Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Bedrock

Amazon Bedrock (service prefix: bedrock) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Bedrock
Actions defined by Amazon Bedrock
Permission-only actions for Amazon Bedrock
Resource types defined by Amazon Bedrock
Condition keys for Amazon Bedrock

API operations defined by Amazon Bedrock

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
BatchDeleteAdvancedPromptOptimizationJob	bedrock	bedrock:BatchDeleteAdvancedPromptOptimizationJob			Write
BatchDeleteEvaluationJob	bedrock	bedrock:BatchDeleteEvaluationJob			Write
CancelAutomatedReasoningPolicyBuildWorkflow	bedrock	bedrock:CancelAutomatedReasoningPolicyBuildWorkflow			Write
CreateAdvancedPromptOptimizationJob	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateAdvancedPromptOptimizationJob			Write
		bedrock:TagResource			Tagging, Write
CreateAutomatedReasoningPolicy	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateAutomatedReasoningPolicy			Write
		bedrock:TagResource			Tagging, Write
CreateAutomatedReasoningPolicyTestCase	bedrock	bedrock:CreateAutomatedReasoningPolicyTestCase			Write
CreateAutomatedReasoningPolicyVersion	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateAutomatedReasoningPolicyVersion			Write
		bedrock:TagResource			Tagging, Write
CreateCustomModel	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateCustomModel			Write
		bedrock:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
CreateCustomModelDeployment	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateCustomModelDeployment			Write
		bedrock:TagResource			Tagging, Write
CreateEvaluationJob	bedrock	bedrock:CreateEvaluationJob			Write
		bedrock:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
CreateFoundationModelAgreement	bedrock	bedrock:CallWithBearerToken			Read
CreateFoundationModelAgreement	bedrock	bedrock:CreateFoundationModelAgreement			Write
CreateGuardrail	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateGuardrail			Write
		bedrock:TagResource			Tagging, Write
CreateGuardrailVersion	bedrock	bedrock:CallWithBearerToken			Read
CreateGuardrailVersion	bedrock	bedrock:CreateGuardrailVersion			Write
CreateInferenceProfile	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateInferenceProfile			Write
		bedrock:TagResource			Tagging, Write
CreateMarketplaceModelEndpoint	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateMarketplaceModelEndpoint			Write
		iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
CreateModelCopyJob	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateModelCopyJob			Write
		bedrock:TagResource			Tagging, Write
CreateModelCustomizationJob	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateModelCustomizationJob			Write
		bedrock:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
CreateModelImportJob	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateModelImportJob			Write
		bedrock:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
CreateModelInvocationJob	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateModelInvocationJob			Write
		bedrock:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
CreatePromptRouter	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreatePromptRouter			Write
		bedrock:TagResource			Tagging, Write
CreateProvisionedModelThroughput	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:CreateProvisionedModelThroughput			Write
		bedrock:TagResource			Tagging, Write
DeleteAutomatedReasoningPolicy	bedrock	bedrock:CallWithBearerToken			Read
DeleteAutomatedReasoningPolicy	bedrock	bedrock:DeleteAutomatedReasoningPolicy			Write
DeleteAutomatedReasoningPolicyBuildWorkflow	bedrock	bedrock:DeleteAutomatedReasoningPolicyBuildWorkflow			Write
DeleteAutomatedReasoningPolicyTestCase	bedrock	bedrock:DeleteAutomatedReasoningPolicyTestCase			Write
DeleteCustomModel	bedrock	bedrock:CallWithBearerToken			Read
DeleteCustomModel	bedrock	bedrock:DeleteCustomModel			Write
DeleteCustomModelDeployment	bedrock	bedrock:CallWithBearerToken			Read
DeleteCustomModelDeployment	bedrock	bedrock:DeleteCustomModelDeployment			Write
DeleteEnforcedGuardrailConfiguration	bedrock	bedrock:DeleteEnforcedGuardrailConfiguration			Write
DeleteFoundationModelAgreement	bedrock	bedrock:DeleteFoundationModelAgreement			Write
DeleteGuardrail	bedrock	bedrock:CallWithBearerToken			Read
DeleteGuardrail	bedrock	bedrock:DeleteGuardrail			Write
DeleteImportedModel	bedrock	bedrock:CallWithBearerToken			Read
DeleteImportedModel	bedrock	bedrock:DeleteImportedModel			Write
DeleteInferenceProfile	bedrock	bedrock:CallWithBearerToken			Read
DeleteInferenceProfile	bedrock	bedrock:DeleteInferenceProfile			Write
DeleteMarketplaceModelEndpoint	bedrock	bedrock:CallWithBearerToken			Read
DeleteMarketplaceModelEndpoint	bedrock	bedrock:DeleteMarketplaceModelEndpoint			Write
DeleteModelInvocationLoggingConfiguration	bedrock	bedrock:DeleteModelInvocationLoggingConfiguration			Write
DeletePromptRouter	bedrock	bedrock:CallWithBearerToken			Read
DeletePromptRouter	bedrock	bedrock:DeletePromptRouter			Write
DeleteProvisionedModelThroughput	bedrock	bedrock:CallWithBearerToken			Read
DeleteProvisionedModelThroughput	bedrock	bedrock:DeleteProvisionedModelThroughput			Write
DeleteResourcePolicy	bedrock	bedrock:DeleteResourcePolicy			Write
DeleteResourcePolicy	bedrock	bedrock:PutResourcePolicy			Write
DeregisterMarketplaceModelEndpoint	bedrock	bedrock:DeregisterMarketplaceModelEndpoint			Write
ExportAutomatedReasoningPolicyVersion	bedrock	bedrock:CallWithBearerToken			Read
ExportAutomatedReasoningPolicyVersion	bedrock	bedrock:ExportAutomatedReasoningPolicyVersion			Read
GetAccountDataRetention	bedrock	bedrock:CallWithBearerToken			Read
GetAccountDataRetention	bedrock	bedrock:GetAccountDataRetention			Read
GetAdvancedPromptOptimizationJob	bedrock	bedrock:GetAdvancedPromptOptimizationJob			Read
GetAutomatedReasoningPolicy	bedrock	bedrock:CallWithBearerToken			Read
GetAutomatedReasoningPolicy	bedrock	bedrock:GetAutomatedReasoningPolicy			Read
GetAutomatedReasoningPolicyAnnotations	bedrock	bedrock:GetAutomatedReasoningPolicyAnnotations			Read
GetAutomatedReasoningPolicyBuildWorkflow	bedrock	bedrock:GetAutomatedReasoningPolicyBuildWorkflow			Read
GetAutomatedReasoningPolicyBuildWorkflowResultAssets	bedrock	bedrock:GetAutomatedReasoningPolicyBuildWorkflowResultAssets			Read
GetAutomatedReasoningPolicyNextScenario	bedrock	bedrock:GetAutomatedReasoningPolicyNextScenario			Read
GetAutomatedReasoningPolicyTestCase	bedrock	bedrock:GetAutomatedReasoningPolicyTestCase			Read
GetAutomatedReasoningPolicyTestResult	bedrock	bedrock:GetAutomatedReasoningPolicyTestResult			Read
GetCustomModel	bedrock	bedrock:CallWithBearerToken			Read
GetCustomModel	bedrock	bedrock:GetCustomModel			Read
GetCustomModelDeployment	bedrock	bedrock:CallWithBearerToken			Read
GetCustomModelDeployment	bedrock	bedrock:GetCustomModelDeployment			Read
GetEvaluationJob	bedrock	bedrock:GetEvaluationJob			Read
GetFoundationModel	bedrock	bedrock:CallWithBearerToken			Read
GetFoundationModel	bedrock	bedrock:GetFoundationModel			Read
GetFoundationModelAvailability	bedrock	bedrock:CallWithBearerToken			Read
GetFoundationModelAvailability	bedrock	bedrock:GetFoundationModelAvailability			Read
GetGuardrail	bedrock	bedrock:CallWithBearerToken			Read
GetGuardrail	bedrock	bedrock:GetGuardrail			Read
GetImportedModel	bedrock	bedrock:CallWithBearerToken			Read
GetImportedModel	bedrock	bedrock:GetImportedModel			Read
