AWS bedrock high security documentation change

Service: bedrock · 2026-07-01 · Security-related high

File: bedrock/latest/userguide/api-keys-revoke.md

Summary

Clarified that both bedrock:CallWithBearerToken and bedrock-mantle:CallWithBearerToken must be denied to fully revoke API key access

Security assessment

Fixes critical documentation gap that could lead to incomplete revocation of API keys, explicitly warning that Mantle endpoint access would remain if only one action is denied.

Diff

diff --git a/bedrock/latest/userguide/api-keys-revoke.md b/bedrock/latest/userguide/api-keys-revoke.md
index c028a004f..c7abd3a7d 100644
--- a//bedrock/latest/userguide/api-keys-revoke.md
+++ b//bedrock/latest/userguide/api-keys-revoke.md
@@ -203 +203,14 @@ This section provides some IAM policies that you can use to restrict access to a
-The action that allows an identity to make calls with an Amazon Bedrock API key is `bedrock:CallWithBearerToken`. To prevent an identity from making calls with the Amazon Bedrock API key, you can attach an IAM policy on an identity depending the type of key:
+To fully prevent an identity from making calls with an Amazon Bedrock API key, you must deny both of the following actions:
+
+  * `bedrock:CallWithBearerToken` – Controls API key usage through the Amazon Bedrock endpoint.
+
+  * `bedrock-mantle:CallWithBearerToken` – Controls API key usage through the Amazon Bedrock Mantle endpoint.
+
+
+
+
+###### Important
+
+Denying only `bedrock:CallWithBearerToken` does **not** prevent API key usage through the Mantle endpoint. You must also deny `bedrock-mantle:CallWithBearerToken` to completely block API key usage.
+
+To prevent an identity from making calls with an API key, attach an IAM policy on the identity depending on the type of key:
@@ -225 +238,4 @@ JSON
-        "Action": "bedrock:CallWithBearerToken",
+        "Action": [
+          "bedrock:CallWithBearerToken",
+          "bedrock-mantle:CallWithBearerToken"
+        ],