AWS bedrock documentation change
Summary
Restructured documentation to add detailed instructions for programmatic model access management via SDK/CLI. Added new sections covering API operations for listing agreements, submitting Anthropic use cases, creating/deleting agreements, and checking model availability. Updated AWS GovCloud access requirements to clarify dual-account management.
Security assessment
The changes document security controls for managing model access through IAM policies and programmatic methods. Specifically, they detail how to: 1) Restrict model access using deny policies, 2) Implement least-privilege access through SDK operations, and 3) Enforce access reviews via availability checks. However, there's no evidence of a specific vulnerability being patched.
Diff
diff --git a/bedrock/latest/userguide/model-access.md b/bedrock/latest/userguide/model-access.md index dd20c2929..0684b1aff 100644 --- a//bedrock/latest/userguide/model-access.md +++ b//bedrock/latest/userguide/model-access.md @@ -5 +5 @@ -Grant permissions to request access to foundation models with a product IDAccess models in AWS GovCloud +Grant permissions to request access to foundation models with a product IDManage model access using SDK and CLIAccess Amazon Bedrock foundation models in AWS GovCloud (US) @@ -11 +11 @@ Access to all Amazon Bedrock foundation models is enabled by default with the co -Access to all Amazon Bedrock foundation models is enabled by default with the correct AWS Marketplace permissions in all commercial AWS regions. For access to models in non-commercial regions, see Access Amazon Bedrock foundation models in AWS GovCloud (US). +Access to all Amazon Bedrock foundation models is enabled by default with the correct AWS Marketplace permissions in all commercial AWS regions. For programtic access to third-party models, see Manage model access using SDK and CLI. @@ -15 +15 @@ Access to all Amazon Bedrock foundation models is enabled by default with the co -Anthropic requires first-time customers to submit use case details before invoking a model once per account or once at the organization's management account. You can submit use case details by selecting an Anthropic model from the model catalog in the Amazon Bedrock console or calling the `PutUseCaseForModelAccess` API command. Access to the model is granted immediately after use case details are successfully submitted. The form submission at the root account will be inherited by other accounts in the same AWS Organizations. +Anthropic requires first-time customers to submit use case details before invoking a model once per account or once at the organization's management account. You can submit use case details by selecting an Anthropic model from the model catalog in the Amazon Bedrock console or calling the `PutUseCaseForModelAccess` API command. Access to the model is granted immediately after use case details are successfully submitted. The form submission at the root account will be inherited by other accounts in the same AWS Organization. @@ -37,0 +38,2 @@ Organizations that need to review and agree to EULA before allowing model usage + * Manage model access using SDK and CLI + @@ -176 +178 @@ JSON -## Access Amazon Bedrock foundation models in AWS GovCloud (US) +## Manage model access using SDK and CLI @@ -178 +180 @@ JSON -Before you can use a foundation model in Amazon Bedrock, you must request access to it. If you no longer need access to a model, you can remove access from it. +Model access can be managed using SDK in addition to invoking the model. Below steps can be used to create/delete model access as well as check if access already exists or not. Note this is applicable only for third-party models. @@ -180 +182 @@ Before you can use a foundation model in Amazon Bedrock, you must request access -###### Note +Follow these steps to manage model access programmatically: @@ -182 +184 @@ Before you can use a foundation model in Amazon Bedrock, you must request access -Models from the following providers aren't sold through AWS Marketplace and don't have product keys, so you can't scope the `aws-marketplace` actions to them: + * Prerequisites @@ -184 +186 @@ Models from the following providers aren't sold through AWS Marketplace and don' - * Amazon + * Step 1: List foundation model agreement offers @@ -186 +188 @@ Models from the following providers aren't sold through AWS Marketplace and don' - * DeepSeek + * Step 2: [Required one-time for Anthropic models only] Put use case for first-time user @@ -188 +190 @@ Models from the following providers aren't sold through AWS Marketplace and don' - * Mistral AI + * Step 3: Create foundation model agreement @@ -190 +192 @@ Models from the following providers aren't sold through AWS Marketplace and don' - * Meta + * Step 