GetInferenceProfile	bedrock	bedrock:CallWithBearerToken			Read
GetInferenceProfile	bedrock	bedrock:GetInferenceProfile			Read
GetMarketplaceModelEndpoint	bedrock	bedrock:CallWithBearerToken			Read
GetMarketplaceModelEndpoint	bedrock	bedrock:GetMarketplaceModelEndpoint			Read
GetModelCopyJob	bedrock	bedrock:CallWithBearerToken			Read
GetModelCopyJob	bedrock	bedrock:GetModelCopyJob			Read
GetModelCustomizationJob	bedrock	bedrock:CallWithBearerToken			Read
GetModelCustomizationJob	bedrock	bedrock:GetModelCustomizationJob			Read
GetModelImportJob	bedrock	bedrock:CallWithBearerToken			Read
GetModelImportJob	bedrock	bedrock:GetModelImportJob			Read
GetModelInvocationJob	bedrock	bedrock:CallWithBearerToken			Read
GetModelInvocationJob	bedrock	bedrock:GetModelInvocationJob			Read
GetModelInvocationLoggingConfiguration	bedrock	bedrock:CallWithBearerToken			Read
GetModelInvocationLoggingConfiguration	bedrock	bedrock:GetModelInvocationLoggingConfiguration			Read
GetPromptRouter	bedrock	bedrock:CallWithBearerToken			Read
GetPromptRouter	bedrock	bedrock:GetPromptRouter			Read
GetProvisionedModelThroughput	bedrock	bedrock:CallWithBearerToken			Read
GetProvisionedModelThroughput	bedrock	bedrock:GetProvisionedModelThroughput			Read
GetResourcePolicy	bedrock	bedrock:GetResourcePolicy			Read
GetUseCaseForModelAccess	bedrock	bedrock:CallWithBearerToken			Read
GetUseCaseForModelAccess	bedrock	bedrock:GetUseCaseForModelAccess			Read
ListAdvancedPromptOptimizationJobs	bedrock	bedrock:CallWithBearerToken			Read
ListAdvancedPromptOptimizationJobs	bedrock	bedrock:ListAdvancedPromptOptimizationJobs			List
ListAutomatedReasoningPolicies	bedrock	bedrock:CallWithBearerToken			Read
ListAutomatedReasoningPolicies	bedrock	bedrock:ListAutomatedReasoningPolicies			List
ListAutomatedReasoningPolicyBuildWorkflows	bedrock	bedrock:ListAutomatedReasoningPolicyBuildWorkflows			List
ListAutomatedReasoningPolicyTestCases	bedrock	bedrock:ListAutomatedReasoningPolicyTestCases			List
ListAutomatedReasoningPolicyTestResults	bedrock	bedrock:ListAutomatedReasoningPolicyTestResults			List
ListCustomModelDeployments	bedrock	bedrock:CallWithBearerToken			Read
ListCustomModelDeployments	bedrock	bedrock:ListCustomModelDeployments			List
ListCustomModels	bedrock	bedrock:CallWithBearerToken			Read
ListCustomModels	bedrock	bedrock:ListCustomModels			List
ListEnforcedGuardrailsConfiguration	bedrock	bedrock:ListEnforcedGuardrailsConfiguration			List
ListEvaluationJobs	bedrock	bedrock:ListEvaluationJobs			List
ListFoundationModelAgreementOffers	bedrock	bedrock:CallWithBearerToken			Read
ListFoundationModelAgreementOffers	bedrock	bedrock:ListFoundationModelAgreementOffers			List
ListFoundationModels	bedrock	bedrock:CallWithBearerToken			Read
ListFoundationModels	bedrock	bedrock:ListFoundationModels			List
ListGuardrails	bedrock	bedrock:CallWithBearerToken			Read
ListGuardrails	bedrock	bedrock:ListGuardrails			List
ListImportedModels	bedrock	bedrock:ListImportedModels			List
ListInferenceProfiles	bedrock	bedrock:CallWithBearerToken			Read
ListInferenceProfiles	bedrock	bedrock:ListInferenceProfiles			List
ListMarketplaceModelEndpoints	bedrock	bedrock:CallWithBearerToken			Read
ListMarketplaceModelEndpoints	bedrock	bedrock:ListMarketplaceModelEndpoints			Read
ListModelCopyJobs	bedrock	bedrock:CallWithBearerToken			Read
ListModelCopyJobs	bedrock	bedrock:ListModelCopyJobs			List
ListModelCustomizationJobs	bedrock	bedrock:CallWithBearerToken			Read
ListModelCustomizationJobs	bedrock	bedrock:ListModelCustomizationJobs			List
ListModelImportJobs	bedrock	bedrock:ListModelImportJobs			List
ListModelInvocationJobs	bedrock	bedrock:CallWithBearerToken			Read
ListModelInvocationJobs	bedrock	bedrock:ListModelInvocationJobs			List
ListPromptRouters	bedrock	bedrock:CallWithBearerToken			Read
ListPromptRouters	bedrock	bedrock:ListPromptRouters			List
ListProvisionedModelThroughputs	bedrock	bedrock:CallWithBearerToken			Read
ListProvisionedModelThroughputs	bedrock	bedrock:ListProvisionedModelThroughputs			List
ListTagsForResource	bedrock	bedrock:CallWithBearerToken			Read
ListTagsForResource	bedrock	bedrock:ListTagsForResource			Read
PutAccountDataRetention	bedrock	bedrock:CallWithBearerToken			Read
PutAccountDataRetention	bedrock	bedrock:PutAccountDataRetention			Write
PutEnforcedGuardrailConfiguration	bedrock	bedrock:PutEnforcedGuardrailConfiguration			Write
PutModelInvocationLoggingConfiguration	bedrock	bedrock:PutModelInvocationLoggingConfiguration			Write
PutModelInvocationLoggingConfiguration	bedrock	iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
PutResourcePolicy	bedrock	bedrock:PutResourcePolicy			Write
PutUseCaseForModelAccess	bedrock	bedrock:CallWithBearerToken			Read
PutUseCaseForModelAccess	bedrock	bedrock:PutUseCaseForModelAccess			Write
RegisterMarketplaceModelEndpoint	bedrock	bedrock:RegisterMarketplaceModelEndpoint			Write
StartAutomatedReasoningPolicyBuildWorkflow	bedrock	bedrock:StartAutomatedReasoningPolicyBuildWorkflow			Write
StartAutomatedReasoningPolicyTestWorkflow	bedrock	bedrock:InvokeAutomatedReasoningPolicy			Read
StartAutomatedReasoningPolicyTestWorkflow	bedrock	bedrock:StartAutomatedReasoningPolicyTestWorkflow			Write
StopAdvancedPromptOptimizationJob	bedrock	bedrock:StopAdvancedPromptOptimizationJob			Write
StopEvaluationJob	bedrock	bedrock:StopEvaluationJob			Write
StopModelCustomizationJob	bedrock	bedrock:CallWithBearerToken			Read
StopModelCustomizationJob	bedrock	bedrock:StopModelCustomizationJob			Write
StopModelInvocationJob	bedrock	bedrock:CallWithBearerToken			Read
StopModelInvocationJob	bedrock	bedrock:StopModelInvocationJob			Write
TagResource	bedrock	bedrock:CallWithBearerToken			Read
TagResource	bedrock	bedrock:TagResource			Tagging, Write
UntagResource	bedrock	bedrock:CallWithBearerToken			Read
UntagResource	bedrock	bedrock:UntagResource			Tagging, Write
UpdateAutomatedReasoningPolicy	bedrock	bedrock:CallWithBearerToken			Read
UpdateAutomatedReasoningPolicy	bedrock	bedrock:UpdateAutomatedReasoningPolicy			Write
UpdateAutomatedReasoningPolicyAnnotations	bedrock	bedrock:UpdateAutomatedReasoningPolicyAnnotations			Write
UpdateAutomatedReasoningPolicyTestCase	bedrock	bedrock:UpdateAutomatedReasoningPolicyTestCase			Write
UpdateCustomModelDeployment	bedrock	bedrock:CallWithBearerToken			Read
UpdateCustomModelDeployment	bedrock	bedrock:UpdateCustomModelDeployment			Write
UpdateGuardrail	bedrock	bedrock:CallWithBearerToken			Read
UpdateGuardrail	bedrock	bedrock:UpdateGuardrail			Write
UpdateMarketplaceModelEndpoint	bedrock	bedrock:CallWithBearerToken			Read
		bedrock:UpdateMarketplaceModelEndpoint			Write
		iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
UpdateProvisionedModelThroughput	bedrock	bedrock:CallWithBearerToken			Read
UpdateProvisionedModelThroughput	bedrock	bedrock:UpdateProvisionedModelThroughput			Write
AssociateAgentCollaborator	bedrock-agent	bedrock:AssociateAgentCollaborator			Write
AssociateAgentKnowledgeBase	bedrock-agent	bedrock:AssociateAgentKnowledgeBase			Write
CreateAgent	bedrock-agent	bedrock:CreateAgent			Write
		bedrock:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
CreateAgentActionGroup	bedrock-agent	bedrock:CreateAgentActionGroup			Write
CreateAgentAlias	bedrock-agent	bedrock:CreateAgentAlias			Write
CreateAgentAlias	bedrock-agent	bedrock:TagResource			Tagging, Write
CreateDataSource	bedrock-agent	bedrock:CreateDataSource			Write
CreateFlow	bedrock-agent	bedrock:CreateFlow			Write
