bedrock foundation models with a product ID](./model-access-permissions.html).
+The `aws-marketplace:ProductId` condition key can be used to control the ability to subscribe to Amazon Bedrock serverless models that have a product ID in AWS Marketplace. To learn how to use the product ID condition key, see the examples in [Grant IAM permissions to request access to Amazon Bedrock foundation models with a product ID](./model-access.html#model-access-permissions).
@@ -20,0 +21 @@ Models from the following providers aren't sold through AWS Marketplace and don'
+  * Qwen
@@ -21,0 +23 @@ Models from the following providers aren't sold through AWS Marketplace and don'
+  * OpenAI
@@ -24 +26,3 @@ Models from the following providers aren't sold through AWS Marketplace and don'
-You can, however, prevent the usage of these models by denying Amazon Bedrock actions and specifying these model IDs in the `Resource` field. For an example, see [Prevent an identity from using a model after access has already been granted](./model-access-permissions.html#model-access-prevent-usage).
+
+
+You can, however, prevent the usage of these models by denying Amazon Bedrock actions and specifying these model IDs in the `Resource` field. For an example, see [Prevent an identity from using a model after access has already been granted](./model-access.html#model-access-prevent-usage).
@@ -41,0 +46 @@ Anthropic Claude Sonnet 4.5 | prod-mxcfnwvpd6kb4
+Anthropic Claude Haiku 4.5 | prod-xdkflymybwmvi  
@@ -54,0 +60 @@ Cohere Rerank 3.5 | prod-2o5bej62oxkbi
+Cohere Embed v4 | prod-ft3cj5gst3spo  
@@ -58,0 +65,49 @@ Stability 3.5 Large 1.0 | prodview-ajc3gw4mjy7my
+TwelveLabs Marengo Embed 2.7 | prod-o6xchhpirymvs  
+TwelveLabs Pegasus 1.2 | prod-635pcy5x5pc2a  
+Writer Palmyra X4 | prod-azehe4da4pzsy  
+Writer Palmyra X5 | prod-23enyy63orhuk  
+  
+You can use the following template to attach an IAM policy that controls model access permissions to a role:
+    
+    
+    {
+        "Version": "2012-10-17"		 	 	 
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "aws-marketplace:Subscribe"
+                ],
+                "Resource": "*",
+                "Condition": {
+                       "Null": {
+                          "aws-marketplace:ProductId": "false"
+                    },
+                    "ForAllValues:StringEquals": {
+                        "aws-marketplace:ProductId": [
+                            "model-product-id-1",
+                            "model-product-id-2",
+                            ...
+                        ]
+                    }
+                }
+            },
+            {
+                "Effect": "Deny",
+                "Action": [
+                    "aws-marketplace:Unsubscribe",
+                    "aws-marketplace:ViewSubscriptions"
+                ],
+                "Resource": "*",
+                "Condition": {
+                    "ForAnyValue:StringNotEquals": {
+                        "aws-marketplace:ProductId": [
+                          ...
+                        ]
+                    }
+                }      
+            }
+        ]
+    }
+
+For more examples of how to manage model access with IAM policies, see [Identity-based policy examples for Amazon Bedrock](./security_iam_id-based-policy-examples.html).
@@ -66 +121 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-Grant permissions to request access to foundation models with a product ID
+Access foundation models
@@ -68 +123 @@ Grant permissions to request access to foundation models with a product ID
-Add or remove access to foundation models
+Foundation model information