AWS bedrock high security documentation change
Summary
Added 'Understanding automatic model access' section with IAM prerequisites, payment requirements, and FTU details; updated policy references; changed section titles to 'Model lifecycle' and 'Subscribe from Marketplace'
Security assessment
The new section explicitly documents security prerequisites: IAM permissions for Marketplace subscriptions and payment validation. This adds critical security documentation about access control mechanisms and compliance requirements.
Diff
diff --git a/bedrock/latest/userguide/model-access.md b/bedrock/latest/userguide/model-access.md index 0684b1aff..de9169b00 100644 --- a//bedrock/latest/userguide/model-access.md +++ b//bedrock/latest/userguide/model-access.md @@ -12,0 +13,15 @@ Access to all Amazon Bedrock foundation models is enabled by default with the co +###### Understanding automatic model access + +When you invoke a third-party model for the first time in your account, Amazon Bedrock automatically initiates the subscription process in the background. During this setup period (up to 15 minutes), your API calls may succeed temporarily while the subscription is being finalized. If any prerequisites are missing, initial API calls may succeed temporarily but will fail with a 403 error after the setup period if the subscription cannot be completed. To avoid interruptions, verify all prerequisites before invoking models in production. + +**Prerequisites for successful model access:** + + 1. **AWS Marketplace permissions** : Your IAM role must have `aws-marketplace:Subscribe`, `aws-marketplace:Unsubscribe`, and `aws-marketplace:ViewSubscriptions` permissions. See Grant IAM permissions to request access to Amazon Bedrock foundation models with a product ID for details. + + 2. **Anthropic models** : For Anthropic models, you must complete the First Time Use (FTU) form before invoking the model. + + 3. **Valid payment method** : Your AWS account must have a valid payment method configured for AWS Marketplace purchases. + + + + @@ -41,0 +57,2 @@ Organizations that need to review and agree to EULA before allowing model usage + * [Manage model subscriptions with License Manager](./managed-entitlements.html) + @@ -73 +90 @@ If an identity has already subscribed to a model in one AWS Region, the model be -For information on creating the policy, see [I already have an AWS account](./getting-started.html#getting-started-bedrock-role). +For information on creating the policy, see [Quickstart](./getting-started.html). @@ -484 +501 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Control permissions for generating and using API keys +Model lifecycle @@ -486 +503 @@ Control permissions for generating and using API keys -Use product ID condition keys to control access +Subscribe from Marketplace