		bedrock:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
CreateFlowAlias	bedrock-agent	bedrock:CreateFlowAlias			Write
CreateFlowAlias	bedrock-agent	bedrock:TagResource			Tagging, Write
CreateFlowVersion	bedrock-agent	bedrock:CreateFlowVersion			Write
CreateKnowledgeBase	bedrock-agent	bedrock:AssociateThirdPartyKnowledgeBase			Write
		bedrock:CreateKnowledgeBase			Write
		bedrock:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
CreatePrompt	bedrock-agent	bedrock:CreatePrompt			Write
CreatePrompt	bedrock-agent	bedrock:TagResource			Tagging, Write
CreatePromptVersion	bedrock-agent	bedrock:CreatePromptVersion			Write
CreatePromptVersion	bedrock-agent	bedrock:TagResource			Tagging, Write
DeleteAgent	bedrock-agent	bedrock:DeleteAgent			Write
DeleteAgentActionGroup	bedrock-agent	bedrock:DeleteAgentActionGroup			Write
DeleteAgentAlias	bedrock-agent	bedrock:DeleteAgentAlias			Write
DeleteAgentVersion	bedrock-agent	bedrock:DeleteAgentVersion			Write
DeleteDataSource	bedrock-agent	bedrock:DeleteDataSource			Write
DeleteFlow	bedrock-agent	bedrock:DeleteFlow			Write
DeleteFlowAlias	bedrock-agent	bedrock:DeleteFlowAlias			Write
DeleteFlowVersion	bedrock-agent	bedrock:DeleteFlowVersion			Write
DeleteKnowledgeBase	bedrock-agent	bedrock:DeleteKnowledgeBase			Write
DeleteKnowledgeBaseDocuments	bedrock-agent	bedrock:AssociateThirdPartyKnowledgeBase			Write
		bedrock:DeleteKnowledgeBaseDocuments			Write
		bedrock:StartIngestionJob			Write
DeletePrompt	bedrock-agent	bedrock:DeletePrompt			Write
DeleteResourcePolicy	bedrock-agent	bedrock:DeleteResourcePolicy			Write
DeleteResourcePolicy	bedrock-agent	bedrock:PutResourcePolicy			Write
DisassociateAgentCollaborator	bedrock-agent	bedrock:DisassociateAgentCollaborator			Write
DisassociateAgentKnowledgeBase	bedrock-agent	bedrock:DisassociateAgentKnowledgeBase			Write
GetAgent	bedrock-agent	bedrock:GetAgent			Read
GetAgentActionGroup	bedrock-agent	bedrock:GetAgentActionGroup			Read
GetAgentAlias	bedrock-agent	bedrock:GetAgentAlias			Read
GetAgentCollaborator	bedrock-agent	bedrock:GetAgentCollaborator			Read
GetAgentKnowledgeBase	bedrock-agent	bedrock:GetAgentKnowledgeBase			Read
GetAgentVersion	bedrock-agent	bedrock:GetAgentVersion			Read
GetDataSource	bedrock-agent	bedrock:GetDataSource			Read
GetFlow	bedrock-agent	bedrock:GetFlow			Read
GetFlowAlias	bedrock-agent	bedrock:GetFlowAlias			Read
GetFlowVersion	bedrock-agent	bedrock:GetFlowVersion			Read
GetIngestionJob	bedrock-agent	bedrock:GetIngestionJob			Read
GetKnowledgeBase	bedrock-agent	bedrock:GetKnowledgeBase			Read
GetKnowledgeBaseDocuments	bedrock-agent	bedrock:GetKnowledgeBaseDocuments			Read
GetPrompt	bedrock-agent	bedrock:GetPrompt			Read
GetResourcePolicy	bedrock-agent	bedrock:GetResourcePolicy			Read
IngestKnowledgeBaseDocuments	bedrock-agent	bedrock:AssociateThirdPartyKnowledgeBase			Write
		bedrock:IngestKnowledgeBaseDocuments			Write
		bedrock:StartIngestionJob			Write
ListAgentActionGroups	bedrock-agent	bedrock:ListAgentActionGroups			List
ListAgentAliases	bedrock-agent	bedrock:ListAgentAliases			List
ListAgentCollaborators	bedrock-agent	bedrock:ListAgentCollaborators			List
ListAgentKnowledgeBases	bedrock-agent	bedrock:ListAgentKnowledgeBases			List
ListAgentVersions	bedrock-agent	bedrock:ListAgentVersions			List
ListAgents	bedrock-agent	bedrock:ListAgents			List
ListDataSources	bedrock-agent	bedrock:ListDataSources			List
ListFlowAliases	bedrock-agent	bedrock:ListFlowAliases			List
ListFlowVersions	bedrock-agent	bedrock:ListFlowVersions			List
ListFlows	bedrock-agent	bedrock:ListFlows			List
ListIngestionJobs	bedrock-agent	bedrock:ListIngestionJobs			List
ListKnowledgeBaseDocuments	bedrock-agent	bedrock:ListKnowledgeBaseDocuments			List
ListKnowledgeBases	bedrock-agent	bedrock:ListKnowledgeBases			List
ListPrompts	bedrock-agent	bedrock:ListPrompts			List
ListTagsForResource	bedrock-agent	bedrock:CallWithBearerToken			Read
ListTagsForResource	bedrock-agent	bedrock:ListTagsForResource			Read
PrepareAgent	bedrock-agent	bedrock:PrepareAgent			Write
PrepareFlow	bedrock-agent	bedrock:PrepareFlow			Write
PutResourcePolicy	bedrock-agent	bedrock:PutResourcePolicy			Write
StartIngestionJob	bedrock-agent	bedrock:AssociateThirdPartyKnowledgeBase			Write
StartIngestionJob	bedrock-agent	bedrock:StartIngestionJob			Write
StopIngestionJob	bedrock-agent	bedrock:StopIngestionJob			Write
TagResource	bedrock-agent	bedrock:CallWithBearerToken			Read
TagResource	bedrock-agent	bedrock:TagResource			Tagging, Write
UntagResource	bedrock-agent	bedrock:CallWithBearerToken			Read
UntagResource	bedrock-agent	bedrock:UntagResource			Tagging, Write
UpdateAgent	bedrock-agent	bedrock:UpdateAgent			Write
UpdateAgent	bedrock-agent	iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
UpdateAgentActionGroup	bedrock-agent	bedrock:UpdateAgentActionGroup			Write
UpdateAgentAlias	bedrock-agent	bedrock:UpdateAgentAlias			Write
UpdateAgentCollaborator	bedrock-agent	bedrock:UpdateAgentCollaborator			Write
UpdateAgentKnowledgeBase	bedrock-agent	bedrock:UpdateAgentKnowledgeBase			Write
UpdateDataSource	bedrock-agent	bedrock:UpdateDataSource			Write
UpdateFlow	bedrock-agent	bedrock:UpdateFlow			Write
UpdateFlow	bedrock-agent	iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
UpdateFlowAlias	bedrock-agent	bedrock:UpdateFlowAlias			Write
UpdateKnowledgeBase	bedrock-agent	bedrock:AssociateThirdPartyKnowledgeBase			Write
		bedrock:UpdateKnowledgeBase			Write
		iam:PassRole	iam:PassedToService	bedrock.amazonaws.com	Write
UpdatePrompt	bedrock-agent	bedrock:UpdatePrompt			Write
ValidateFlowDefinition	bedrock-agent	bedrock:ValidateFlowDefinition			Read
AgenticRetrieveStream	bedrock-agent-runtime	bedrock:AgenticRetrieveStream			Read
AgenticRetrieveStream	bedrock-agent-runtime	bedrock:Retrieve			Read
CreateInvocation	bedrock-agent-runtime	bedrock:CreateInvocation			Write
CreateSession	bedrock-agent-runtime	bedrock:CreateSession			Write
CreateSession	bedrock-agent-runtime	bedrock:TagResource			Tagging, Write
DeleteAgentMemory	bedrock-agent-runtime	bedrock:DeleteAgentMemory			Write
DeleteSession	bedrock-agent-runtime	bedrock:DeleteSession			Write
EndSession	bedrock-agent-runtime	bedrock:EndSession			Write
GenerateQuery	bedrock-agent-runtime	bedrock:GenerateQuery			Read
GenerateQuery	bedrock-agent-runtime	bedrock:GetKnowledgeBase			Read
GetAgentMemory	bedrock-agent-runtime	bedrock:GetAgentMemory			Read
GetDocumentContent	bedrock-agent-runtime	bedrock:GetDocumentContent			Read
GetDocumentContent	bedrock-agent-runtime	bedrock:Retrieve			Read
GetExecutionFlowSnapshot	bedrock-agent-runtime	bedrock:GetExecutionFlowSnapshot			Read
GetFlowExecution	bedrock-agent-runtime	bedrock:GetFlowExecution			Read
GetInvocationStep	bedrock-agent-runtime	bedrock:GetInvocationStep			Read
GetSession	bedrock-agent-runtime	bedrock:GetSession			Read
InvokeAgent	bedrock-agent-runtime	bedrock:InvokeAgent			Read
InvokeFlow	bedrock-agent-runtime	bedrock:InvokeFlow			Read
InvokeInlineAgent	bedrock-agent-runtime	bedrock:InvokeInlineAgent			Read
ListFlowExecutionEvents	bedrock-agent-runtime	bedrock:ListFlowExecutionEvents			List
ListFlowExecutions	bedrock-agent-runtime	bedrock:ListFlowExecutions			List
ListInvocationSteps	bedrock-agent-runtime	bedrock:ListInvocations			List
ListInvocationSteps	bedrock-agent-runtime	bedrock:ListInvocationSteps			List
ListInvocations	bedrock-agent-runtime	bedrock:ListInvocations			List
ListSessions	bedrock-agent-runtime	bedrock:ListSessions			List
