AWS bedrock medium security documentation change
Summary
Added a warning about IAM policy conditions causing AccessDeniedException for batch inference with foundation models, noting these resources are owned by Amazon Bedrock service.
Security assessment
This change directly addresses a security/access control misconfiguration that causes requests to fail. The warning explicitly states that organization-based IAM conditions (like aws:ResourceOrgID) on foundation model resources will result in AccessDeniedException, providing concrete guidance to prevent access issues. This is security documentation about proper IAM policy configuration.
Diff
diff --git a/bedrock/latest/userguide/batch-inference-permissions.md b/bedrock/latest/userguide/batch-inference-permissions.md index da228ec89..7453cb3e1 100644 --- a//bedrock/latest/userguide/batch-inference-permissions.md +++ b//bedrock/latest/userguide/batch-inference-permissions.md @@ -12,0 +13,4 @@ To carry out batch inference, you must set up permissions for the following IAM +###### Warning + +Foundation model resources used in batch inference are owned by the Amazon Bedrock service, not by your AWS account. If your IAM policies include organization-based conditions on resources (such as `aws:ResourceOrgID`), batch inference requests to foundation models will fail with `AccessDeniedException`. Remove organization resource conditions from policies that apply to Amazon Bedrock foundation model resources. +