IAM / ml / bedrock

Amazon Bedrock (IAM)

AWSbedrockml

Amazon Bedrock is a fully managed service that makes foundation models from leading AI companies accessible via an API to build generative AI applications.

iamaws

docs ↗

Permissions

Actions in this service

bedrock:ListAgents

bedrock:GetAgent

bedrock:InvokeAgent

bedrock:ListFlows

bedrock:GetFlow

bedrock:InvokeFlow

bedrock:ListPrompts

bedrock:GetPrompt

Policy

Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "bedrock:ListAgents", "bedrock:GetAgent", "bedrock:InvokeAgent", "bedrock:ListFlows", "bedrock:GetFlow", "bedrock:InvokeFlow", "bedrock:ListPrompts", "bedrock:GetPrompt" ], "Resource": "*" } ] }

SDK mapping

Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns

Known gotchas

Avoid bedrock:* — grants full control including delete and modify of agents, flows, and prompts

Avoid bedrock:DeleteAgent and bedrock:DeleteFlow unless explicitly needed for cleanup

Resources

docshttps://servicereference.us-east-1.amazonaws.com/v1/bedrock/bedrock.json ↗