ListTagsForResource	bedrock-agent-runtime	bedrock:CallWithBearerToken			Read
ListTagsForResource	bedrock-agent-runtime	bedrock:ListTagsForResource			Read
OptimizePrompt	bedrock-agent-runtime	bedrock:OptimizePrompt			Read
PutInvocationStep	bedrock-agent-runtime	bedrock:PutInvocationStep			Write
Rerank	bedrock-agent-runtime	bedrock:Rerank			Write
Retrieve	bedrock-agent-runtime	bedrock:Retrieve			Read
RetrieveAndGenerate	bedrock-agent-runtime	bedrock:RetrieveAndGenerate			Write
RetrieveAndGenerateStream	bedrock-agent-runtime	bedrock:RetrieveAndGenerate			Write
StartFlowExecution	bedrock-agent-runtime	bedrock:StartFlowExecution			Write
StopFlowExecution	bedrock-agent-runtime	bedrock:StopFlowExecution			Write
TagResource	bedrock-agent-runtime	bedrock:CallWithBearerToken			Read
TagResource	bedrock-agent-runtime	bedrock:TagResource			Tagging, Write
UntagResource	bedrock-agent-runtime	bedrock:CallWithBearerToken			Read
UntagResource	bedrock-agent-runtime	bedrock:UntagResource			Tagging, Write
UpdateSession	bedrock-agent-runtime	bedrock:UpdateSession			Write
CopyBlueprintStage	bedrock-data-automation	bedrock:CopyBlueprintStage			Write
CreateBlueprint	bedrock-data-automation	bedrock:CreateBlueprint			Write
CreateBlueprint	bedrock-data-automation	bedrock:TagResource			Tagging, Write
CreateBlueprintVersion	bedrock-data-automation	bedrock:CreateBlueprintVersion			Write
CreateDataAutomationLibrary	bedrock-data-automation	bedrock:CreateDataAutomationLibrary			Write
CreateDataAutomationLibrary	bedrock-data-automation	bedrock:TagResource			Tagging, Write
CreateDataAutomationProject	bedrock-data-automation	bedrock:CreateDataAutomationProject			Write
CreateDataAutomationProject	bedrock-data-automation	bedrock:TagResource			Tagging, Write
DeleteBlueprint	bedrock-data-automation	bedrock:DeleteBlueprint			Write
DeleteDataAutomationLibrary	bedrock-data-automation	bedrock:DeleteDataAutomationLibrary			Write
DeleteDataAutomationProject	bedrock-data-automation	bedrock:DeleteDataAutomationProject			Write
GetBlueprint	bedrock-data-automation	bedrock:GetBlueprint			Read
GetBlueprintOptimizationStatus	bedrock-data-automation	bedrock:GetBlueprintOptimizationStatus			Read
GetDataAutomationLibrary	bedrock-data-automation	bedrock:GetDataAutomationLibrary			Read
GetDataAutomationLibraryEntity	bedrock-data-automation	bedrock:GetDataAutomationLibraryEntity			Read
GetDataAutomationLibraryIngestionJob	bedrock-data-automation	bedrock:GetDataAutomationLibraryIngestionJob			Read
GetDataAutomationProject	bedrock-data-automation	bedrock:GetDataAutomationProject			Read
InvokeBlueprintOptimizationAsync	bedrock-data-automation	bedrock:InvokeBlueprintOptimizationAsync			Write
InvokeBlueprintOptimizationAsync	bedrock-data-automation	bedrock:TagResource			Tagging, Write
InvokeDataAutomationLibraryIngestionJob	bedrock-data-automation	bedrock:InvokeDataAutomationLibraryIngestionJob			Write
InvokeDataAutomationLibraryIngestionJob	bedrock-data-automation	bedrock:TagResource			Tagging, Write
ListBlueprints	bedrock-data-automation	bedrock:ListBlueprints			List
ListDataAutomationLibraries	bedrock-data-automation	bedrock:ListDataAutomationLibraries			List
ListDataAutomationLibraryEntities	bedrock-data-automation	bedrock:ListDataAutomationLibraryEntities			List
ListDataAutomationLibraryIngestionJobs	bedrock-data-automation	bedrock:ListDataAutomationLibraryIngestionJobs			List
ListDataAutomationProjects	bedrock-data-automation	bedrock:ListDataAutomationProjects			List
ListTagsForResource	bedrock-data-automation	bedrock:CallWithBearerToken			Read
ListTagsForResource	bedrock-data-automation	bedrock:ListTagsForResource			Read
TagResource	bedrock-data-automation	bedrock:CallWithBearerToken			Read
TagResource	bedrock-data-automation	bedrock:TagResource			Tagging, Write
UntagResource	bedrock-data-automation	bedrock:CallWithBearerToken			Read
UntagResource	bedrock-data-automation	bedrock:UntagResource			Tagging, Write
UpdateBlueprint	bedrock-data-automation	bedrock:UpdateBlueprint			Write
UpdateDataAutomationLibrary	bedrock-data-automation	bedrock:UpdateDataAutomationLibrary			Write
UpdateDataAutomationProject	bedrock-data-automation	bedrock:UpdateDataAutomationProject			Write
GetDataAutomationStatus	bedrock-data-automation-runtime	bedrock:GetDataAutomationStatus			Read
InvokeDataAutomation	bedrock-data-automation-runtime	bedrock:InvokeDataAutomation			Write
InvokeDataAutomationAsync	bedrock-data-automation-runtime	bedrock:InvokeDataAutomationAsync			Write
InvokeDataAutomationAsync	bedrock-data-automation-runtime	bedrock:TagResource			Tagging, Write
ListTagsForResource	bedrock-data-automation-runtime	bedrock:CallWithBearerToken			Read
ListTagsForResource	bedrock-data-automation-runtime	bedrock:ListTagsForResource			Read
TagResource	bedrock-data-automation-runtime	bedrock:CallWithBearerToken			Read
TagResource	bedrock-data-automation-runtime	bedrock:TagResource			Tagging, Write
UntagResource	bedrock-data-automation-runtime	bedrock:CallWithBearerToken			Read
UntagResource	bedrock-data-automation-runtime	bedrock:UntagResource			Tagging, Write
ApplyGuardrail	bedrock-runtime	bedrock:ApplyGuardrail			Read
		bedrock:CallWithBearerToken			Read
		bedrock:InvokeAutomatedReasoningPolicy			Read
Converse	bedrock-runtime	bedrock:ApplyGuardrail			Read
		bedrock:CallWithBearerToken			Read
		bedrock:InvokeModel			Read
		bedrock:InvokeTool			Read
ConverseStream	bedrock-runtime	bedrock:ApplyGuardrail			Read
		bedrock:CallWithBearerToken			Read
		bedrock:InvokeModelWithResponseStream			Read
		bedrock:InvokeTool			Read
CountTokens	bedrock-runtime	bedrock:CallWithBearerToken			Read
CountTokens	bedrock-runtime	bedrock:CountTokens			Read
GetAsyncInvoke	bedrock-runtime	bedrock:CallWithBearerToken			Read
GetAsyncInvoke	bedrock-runtime	bedrock:GetAsyncInvoke			Read
InvokeGuardrailChecks	bedrock-runtime	bedrock:InvokeGuardrailChecks			Read
InvokeModel	bedrock-runtime	bedrock:ApplyGuardrail			Read
		bedrock:CallWithBearerToken			Read
		bedrock:InvokeModel			Read
		bedrock:InvokeTool			Read
InvokeModelWithBidirectionalStream	bedrock-runtime	bedrock:InvokeModel			Read
InvokeModelWithResponseStream	bedrock-runtime	bedrock:ApplyGuardrail			Read
		bedrock:CallWithBearerToken			Read
		bedrock:InvokeModel			Read
		bedrock:InvokeModelWithResponseStream			Read
		bedrock:InvokeTool			Read
ListAsyncInvokes	bedrock-runtime	bedrock:CallWithBearerToken			Read
ListAsyncInvokes	bedrock-runtime	bedrock:ListAsyncInvokes			List
StartAsyncInvoke	bedrock-runtime	bedrock:CallWithBearerToken			Read
		bedrock:InvokeModel			Read
		bedrock:TagResource			Tagging, Write

Actions defined by Amazon Bedrock

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AgenticRetrieveStream	Grants permission to perform agentic retrieve with streaming from retrievers			Read
ApplyGuardrail	Grants permission to apply a guardrail	guardrail*	aws:ResourceTag/${TagKey}	Read
ApplyGuardrail	Grants permission to apply a guardrail	guardrail-profile		Read
AssociateAgentCollaborator	Grants permission to associate another existing agent as a collaborator to an existing agent	agent*	aws:ResourceTag/${TagKey}	Write
AssociateAgentKnowledgeBase	Grants permission to associate a knowledge base with an agent	agent*	aws:ResourceTag/${TagKey}	Write
AssociateAgentKnowledgeBase		knowledge-base*	aws:ResourceTag/${TagKey}	Write
BatchDeleteAdvancedPromptOptimizationJob	Grants permission to delete one or more advanced prompt optimization jobs	advanced-prompt-optimization-job*	aws:ResourceTag/${TagKey}	Write
