Bedrock API user is getting created after preventing the creation of Long Term API Keys

Question

I have created an SCP that blocks users from creating LongTermAPIKey for Bedrock which is preventing users from creating the keys but when I go to IAM console and check, I see the user already created for the Bedrock API which is not an expected behavior.
Is there a way we can block the users from creating the longTermAPI keys and also from creating the corresponding IAM user for that?

Riku_Kobayashi · Answer

Hello.

How about setting up an SCP like this:  
When you create a Bedrock API key, an IAM user is created with a name like "BedrockAPIKey-1234".  
Therefore, I thought that if I could restrict the creation of IAM users with names starting with "BedrockAPIKey", IAM users would not be created.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "test",
            "Effect": "Deny",
            "Action": "iam:CreateUser",
            "Resource": "arn:aws:iam::*:user/BedrockAPIKey*"
        }
    ]
}
```

Bedrock API user is getting created after preventing the creation of Long Term API Keys

Add your answer

Relevant content