4: Get foundation model availability @@ -192 +194 @@ Models from the following providers aren't sold through AWS Marketplace and don' - * Qwen + * [Optional] Step 5: Delete foundation model agreement @@ -194 +195,0 @@ Models from the following providers aren't sold through AWS Marketplace and don' - * OpenAI @@ -197,0 +199 @@ Models from the following providers aren't sold through AWS Marketplace and don' +### Prerequisites @@ -199 +201 @@ Models from the following providers aren't sold through AWS Marketplace and don' -You can, however, prevent the usage of these models by denying Amazon Bedrock actions and specifying these model IDs in the `Resource` field. For an example, see Prevent an identity from using a model after access has already been granted. + * Attach the [AmazonBedrockFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonBedrockFullAccess.html) policy to the IAM user/role used for the SDK/CLI. @@ -201 +203 @@ You can, however, prevent the usage of these models by denying Amazon Bedrock ac -Once access is provided to a model, it is available for all users in the AWS account. + * Bedrock SDK Setup: [Set up the AWS SDK for Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/sdk-general-information-section.html) @@ -203 +205 @@ Once access is provided to a model, it is available for all users in the AWS acc -###### To add or remove access to foundation models +Note: Below instructions use python3 for the examples @@ -205 +207 @@ Once access is provided to a model, it is available for all users in the AWS acc - 1. Make sure you have permissions to request access, or modify access, to Amazon Bedrock foundation models. + * Note the modelId of the model for which the access needs to be managed. @@ -207 +208,0 @@ Once access is provided to a model, it is available for all users in the AWS acc - 2. Sign into the Amazon Bedrock console at [https://console.aws.amazon.com/bedrock/](https://console.aws.amazon.com/bedrock/). @@ -209 +209,0 @@ Once access is provided to a model, it is available for all users in the AWS acc - 3. In the left navigation pane, under **Bedrock configurations** , choose **Model access**. @@ -211 +210,0 @@ Once access is provided to a model, it is available for all users in the AWS acc - 4. On the **Model access** page, choose **Modify model access**. @@ -213 +212 @@ Once access is provided to a model, it is available for all users in the AWS acc - 5. Select the models that you want the account to have access to and unselect the models that you don't want the account to have access to. You have the following options: +### Step 1: List foundation model agreement offers @@ -215 +214 @@ Once access is provided to a model, it is available for all users in the AWS acc -Be sure to review the **End User License Agreement (EULA)** for terms and conditions of using a model before requesting access to it. +Use this API to get the agreement offers for a particular model. This will provide the offerToken used to create model access in next steps. @@ -217 +216 @@ Be sure to review the **End User License Agreement (EULA)** for terms and condit - * Select the check box next to an individual model to check or uncheck it. +Documentation @@ -219 +218 @@ Be sure to review the **End User License Agreement (EULA)** for terms and condit - * Select the top check box to check or uncheck all models. + * API: [ListFoundationModelAgreementOffers](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_ListFoundationModelAgreementOffers.html) @@ -221 +220 @@ Be sure to review the **End User License Agreement (EULA)** for terms and condit - * Select how the models are grouped and then check or uncheck all the models in a group by selecting the check box next to the group. For example, you can choose to **Group by provider** and then select the check box next to **Cohere** to check or uncheck all Cohere models. + * CLI Documentation: [list-foundation-model-agreement-offers](https://docs.aws.amazon.com/cli/latest/reference/bedrock/list-foundation-model-agreement-offers.html) @@ -223 +221,0 @@ Be sure to review the **End User License Agreement (EULA)** for terms and condit - 6. Choose **Next**. @@ -225 +222,0 @@ Be sure to review the **End User License Agreement (EULA)** for terms and condit - 7. If you add access to Anthropic models, you must describe your use case details. Choose **Submit use case details** , fill out the form, and then select **Submit form**. Notification of access is granted or denied based on your answers when completing the form for the provider. @@ -227 +223,0 @@ Be sure to review the **End User License Agreement (EULA)** for terms and condit - 8. Review the access changes you're making, and then read the **Terms**. @@ -229 +225 @@ Be sure to review the **End User License Agreement (EULA)** for terms and condit -###### Note +AWS CLI @@ -231 +226,0 @@ Be sure to review the **End User License Agreement (EULA)** for terms and condit -Your use of Amazon Bedrock foundation models is subject to the [seller's pricing terms](https://aws.amazon.com/bedrock/pricing/), EULA, and the [AWS service terms](https://aws.amazon.com/service-terms). @@ -233 +227,0 @@ Your use of Amazon Bedrock foundation models is subject to the [seller's pricing - 9. If you agree with the terms, choose **Submit**. The changes can take several minutes to be reflected in the console. @@ -235 +229 @@ Your use of Amazon Bedrock foundation models is subject to the [seller's pricing -###### Note + aws bedrock list-foundation-model-agreement-offers --model-id <ModelId> @@ -237 +231 @@ Your use of Amazon Bedrock foundation models is subject to the [seller's pricing -If you revoke access to a model, it can still be accessed through the API for some time after you complete this action while the changes propagate. To immediately remove access in the meantime, add an [IAM policy to a role to deny access to the model](./security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-deny-inference). +Python @@ -239 +232,0 @@ If you revoke access to a model, it can still be accessed through the API for so - 10. If your request is successful, the **Access status** changes to **Access granted** or **Available to request**. @@ -241,0 +235,114 @@ If you revoke access to a model, it can still be accessed through the API for so + # Placeholder for modelId + model_id = "<enter model id here>" + # Placeholder for offerId + offer_id = "<enter offer id here>" + try: + # offerType= "ALL" means both public and private offers, if offerType isn't defined, the default would be "PUBLIC" + model_agreement_offers_response = bedrock_client.list_foundation_model_agreement_offers(modelId=model_id,offerType="ALL") + print(model_agreement_offers_response) + except ClientError as e: + print(f"Failed to list foundation model offers for modelId: {model_id} due to the following error: {e}") + +### Step 2: [Required one-time for Anthropic models only] Put use case for first-time user + +Used to put the first-time user use-case form required only for Anthropic models. This is a pre-requisite for gaining access to Anthropic models in the account. This API is only required one time per account or per AWS organization across all commercial regions, with the exception of opt-in regions where this form needs to be filled again. + +Documentation + + * API: [PutUseCaseForModelAccess](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_PutUseCaseForModelAccess.html) + + * CLI Documentation: [put-use-case-for-model-access](https://docs.aws.amazon.com/cli/latest/reference/bedrock/put-use-case-for-model-access.html) + + + + +AWS CLI + + + + aws bedrock put-use-case-for-model-access \ + --form-data <Base64EncodedFormData> + +Python + + + + # Placeholder for form data, replace the names + COMPANY_NAME = "<enter company name here>" + COMPANY_WEBSITE = "<enter company website here>" + INTENDED_USERS = "1" #for external users + INDUSTRY_OPTION = "<enter industry option here>" + OTHER_INDUSTRY_OPTION = "<enter other industry option here>" + USE_CASES = "<enter use cases here>" + form_data = { + "companyName": COMPANY_NAME, + "companyWebsite": COMPANY_WEBSITE, + "intendedUsers": INTENDED_USERS, + "industryOption": INDUSTRY_OPTION, + "otherIndustryOption": OTHER_INDUSTRY_OPTION, + "useCases": USE_CASES + } + form_data_json = json.dumps(form_data) + model_access_response = bedrock_client.put_use_case_for_model_access(formData=form_data_json) + +For CLI, the form data is base64 encoded json of the form below. + + + { + "companyName": COMPANY_NAME, + "companyWebsite": COMPANY_WEBSITE, + "intendedUsers": INTENDED_USERS, + "industryOption": INDUSTRY_OPTION, + "otherIndustryOption": OTHER_INDUSTRY_OPTION, + "useCases": USE_CASES + } + + * COMPANY_NAME: String with maximum length of 128 + + * COMPANY_WEBSITE: String with a maximum length of 128 + + * INTENDED USERS: Either 0, 1 or 2. 0: Internal, 1: External, 2: Internal_and_External + + * INDUSTRY_OPTION: String with maximum length of 128 + + * OTHER_INDUSTRY_OPTION: String with maximum length of 128 + + * USE_CASES: String with maximum length of 8192 + + + + +### Step 3: Create foundation model agreement + +Used to create agreement (access) for the foundation model. Use the offer token and modelId from above. + +Documentation + + * API: [CreateFoundationModelAgreement](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_CreateFoundationModelAgreement.html) + + * CLI Documentation: [create-foundation-model-agreement](https://docs.aws.amazon.com/cli/latest/reference/bedrock/create-foundation-model-agreement.html) + + + + +AWS CLI + + + + aws bedrock create-foundation-model-agreement \