BatchDeleteEvaluationJob	Grants permission to batch delete list of bedrock evaluation jobs	evaluation-job*	aws:ResourceTag/${TagKey}	Write
CallWithBearerToken	Grants permission to use bearer token		bedrock:BearerTokenType	Read
CancelAutomatedReasoningPolicyBuildWorkflow	Grants permission to cancel a build workflow for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Write
CopyBlueprintStage	Grants permission to copy a blueprint from one stage to another	blueprint*	aws:ResourceTag/${TagKey}	Write
CountTokens	Grants permission to count the number of tokens in an input prompt	foundation-model*		Read
CreateAdvancedPromptOptimizationJob	Grants permission to create an advanced prompt optimization job		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAgent	Grants permission to create a new agent and a test agent alias pointing to the DRAFT agent version		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAgentActionGroup	Grants permission to create a new action group in an existing agent	agent*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAgentAlias	Grants permission to create a new alias for an agent	agent*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAutomatedReasoningPolicy	Grants permission to create a new automated reasoning policy		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAutomatedReasoningPolicyTestCase	Grants permission to create a test case for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Write
CreateAutomatedReasoningPolicyVersion	Grants permission to create a new automated reasoning policy version	automated-reasoning-policy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateBlueprint	Grants permission to create a blueprint for custom output from data automation		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateBlueprintVersion	Grants permission to create a new version for an existing blueprint	blueprint*	aws:ResourceTag/${TagKey}	Write
CreateCustomModel	Grants permission to create a custom model into Bedrock		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCustomModelDeployment	Grants permission to create a custom model deployment for custom model	custom-model*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataAutomationLibrary	Grants permission to create a Data Automation Library		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDataAutomationProject	Grants permission to create a data automation project	blueprint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataAutomationProject	Grants permission to create a data automation project	data-automation-library	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataSource	Grants permission to create a data source	knowledge-base*	aws:ResourceTag/${TagKey}	Write
CreateEvaluationJob	Grants permission to create a job for evaluation foundation models or custom models	custom-model*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		default-prompt-router*	aws:RequestTag/${TagKey} aws:TagKeys
		foundation-model*	aws:RequestTag/${TagKey} aws:TagKeys
		prompt-router*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateFlow	Grants permission to create a prompt flow		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateFlowAlias	Grants permission to create an alias of a prompt flow	flow*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFlowVersion	Grants permission to create an immutable version of a prompt flow	flow*	aws:ResourceTag/${TagKey}	Write
CreateFoundationModelAgreement	Grants permission to create a new foundation model agreement			Write
CreateGuardrail	Grants permission to create a new guardrail	automated-reasoning-policy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		automated-reasoning-policy-version	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		guardrail-profile	aws:RequestTag/${TagKey} aws:TagKeys
CreateGuardrailVersion	Grants permission to create a new guardrail version	guardrail*	aws:ResourceTag/${TagKey}	Write
CreateInferenceProfile	Grants permission to create inference profiles	application-inference-profile*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		foundation-model*	aws:RequestTag/${TagKey} aws:TagKeys
		inference-profile*	aws:RequestTag/${TagKey} aws:TagKeys
CreateInvocation	Grants permission to create a new invocation in an existing session	session*	aws:ResourceTag/${TagKey}	Write
CreateKnowledgeBase	Grants permission to create a knowledge base		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateMarketplaceModelEndpoint	Grants permission to create a marketplace model endpoint			Write
CreateModelCopyJob	Grants permission to create a job for copying a custom model across region or across account	custom-model*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateModelCustomizationJob	Grants permission to create a job for customizing the model with your custom training data	custom-model*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateModelCustomizationJob		foundation-model*	aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateModelEvaluationJob	Grants permission to create a job for evaluation foundation models or custom models	custom-model*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateModelEvaluationJob		foundation-model*	aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateModelImportJob	Grants permission to create a job for importing model into Bedrock		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateModelInvocationJob	Grants permission to create a new model invocation job	custom-model*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		foundation-model*	aws:RequestTag/${TagKey} aws:TagKeys
		model-invocation-job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreatePrompt	Grants permission to create a prompt		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreatePromptRouter	Grants permission to create a custom prompt router	application-inference-profile*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		foundation-model*	aws:RequestTag/${TagKey} aws:TagKeys
		inference-profile*	aws:RequestTag/${TagKey} aws:TagKeys
CreatePromptVersion	Grants permission to create a version of a prompt	prompt*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProvisionedModelThroughput	Grants permission to create a new provisioned model throughput	custom-model*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProvisionedModelThroughput		foundation-model*	aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateSession	Grants permission to create a new session		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteAgent	Grants permission to delete an Agent that you created earlier	agent*	aws:ResourceTag/${TagKey}	Write
DeleteAgentActionGroup	Grants permission to delete an actionGroup that you created earlier	agent*	aws:ResourceTag/${TagKey}	Write
DeleteAgentAlias	Grants permission to delete an AgentAlias that you created earlier	agent-alias*	aws:ResourceTag/${TagKey}	Write
DeleteAgentMemory	Grants permission to delete existing memory for an alias	agent-alias*	aws:ResourceTag/${TagKey}	Write
DeleteAgentVersion	Grants permission to delete an Agent Version that you created earlier	agent*	aws:ResourceTag/${TagKey}	Write
DeleteAutomatedReasoningPolicy	Grants permission to delete an automated reasoning policy or its version	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Write
DeleteAutomatedReasoningPolicy		automated-reasoning-policy-version*	aws:ResourceTag/${TagKey}	Write
