AWS bedrock high security documentation change

Service: bedrock · 2026-02-25 · Security-related high

File: bedrock/latest/userguide/model-access.md

Summary

Added critical note about blocking model access via bedrock:InvokeModel deny policies

Security assessment

Explicitly documents a security control gap (aws-marketplace:Subscribe deny being insufficient) and provides remediation (deny bedrock:InvokeModel). This addresses potential unauthorized access by clarifying required IAM/SCP configurations.

Diff

diff --git a/bedrock/latest/userguide/model-access.md b/bedrock/latest/userguide/model-access.md
index de9169b00..1dee51806 100644
--- a//bedrock/latest/userguide/model-access.md
+++ b//bedrock/latest/userguide/model-access.md
@@ -159,0 +160,6 @@ JSON
+###### Note
+
+Denying `aws-marketplace:Subscribe` alone will **not** block the first model invocation, because Amazon Bedrock **auto-initiates** the subscription in the background.
+
+To **block model access from the start** , apply **Deny policies on`bedrock:InvokeModel`** at the **Organization (SCP) or Account (IAM) level**.
+