AWS bedrock documentation change
Summary
Clarified error handling and subscription process for third-party model access, specifying AccessDeniedException behavior and timing considerations.
Security assessment
The changes provide more detailed information on error responses and subscription timing, enhancing documentation clarity. While it relates to access control errors, there's no evidence of addressing a specific security vulnerability. The update improves understanding of prerequisites but does not indicate new security features or resolve a security issue.
Diff
diff --git a/bedrock/latest/userguide/model-access.md b/bedrock/latest/userguide/model-access.md index 1dee51806..e1181a102 100644 --- a//bedrock/latest/userguide/model-access.md +++ b//bedrock/latest/userguide/model-access.md @@ -15 +15 @@ Access to all Amazon Bedrock foundation models is enabled by default with the co -When you invoke a third-party model for the first time in your account, Amazon Bedrock automatically initiates the subscription process in the background. During this setup period (up to 15 minutes), your API calls may succeed temporarily while the subscription is being finalized. If any prerequisites are missing, initial API calls may succeed temporarily but will fail with a 403 error after the setup period if the subscription cannot be completed. To avoid interruptions, verify all prerequisites before invoking models in production. +When you invoke a third-party model for the first time in your account, Amazon Bedrock automatically initiates the subscription process in the background. During this setup period (up to 15 minutes), your API calls may succeed temporarily while the subscription is being finalized. If any prerequisites are missing, the subscription attempt fails and subsequent API calls will return `AccessDeniedException`. After granting the necessary permissions, it may take up to 2 minutes for the subscription to complete. During this time, API calls may continue to return `AccessDeniedException`. Once the subscription is complete, all subsequent invocations will succeed. To avoid this entirely, verify all prerequisites before invoking models in production.