DeleteAutomatedReasoningPolicyBuildWorkflow	Grants permission to delete a build workflow for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Write
DeleteAutomatedReasoningPolicyTestCase	Grants permission to delete a test case for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Write
DeleteBlueprint	Grants permission to delete a blueprint for data automation	blueprint*	aws:ResourceTag/${TagKey}	Write
DeleteCustomModel	Grants permission to delete a custom model that you created earlier	custom-model*	aws:ResourceTag/${TagKey}	Write
DeleteCustomModelDeployment	Grants permission to delete a custom model deployment that you created earlier	custom-model-deployment*	aws:ResourceTag/${TagKey}	Write
DeleteDataAutomationLibrary	Grants permission to delete a Data Automation Library	data-automation-library*	aws:ResourceTag/${TagKey}	Write
DeleteDataAutomationProject	Grants permission to delete a data automation project	data-automation-project*	aws:ResourceTag/${TagKey}	Write
DeleteDataSource	Grants permission to delete a data source	knowledge-base*	aws:ResourceTag/${TagKey}	Write
DeleteEnforcedGuardrailConfiguration	Grants permission to delete account-level enforced guardrail configuration			Write
DeleteFlow	Grants permission to delete a prompt flow	flow*	aws:ResourceTag/${TagKey}	Write
DeleteFlowAlias	Grants permission to delete an alias of a prompt flow	flow-alias*	aws:ResourceTag/${TagKey}	Write
DeleteFlowVersion	Grants permission to delete a version of a prompt flow	flow*	aws:ResourceTag/${TagKey}	Write
DeleteFoundationModelAgreement	Grants permission to delete a foundation model agreement that you created earlier			Write
DeleteGuardrail	Grants permission to delete a guardrail or its version	guardrail*	aws:ResourceTag/${TagKey}	Write
DeleteImportedModel	Grants permission to delete previously created Bedrock imported model	imported-model*	aws:ResourceTag/${TagKey}	Write
DeleteInferenceProfile	Grants permission to delete inference profiles	application-inference-profile*	aws:ResourceTag/${TagKey}	Write
DeleteKnowledgeBase	Grants permission to delete a knowledge base	knowledge-base*	aws:ResourceTag/${TagKey}	Write
DeleteKnowledgeBaseDocuments	Grants permission to delete documents from a knowledge base	knowledge-base*	aws:ResourceTag/${TagKey}	Write
DeleteMarketplaceModelAgreement	Grants permission to unsubscribe from a bedrock marketplace enabled AWS marketplace model			Write
DeleteMarketplaceModelEndpoint	Grants permission to delete a marketplace model endpoint	bedrock-marketplace-model-endpoint*		Write
DeleteModelInvocationLoggingConfiguration	Grants permission to delete an existing Invocation logging configuration			Write
DeletePrompt	Grants permission to delete a prompt or its version	prompt*	aws:ResourceTag/${TagKey}	Write
DeletePrompt	Grants permission to delete a prompt or its version	prompt-version*	aws:ResourceTag/${TagKey}	Write
DeletePromptRouter	Grants permission to delete a custom prompt router	prompt-router*	aws:ResourceTag/${TagKey}	Write
DeleteProvisionedModelThroughput	Grants permission to delete a provisioned model throughput that you created earlier	provisioned-model*	aws:ResourceTag/${TagKey}	Write
DeleteSession	Grants permission to delete a Session that you created earlier	session*	aws:ResourceTag/${TagKey}	Write
DeregisterMarketplaceModelEndpoint	Grants permission to deregister a marketplace model endpoint to make it unusable in Bedrock Marketplace	bedrock-marketplace-model-endpoint*		Write
DetectGeneratedContent	Grants permission to detect if the provided content is generated using Amazon Bedrock	foundation-model*		Read
DisassociateAgentCollaborator	Grants permission to diassociate a collaborator that you associated earlier	agent*	aws:ResourceTag/${TagKey}	Write
DisassociateAgentKnowledgeBase	Grants permission to disassociate a knowledge base from the agent	agent*	aws:ResourceTag/${TagKey}	Write
DisassociateAgentKnowledgeBase		knowledge-base*	aws:ResourceTag/${TagKey}	Write
EndSession	Grants permission to end a Session that you created earlier	session*	aws:ResourceTag/${TagKey}	Write
ExportAutomatedReasoningPolicyVersion	Grants permission to retrieve an automated reasoning policy version artifact	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Read
ExportAutomatedReasoningPolicyVersion		automated-reasoning-policy-version*	aws:ResourceTag/${TagKey}	Read
GenerateQuery	Grants permission to generate queries associated with user input			Read
GetAccountDataRetention	Returns the account-wide data retention mode for Amazon Bedrock			Read
GetAdvancedPromptOptimizationJob	Grants permission to get information about an advanced prompt optimization job	advanced-prompt-optimization-job*	aws:ResourceTag/${TagKey}	Read
GetAgent	Grants permission to retrieve an existing agent	agent*	aws:ResourceTag/${TagKey}	Read
GetAgentActionGroup	Grants permission to retrieve an existing action group	agent*	aws:ResourceTag/${TagKey}	Read
GetAgentAlias	Grants permission to retrieve an existing alias	agent-alias*	aws:ResourceTag/${TagKey}	Read
GetAgentCollaborator	Grants permission to retrieve an existing collaborator	agent*	aws:ResourceTag/${TagKey}	Read
GetAgentKnowledgeBase	Grants permission to describe a knowledge base associated with an agent	agent*	aws:ResourceTag/${TagKey}	Read
GetAgentKnowledgeBase		knowledge-base*	aws:ResourceTag/${TagKey}	Read
GetAgentMemory	Grants permission to retrieve existing memory for an alias	agent-alias*	aws:ResourceTag/${TagKey}	Read
GetAgentVersion	Grants permission to retrieve an existing version of an agent	agent*	aws:ResourceTag/${TagKey}	Read
GetAsyncInvoke	Grants permission to get the properties associated with an asynchronous invocation that you have submitted	async-invoke*	aws:ResourceTag/${TagKey}	Read
GetAutomatedReasoningPolicy	Grants permission to retrieve an automated reasoning policy or its version	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Read
GetAutomatedReasoningPolicy		automated-reasoning-policy-version*	aws:ResourceTag/${TagKey}	Read
GetAutomatedReasoningPolicyAnnotations	Grants permission to retrieve annotations for a build workflow for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Read
GetAutomatedReasoningPolicyBuildWorkflow	Grants permission to retrieve a build workflow for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Read
GetAutomatedReasoningPolicyBuildWorkflowResultAssets	Grants permission to retrieve assets for a build workflow for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Read
GetAutomatedReasoningPolicyNextScenario	Grants permission to retrieve the next unreviewed generated scenario for a build workflow for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Read
GetAutomatedReasoningPolicyTestCase	Grants permission to retrieve a test case for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Read
GetAutomatedReasoningPolicyTestResult	Grants permission to retrieve result for a test case for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Read
GetBlueprint	Grants permission to retrieve an existing blueprint for data automation	blueprint*	aws:ResourceTag/${TagKey}	Read
GetBlueprintOptimizationStatus	Grants permission to get the status of a blueprint optimization job	blueprint-optimization-invocation*	aws:ResourceTag/${TagKey}	Read
GetCustomModel	Grants permission to get the properties associated with a Bedrock custom model that you have created	custom-model*	aws:ResourceTag/${TagKey}	Read
