AWS elasticbeanstalk documentation change
Summary
Clarified that AWS Marketplace permissions for AI analysis are only required in commercial regions, not GovCloud regions where NVIDIA Nemotron is used.
Security assessment
Permission adjustments are region-specific operational updates. No security vulnerabilities are mentioned or fixed, and no new security capabilities are added. Changes maintain existing security posture by refining permission requirements.
Diff
diff --git a/elasticbeanstalk/latest/dg/iam-instanceprofile.md b/elasticbeanstalk/latest/dg/iam-instanceprofile.md index 65dbff7da..205d83817 100644 --- a//elasticbeanstalk/latest/dg/iam-instanceprofile.md +++ b//elasticbeanstalk/latest/dg/iam-instanceprofile.md @@ -67 +67 @@ To customize permissions, you can add policies to the role attached to the defau -To use the [AI-powered environment analysis](./health-ai-analysis.html) feature, add the `bedrock:InvokeModel`, `bedrock:ListFoundationModels`, `elasticbeanstalk:DescribeEvents`, and `elasticbeanstalk:DescribeEnvironmentHealth` permissions to your instance profile. These permissions allow Elastic Beanstalk to use Amazon Bedrock and access environment data for analyzing logs, events, and instance health. If this is the first time an Anthropic Claude model is being used in your AWS account, also add the `aws-marketplace:Subscribe`, `aws-marketplace:Unsubscribe`, and `aws-marketplace:ViewSubscriptions` permissions. These AWS Marketplace permissions enable the automatic model subscription that Amazon Bedrock requires for first-time access to third-party models. +To use the [AI-powered environment analysis](./health-ai-analysis.html) feature, add the `bedrock:InvokeModel`, `bedrock:ListFoundationModels`, `elasticbeanstalk:DescribeEvents`, and `elasticbeanstalk:DescribeEnvironmentHealth` permissions to your instance profile. These permissions allow Elastic Beanstalk to use Amazon Bedrock and access environment data for analyzing logs, events, and instance health. In commercial regions, if this is the first time an Anthropic Claude model is being used in your AWS account, also add the `aws-marketplace:Subscribe`, `aws-marketplace:Unsubscribe`, and `aws-marketplace:ViewSubscriptions` permissions. These AWS Marketplace permissions enable the automatic model subscription that Amazon Bedrock requires for first-time access to third-party models. In GovCloud regions, AI analysis uses the NVIDIA Nemotron model and does not require AWS Marketplace permissions.