Grant IAM permissions to request access to Amazon Bedrock foundation models

Before you can request access, or modify access, to Amazon Bedrock foundation models, you need to attach an identity-based IAM policy with the following AWS Marketplace actions to the IAM role that allows access to Amazon Bedrock:

For information creating the policy, see I already have an AWS account.

For the aws-marketplace:Subscribe action only, you can use the aws-marketplace:ProductId condition key to restrict subscription to specific models.

The following table lists product IDs for Amazon Bedrock foundation models:

The following is the format of the IAM policy you can attach to a role to control model access permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow|Deny",
            "Action": [
                "aws-marketplace:Subscribe"
            ],
            "Resource": "*",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws-marketplace:ProductId": [
                        model-product-id-1,
                        model-product-id-2,
                        ...
                    ]
                }
            }
        },
        {
            "Effect": "Allow|Deny",
            "Action": [
                "aws-marketplace:Unsubscribe"
                "aws-marketplace:ViewSubscriptions"
            ],
            "Resource": "*"
        }
    ]
}

To see an example policy, refer to Allow access to third-party model subscriptions.