Restricting Access to Amazon Bedrock Models

Question

Hi all, I am trying to restrict a user's access to certain FMs on Amazon Bedrock by preventing them from granting a model access. I tried following this [guide](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html#model-access-permissions) but it doesn't work. Can anyone help?

Riku_Kobayashi · Answer

Hello.

You can check the ARN of Bedrock's foundation model as follows.  
The document you're looking at is enabling model access, so it's a marketplace permission.  
For example, if you want to control Bedrock's "InvokeModel", you will need to use the following ARN.  
A sample IAM policy is provided in the following document.  
https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-deny-inference  
```
aws bedrock list-foundation-models --query "modelSummaries"[]."modelArn"
[
    "arn:aws:bedrock:ap-northeast-1::foundation-model/amazon.titan-text-express-v1:0:8k",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/amazon.titan-text-express-v1",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/amazon.titan-embed-text-v1:2:8k",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/amazon.titan-embed-text-v1",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/anthropic.claude-instant-v1:2:18k",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/anthropic.claude-instant-v1",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/anthropic.claude-v2:1:18k",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/anthropic.claude-v2:1:200k",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/anthropic.claude-v2:1",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/anthropic.claude-3-haiku-20240307-v1:0",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/anthropic.claude-3-5-sonnet-20240620-v1:0",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/cohere.embed-english-v3",
    "arn:aws:bedrock:ap-northeast-1::foundation-model/cohere.embed-multilingual-v3"
]
```

Restricting Access to Amazon Bedrock Models

Add your answer

Relevant content