GetCustomModelDeployment	Grants permission to get the properties associated with a custom model deployment. Use this operation to get the status of a custom model deployment	custom-model-deployment*	aws:ResourceTag/${TagKey}	Read
GetDataAutomationLibrary	Grants permission to retrieve an existing Data Automation Library	data-automation-library*	aws:ResourceTag/${TagKey}	Read
GetDataAutomationLibraryEntity	Grants permission to get a Data Automation Library entity	data-automation-library*	aws:ResourceTag/${TagKey}	Read
GetDataAutomationLibraryIngestionJob	Grants permission to get details about a Data Automation Library ingestion job	data-automation-library*	aws:ResourceTag/${TagKey}	Read
GetDataAutomationLibraryIngestionJob		data-automation-library-ingestion-job*	aws:ResourceTag/${TagKey}	Read
GetDataAutomationProject	Grants permission to retrieve an existing data automation project	data-automation-project*	aws:ResourceTag/${TagKey}	Read
GetDataAutomationStatus	Grants permission to retrieve the status of a data automation invocation job	data-automation-invocation-job*	aws:ResourceTag/${TagKey}	Read
GetDataSource	Grants permission to retrieve an existing data source	knowledge-base*	aws:ResourceTag/${TagKey}	Read
GetDocumentContent	Grants permission to retrieve a document			Read
GetEvaluationJob	Grants permission to get the properties associated with a evaluation job. Use this operation to get the status of a evaluation job	evaluation-job*	aws:ResourceTag/${TagKey}	Read
GetExecutionFlowSnapshot	Grants permission to retrieve the flow definition for a flow execution	flow*	aws:ResourceTag/${TagKey}	Read
		flow-alias*	aws:ResourceTag/${TagKey}
		flow-execution*
GetFlow	Grants permission to retrieve an existing prompt flow	flow*	aws:ResourceTag/${TagKey}	Read
GetFlowAlias	Grants permission to retrieve an existing alias of a prompt flow	flow-alias*	aws:ResourceTag/${TagKey}	Read
GetFlowExecution	Grants permission to retrieve an existing execution of a flow alias	flow*	aws:ResourceTag/${TagKey}	Read
		flow-alias*	aws:ResourceTag/${TagKey}
		flow-execution*
GetFlowVersion	Grants permission to retrieve an existing version of a prompt flow	flow*	aws:ResourceTag/${TagKey}	Read
GetFoundationModel	Grants permission to get the properties associated with a Bedrock foundation model	foundation-model*		Read
GetFoundationModelAvailability	Grants permission to get the availability of a foundation model			Read
GetGuardrail	Grants permission to retrieve a guardrail or its version	guardrail*	aws:ResourceTag/${TagKey}	Read
GetImportedModel	Grants permission to get the properties associated with Bedrock imported model	imported-model*	aws:ResourceTag/${TagKey}	Read
GetInferenceProfile	Grants permission to get the properties associated with an inference profile	application-inference-profile*	aws:ResourceTag/${TagKey}	Read
GetInferenceProfile		inference-profile*		Read
GetIngestionJob	Grants permission to retrieve an existing ingestion job	knowledge-base*	aws:ResourceTag/${TagKey}	Read
GetInvocationStep	Grants permission to get an invocation step from a session	session*	aws:ResourceTag/${TagKey}	Read
GetKnowledgeBase	Grants permission to retrieve an existing knowledge base	knowledge-base*	aws:ResourceTag/${TagKey}	Read
GetKnowledgeBaseDocuments	Grants permission to get details for documents in a knowledge base	knowledge-base*	aws:ResourceTag/${TagKey}	Read
GetMarketplaceModelEndpoint	Grants permission to get the properties of a marketplace model endpoint	bedrock-marketplace-model-endpoint*		Read
GetModelCopyJob	Grants permission to get the properties associated with a model-copy job. Use this operation to get the status of a model-copy job	model-copy-job*	aws:ResourceTag/${TagKey}	Read
GetModelCustomizationJob	Grants permission to get the properties associated with a model-customization job. Use this operation to get the status of a model-customization job	model-customization-job*	aws:ResourceTag/${TagKey}	Read
GetModelEvaluationJob	Grants permission to get the properties associated with a model-evaluation job. Use this operation to get the status of a model-evaluation job	model-evaluation-job*	aws:ResourceTag/${TagKey}	Read
GetModelImportJob	Grants permission to get the properties associated with a model import job and is used to get the status of a model import job	model-import-job*	aws:ResourceTag/${TagKey}	Read
GetModelInvocationJob	Grants permission to retrieve a model invocation job	model-invocation-job*	aws:ResourceTag/${TagKey}	Read
GetModelInvocationLoggingConfiguration	Grants permission to retrieve an existing Invocation logging configuration			Read
GetPrompt	Grants permission to retrieve an existing prompt or its version	prompt*	aws:ResourceTag/${TagKey}	Read
GetPrompt		prompt-version*	aws:ResourceTag/${TagKey}	Read
GetPromptRouter	Grants permission to get the properties associated with a prompt router	default-prompt-router*		Read
GetPromptRouter		prompt-router*	aws:ResourceTag/${TagKey}	Read
GetProvisionedModelThroughput	Grants permission to retrieve a provisioned model throughput	provisioned-model*	aws:ResourceTag/${TagKey}	Read
GetSession	Grants permission to retrieve an existing session	session*	aws:ResourceTag/${TagKey}	Read
GetUseCaseForModelAccess	Grants permission to retrieve a use case for model access			Read
IngestKnowledgeBaseDocuments	Grants permission to directly ingest documents into a knowledge base	knowledge-base*	aws:ResourceTag/${TagKey}	Write
InvokeAgent	Grants permission to send user input (text-only) to the alias of an agent for Bedrock	agent-alias*	aws:ResourceTag/${TagKey}	Read
InvokeBlueprintOptimizationAsync	Grants permission to invoke an async job to perform blueprint optimization	blueprint*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
InvokeBlueprintOptimizationAsync		data-automation-profile*	aws:RequestTag/${TagKey} aws:TagKeys	Write
InvokeDataAutomation	Grants permission to invoke a call to Sync API of Bedrock data automation	blueprint*	aws:ResourceTag/${TagKey}	Write
		data-automation-profile*
		data-automation-project*	aws:ResourceTag/${TagKey}
InvokeDataAutomationAsync	Grants permission to invoke a Bedrock data automation job	blueprint*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		data-automation-profile*	aws:RequestTag/${TagKey} aws:TagKeys
		data-automation-project*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
InvokeDataAutomationLibraryIngestionJob	Grants permission to invoke a Data Automation Library ingestion job	data-automation-library*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
InvokeFlow	Grants permission to invoke a prompt flow with user input	flow-alias*	aws:ResourceTag/${TagKey}	Read
InvokeGuardrailChecks	Grants permission to invoke guardrail checks			Read
InvokeInlineAgent	Grants permission to send user input (text-only) to the inline agent for Bedrock		bedrock:InlineAgentName	Read
InvokeModel	Grants permission to invoke the specified Bedrock model to run inference using the input provided in the request body	application-inference-profile*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier	Read
