Bedrock IAM Permissions Help - Claude Sonnet Access

Question

We are trying to use Claude Sonnet 4. While we previously had to request model access in conduit, it seems serverless models are now available by default. We've set up IAM role access for external users, but when they try to switch to Sonnet 4.0 or later versions, they're receiving permission errors.

Here is the error message (with account details redacted):
User: arn:aws:iam::REDACTED:user/REDACTED
is not authorized to perform: bedrock:InvokeModel
on resource: arn:aws:bedrock:us-west-2:REDACTED:inference-profile/global.anthropic.claude-haiku-4-5-20251001-v1:0
because no identity-based policy allows the bedrock:InvokeModel action

How can we resolve this? We believe we need to update the IAM role's policy. Could you share documentation on the required permissions and process?

Riku_Kobayashi · Answer

Hello.

As far as the error message is concerned, the IAM policy does not allow "bedrock:InvokeModel" for "arn:aws:bedrock:us-west-2:REDACTED:inference-profile/global.anthropic.claude-haiku-4-5-20251001-v1:0", so please try setting the following IAM policy.  
https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html  
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "test",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel"
            ],
            "Resource": "arn:aws:bedrock:us-west-2:REDACTED:inference-profile/global.anthropic.claude-haiku-4-5-20251001-v1:0"
        }
    ]
}

```

User-6743044 · Answer

I think I found where to add this policy, however it's highlighting an error related to what you have provided. Can you advise where we need to add the AWS accoun ID? Please see screenshot:
![Enter image description here](/media/postImages/original/IMPq8WJHXdQ4OhQevw9zYkMA)

Bedrock IAM Permissions Help - Claude Sonnet Access

Add your answer

Relevant content