Converse API to interact with Bedrock Prompt is throwing AccessDeniedException

Question

I’m using ConverseAPI to invoke a prompt created in Bedrock Prompt Management. This prompt is being invoked from an ECS cluster with a role that has been granted the following permissions:

```yaml
- "bedrock:InvokeModel"
- "bedrock:InvokeModelWithResponseStream"
- "bedrock:GetInferenceProfile"
- "bedrock:GetPrompt"
```
In the Resource field, I’ve tried specifying the exact prompt ARN, along with the foundational model and inference profile ARNs used by this prompt version:
```yaml
- !Sub arn:aws:bedrock:eu-central-1:${AWS::AccountId}:prompt/:4
- !Sub arn:aws:bedrock:eu-central-1:${AWS::AccountId}:inference-profile/eu.anthropic.claude-3-7-sonnet-20250219-v1:0
- arn:aws:bedrock:eu-central-1::foundation-model/anthropic.claude-3-7-sonnet-20250219-v1:0
- arn:aws:bedrock:eu-west-1::foundation-model/anthropic.claude-3-7-sonnet-20250219-v1:0
- arn:aws:bedrock:eu-north-1::foundation-model/anthropic.claude-3-7-sonnet-20250219-v1:0
- arn:aws:bedrock:eu-west-3::foundation-model/anthropic.claude-3-7-sonnet-20250219-v1:0   
```
I also tried setting `"Resource": "*"` and gave the role full Bedrock access, but I’m still getting the following error:

> An error occurred (AccessDeniedException) when calling the Converse operation: Your account is not authorized to invoke this API operation with a prompt  resource.
What am I missing in my IAM permissions?

Tim Horton · Answer

The auto-generated answer is correct for adding bedrock:Converse and may also need bedrock:ConverseStream. However, can you check CloudTrail for a more detailed error message about what access is being denied, since this isn't an explicit deny?

You may also need more than the noted List and Get actions for foundation models:

ListFoundationModels GetFoundationModels

You may also need more than the noted List and Get actions for foundation models:

ListFoundationModels
GetFoundationModels

re:Post Agent · Answer

Based on your error message, it appears you're missing specific permissions needed to use the Converse operation with a Bedrock managed prompt.

When working with Bedrock's Prompt Management feature and the Converse API, you need to include additional permissions beyond just the standard InvokeModel permissions. The error specifically mentions that your account is not authorized to invoke the Converse operation with a prompt resource.

Try adding these additional permissions to your IAM role:

```yaml
- "bedrock:Converse"
- "bedrock:RenderPrompt"
- "bedrock:CreateInvocation"
- "bedrock:CreateSession"
- "bedrock:ListInvocations"
- "bedrock:ListSessions"
- "bedrock:GetSession"
```

Make sure these permissions apply to the appropriate resources. You can either specify the exact ARNs or use a wildcard ("*") for testing purposes.

Also, verify that you're using the correct prompt identifier in your code. The prompt identifier should be the 10-character alphanumeric code found in the ARN (the part after "prompt/" in your ARN). Some users have encountered issues when passing the name of the prompt instead of this identifier.

If you're still experiencing issues after adding these permissions, check your CloudTrail logs to see if there are any additional clues about what specific permission might be missing.  
**Sources**  
[Bedrock InvokeModel/Converse with Managed Prompt - AccessDenied | AWS re:Post](https://repost.aws/questions/QUn3E9ZAq2RYyCfs6L1jtdkA/bedrock-invokemodel-converse-with-managed-prompt-accessdenied)  
[Bedrock Prompt Management - Access Denied | AWS re:Post](https://repost.aws/questions/QUvG1YU5RpT-ScKEp4ksIy8w/bedrock-prompt-management-access-denied)

Mnno · Answer

I got the same error message and only adding the "bedrock:RenderPrompt" action on the "arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:prompt/*" resource solved the issue.

As far as I could see the other actions do not exist (converse uses invokeModel) or are only needed for Bedrock session management.

Converse API to interact with Bedrock Prompt is throwing AccessDeniedException

Add your answer

Relevant content