Restricting usage of Bedrock only through application inference profiles with tags in an AWS Organization

To restrict Amazon Bedrock usage to only application inference profiles with specific tags while still allowing those profiles to work properly, you need to modify your approach. Your current SCP has identified a key challenge: denying direct access to foundation models also prevents application inference profiles from working, as they need to invoke those models.

Here's a better approach to achieve your goal:

1. Instead of denying access to foundation models completely, modify your policy to allow access to foundation models only when the request is coming through an application inference profile.

2. You can implement a policy that:

• Denies direct invocation of foundation models
• Allows invocation through application inference profiles
• Requires those profiles to have specific tags

A policy like this would allow your developers to use Claude models, but only through properly tagged application inference profiles, enabling you to trace each invocation to specific individuals or projects.

When creating application inference profiles, you can assign tags like "Project" or "UserId" to track usage. These profiles will have ARNs in the format arn:aws:bedrock:region:account-id:application-inference-profile/profile-id.

For your specific use case, you might want to implement conditions that check for the presence of required tags on the application inference profile resources, rather than denying access to the foundation models entirely.
Sources
Configure fine-grained access to Amazon Bedrock models using Amazon SageMaker Unified Studio | Artificial Intelligence
Identity-based policy examples for Amazon Bedrock - Amazon Bedrock
Add cost allocation tags to Amazon Bedrock on-demand models | AWS re:Post
CreateInferenceProfile - Amazon Bedrock