AWS bedrock high security documentation change

Service: bedrock · 2026-07-01 · Security-related high

File: bedrock/latest/userguide/api-keys-permissions.md

Summary

Added requirement to deny both bedrock:CallWithBearerToken and bedrock-mantle:CallWithBearerToken actions to fully restrict API key access

Security assessment

Addresses security gap where previous documentation only covered one endpoint, potentially leaving Mantle endpoint accessible. Adds explicit warnings and updated policies to prevent unauthorized access through both endpoints.

Diff

diff --git a/bedrock/latest/userguide/api-keys-permissions.md b/bedrock/latest/userguide/api-keys-permissions.md
index 4e2d51b05..a36b5aaa4 100644
--- a//bedrock/latest/userguide/api-keys-permissions.md
+++ b//bedrock/latest/userguide/api-keys-permissions.md
@@ -28 +28 @@ You can use the following condition keys to impose conditions on the permission
-The [bedrock:CallWithBearerToken](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrock.html#amazonbedrock-actions-as-permissions) action controls the use of a short-term or long-term Amazon Bedrock API key.
+Amazon Bedrock API keys can be used with [two endpoints](https://docs.aws.amazon.com/bedrock/latest/userguide/endpoints.html), each controlled by a separate IAM action. To fully prevent all API key-based access, you must deny both actions.
@@ -30 +30,8 @@ The [bedrock:CallWithBearerToken](https://docs.aws.amazon.com/service-authorizat
-You can use the `bedrock:bearerTokenType` condition key with [string condition operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String) to specify the type of bearer token for which to apply the permission for `bedrock:CallWithBearerToken`. You can specify one of the following values:
+  * `bedrock:CallWithBearerToken` – Controls the use of an API key through the Amazon Bedrock endpoint.
+
+  * `bedrock-mantle:CallWithBearerToken` – Controls the use of an API key through the Amazon Bedrock Mantle endpoint.
+
+
+
+
+Each action has a corresponding `bearerTokenType` condition key that you can use with [string condition operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String) to specify the type of bearer token for which to apply the permission. Use `bedrock:bearerTokenType` with `bedrock:CallWithBearerToken` and `bedrock-mantle:bearerTokenType` with `bedrock-mantle:CallWithBearerToken`. You can specify one of the following values:
@@ -44 +51 @@ Prevent generation of keys | Attach a policy that denies the `iam:CreateServiceS
-Prevent usage of a key | Attach a policy that denies the `bedrock:CallWithBearerToken` action to the IAM user associated with the key. | Attach a policy that denies the `bedrock:CallWithBearerToken` action to IAM identities that you don't want to be able to use the key.  
+Prevent usage of a key | Attach a policy that denies both `bedrock:CallWithBearerToken` and `bedrock-mantle:CallWithBearerToken` to the IAM user associated with the key. | Attach a policy that denies both `bedrock:CallWithBearerToken` and `bedrock-mantle:CallWithBearerToken` to IAM identities that you don't want to be able to use the key.  
@@ -90 +97,2 @@ JSON
-            "bedrock:CallWithBearerToken"
+            "bedrock:CallWithBearerToken",
+            "bedrock-mantle:CallWithBearerToken"
@@ -112,0 +121,34 @@ To prevent an IAM identity from using short-term Amazon Bedrock API keys, attach
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Deny",
+                "Action": "bedrock:CallWithBearerToken",
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "bedrock:bearerTokenType": "SHORT_TERM"
+                    }
+                }
+            },
+            {
+                "Effect": "Deny",
+                "Action": "bedrock-mantle:CallWithBearerToken",
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "bedrock-mantle:bearerTokenType": "SHORT_TERM"
+                    }
+                }
+            }
+        ]
+    }
+    
+
@@ -135,0 +178,10 @@ JSON
+            },
+            {
+                "Effect": "Deny",
+                "Action": "bedrock-mantle:CallWithBearerToken",
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "bedrock-mantle:bearerTokenType": "LONG_TERM"
+                    }
+                }
@@ -164,0 +217,10 @@ JSON
+            {
+                "Effect": "Deny",
+                "Action": "bedrock-mantle:CallWithBearerToken",
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "bedrock-mantle:bearerTokenType": "SHORT_TERM"
+                    }
+                }
+            },
@@ -167 +229,4 @@ JSON
-                "Action": "bedrock:CallWithBearerToken",
+                "Action": [
+                    "bedrock:CallWithBearerToken",
+                    "bedrock-mantle:CallWithBearerToken"
+                ],
@@ -197,0 +263,10 @@ JSON
+            {
+                "Effect": "Deny",
+                "Action": "bedrock-mantle:CallWithBearerToken",
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "bedrock-mantle:bearerTokenType": "LONG_TERM"
+                    }
+                }
+            },
@@ -200 +275,4 @@ JSON
-                "Action": "bedrock:CallWithBearerToken",
+                "Action": [
+                    "bedrock:CallWithBearerToken",
+                    "bedrock-mantle:CallWithBearerToken"
+                ],