Model access - Amazon Bedrock
Add model accessRemove model accessControl model access permissions

Model access

Access to Amazon Bedrock foundation models isn't granted by default. In order to gain access to a foundation model, an IAM user with sufficient permissions needs to request access to it through the console. Once access is provided to a model, it is available for all users in the account.

To manage model access, select Model access at the bottom of the left navigation pane in the Amazon Bedrock management console. The model access page lets you view a list of available models, the output modality of the model, whether you have been granted access to it, and the End User License Agreement (EULA). You should review the EULA for terms and conditions of using a model before requesting access to it. For information about model pricing, refer to Amazon Bedrock Pricing.

Note

You can manage model access only through the console.

Request model access

Add model access

Before you can use a foundation model in Amazon Bedrock, you must request access to it.

To request access to a model

  1. On the Model access page, select Enable all models or Enable specific models.

  2. Select model group by provider, group by access or group by modality from the drop down menu. Alternatively, you can select the check boxes next to the models you want to add access to. To request access to all models belonging to a provider, select the check box next to the provider.

    Note

    You can't remove access from Titan models after requesting it.

    For Anthropic models, select Submit use case details, fill out the form, then select Submit form. Notification of access is granted or denied based on your answers when completing the form for the provider.

  3. Select Save changes to request access. The changes may take several minutes to take place.

    Note

    Your use of Amazon Bedrock foundation models is subject to the seller's pricing terms, EULA, and the AWS service terms.

  4. If your request is successful, the Access status changes to Access granted.

If you don't have permissions to request access to a model, an error banner appears. Contact your account administrator to ask them to request access to the model for you or to provide you permissions to request access to the model.

Remove model access

If you no longer need to use a foundation model, you can remove access to it.

Note

You can't remove access from Amazon Titan models, Mistral AI models, or from the Meta Llama 3 Instruct model.

  1. On the Model access page, select Manage model access.

  2. Select the check boxes next to the models for which you want to remove access. To remove access for all models belonging to a provider, select the check box next to the provider.

  3. Select Save changes.

  4. You will be prompted to confirm you want to remove access to models. If you consent to the terms and select Remove access,

    Note

    The model may still be accessed through the API for some time after you complete this action while the changes propagate. To immediately remove access in the meantime, add an IAM policy to a role to deny access to the model.

Control model access permissions

To control a role's permissions to request access to Amazon Bedrock models, attach an IAM policy to the role using any of the following AWS Marketplace actions.

  • aws-marketplace:Subscribe

  • aws-marketplace:Unsubscribe

  • aws-marketplace:ViewSubscriptions

For the aws-marketplace:Subscribe action only, you can use the aws-marketplace:ProductId condition key to limit subscription to specific models. The following table lists product IDs for Amazon Bedrock foundation models.

Model Product ID
AI21 Labs Jurassic-2 Mid 1d288c71-65f9-489a-a3e2-9c7f4f6e6a85
AI21 Labs Jurassic-2 Ultra cc0bdd50-279a-40d8-829c-4009b77a1fcc
AI21 Jamba-Instruct prod-dr2vpvd4k73aq
Anthropic Claude c468b48a-84df-43a4-8c46-8870630108a7
Anthropic Claude Instant b0eb9475-3a2c-43d1-94d3-56756fd43737
Anthropic Claude 3 Sonnet prod-6dw3qvchef7zy
Anthropic Claude 3.5 Sonnet prod-m5ilt4siql27k
Anthropic Claude 3 Haiku prod-ozonys2hmmpeu
Anthropic Claude 3 Opus prod-fm3feywmwerog
Cohere Command a61c46fe-1747-41aa-9af0-2e0ae8a9ce05
Cohere Command Light 216b69fd-07d5-4c7b-866b-936456d68311
Cohere Command R prod-tukx4z3hrewle
Cohere Command R+ prod-nb4wqmplze2pm
Cohere Embed (English) b7568428-a1ab-46d8-bab3-37def50f6f6a
Cohere Embed (Multilingual) 38e55671-c3fe-4a44-9783-3584906e7cad
Meta Llama 2 13B prod-ariujvyzvd2qy
Meta Llama 2 70B prod-2c2yc2s3guhqy
Stable Diffusion XL 0.8 d0123e8d-50d6-4dba-8a26-3fed4899f388
Stable Diffusion XL 1.0 prod-2lvuzn4iy6n6o

The following is the format of the IAM policy you can attach to a role to control model access permissions. You can see an example at Allow access to third-party model subscriptions.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow|Deny",
            "Action": [
                "aws-marketplace:Subscribe"
            ],
            "Resource": "*",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws-marketplace:ProductId": [
                        model-product-id-1,
                        model-product-id-2,
                        ...
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "aws-marketplace:Unsubscribe",
                "aws-marketplace:ViewSubscriptions"
            ],
            "Resource": "*"
        }
    ]
}