		async-invoke*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		bedrock-marketplace-model-endpoint*	aws:RequestTag/${TagKey} aws:TagKeys bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		custom-model-deployment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		default-prompt-router*	aws:RequestTag/${TagKey} aws:TagKeys bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		foundation-model*	aws:RequestTag/${TagKey} aws:TagKeys bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		imported-model*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		inference-profile*	aws:RequestTag/${TagKey} aws:TagKeys bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		prompt-router*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		provisioned-model*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		system-tool*	aws:RequestTag/${TagKey} aws:TagKeys bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
InvokeModelWithResponseStream	Grants permission to invoke the specified Bedrock model to run inference using the input provided in the request body with streaming response	application-inference-profile*	aws:ResourceTag/${TagKey} bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier	Read
		bedrock-marketplace-model-endpoint*	bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		custom-model-deployment*	aws:ResourceTag/${TagKey} bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		default-prompt-router*	bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		foundation-model*	bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		imported-model*	aws:ResourceTag/${TagKey} bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		inference-profile*	bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		prompt-router*	aws:ResourceTag/${TagKey} bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		provisioned-model*	aws:ResourceTag/${TagKey} bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
		system-tool*	bedrock:GuardrailIdentifier bedrock:InferenceProfileArn bedrock:PromptRouterArn bedrock:ServiceTier
InvokeTool	Grants permission to invoke the specified Bedrock tool to run inference	system-tool*		Read
ListAdvancedPromptOptimizationJobs	Grants permission to list the advanced prompt optimization jobs in your account			List
ListAgentActionGroups	Grants permission to list action groups in an agent	agent*	aws:ResourceTag/${TagKey}	List
ListAgentAliases	Grants permission to list aliases for an agent	agent*	aws:ResourceTag/${TagKey}	List
ListAgentCollaborators	Grants permission to list collaborators for an agent	agent*	aws:ResourceTag/${TagKey}	List
ListAgentKnowledgeBases	Grants permission to list knowledge bases associated with an agent	agent*	aws:ResourceTag/${TagKey}	List
ListAgentVersions	Grants permission to list existing versions of an agent	agent*	aws:ResourceTag/${TagKey}	List
ListAgents	Grants permission to list existing agents			List
ListAsyncInvokes	Grants permission to get a list of asynchronous invocations that you have submitted			List
ListAutomatedReasoningPolicies	Grants permission to list automated reasoning policies or its versions	automated-reasoning-policy	aws:ResourceTag/${TagKey}	List
ListAutomatedReasoningPolicyBuildWorkflows	Grants permission to list build workflows for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	List
ListAutomatedReasoningPolicyTestCases	Grants permission to list test cases for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	List
ListAutomatedReasoningPolicyTestResults	Grants permission to list test result for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	List
ListBlueprints	Grants permission to list existing blueprints for data automation	data-automation-project	aws:ResourceTag/${TagKey}	List
ListCustomModelDeployments	Grants permission to get the list of custom model deployments that you have submitted			List
ListCustomModels	Grants permission to get a list of Bedrock custom models that you have created			List
ListDataAutomationLibraries	Grants permission to list Data Automation Libraries	data-automation-project	aws:ResourceTag/${TagKey}	List
ListDataAutomationLibraryEntities	Grants permission to list Data Automation Library entities	data-automation-library*	aws:ResourceTag/${TagKey}	List
ListDataAutomationLibraryIngestionJobs	Grants permission to list Data Automation Library ingestion jobs	data-automation-library*	aws:ResourceTag/${TagKey}	List
ListDataAutomationProjects	Grants permission to list existing data automation projects	blueprint	aws:ResourceTag/${TagKey}	List
ListDataAutomationProjects	Grants permission to list existing data automation projects	data-automation-project	aws:ResourceTag/${TagKey}	List
ListDataSources	Grants permission to list existing data sources in an knowledge base	knowledge-base*	aws:ResourceTag/${TagKey}	List
ListEnforcedGuardrailsConfiguration	Grants permission to list account-level enforced guardrail configurations			List
ListEvaluationJobs	Grants permission to get the list of evaluation jobs that you have submitted			List
ListFlowAliases	Grants permission to list existing aliases of a prompt flow	flow*	aws:ResourceTag/${TagKey}	List
ListFlowExecutionEvents	Grants permission to retrieve events for a flow execution	flow*	aws:ResourceTag/${TagKey}	List
		flow-alias*	aws:ResourceTag/${TagKey}
		flow-execution*
ListFlowExecutions	Grants permission to list executions of a flow or a flow alias	flow*	aws:ResourceTag/${TagKey}	List
ListFlowExecutions		flow-alias	aws:ResourceTag/${TagKey}	List
ListFlowVersions	Grants permission to list existing versions of a prompt flow	flow*	aws:ResourceTag/${TagKey}	List
ListFlows	Grants permission to list existing prompt flows			List
ListFoundationModelAgreementOffers	Grants permission to get a list of foundation model agreement offers			List
ListFoundationModels	Grants permission to list Bedrock foundation models that you can use			List
ListGuardrails	Grants permission to list guardrails or its versions	guardrail	aws:ResourceTag/${TagKey}	List
ListImportedModels	Grants permission to get list of Bedrock imported models			List
ListInferenceProfiles	Grants permission to list inference profiles that you can use			List
ListIngestionJobs	Grants permission to list ingestion jobs in a data source	knowledge-base*	aws:ResourceTag/${TagKey}	List
ListInvocationSteps	Grants permission to get list of invocation step from a session	session*	aws:ResourceTag/${TagKey}	List
ListInvocations	Grants permission to list invocations in a session	session*	aws:ResourceTag/${TagKey}	List
ListKnowledgeBaseDocuments	Grants permission to list documents in a knowledge base	knowledge-base*	aws:ResourceTag/${TagKey}	List
ListKnowledgeBases	Grants permission to list existing knowledge bases			List
ListMarketplaceModelEndpoints	Grants permission to list marketplace model endpoints that you can use			Read
ListModelCopyJobs	Grants permission to get the list of model copy jobs that you have submitted			List
ListModelCustomizationJobs	Grants permission to get the list of model customization jobs that you have submitted			List
ListModelEvaluationJobs	Grants permission to get the list of model evaluation jobs that you have submitted			List
ListModelImportJobs	Grants permission to get list of model import jobs			List
ListModelInvocationJobs	Grants permission to list model invocation jobs that you created earlier			List
ListPromptRouters	Grants permission to list prompt routers that you can use			List
ListPrompts	Grants permission to list existing prompts	prompt	aws:ResourceTag/${TagKey}	List
ListProvisionedModelThroughputs	Grants permission to list provisioned model throughputs that you created earlier			List
ListSessions	Grants permission to list existing sessions			List
ListTagsForResource	Grants permission to list tags for a Bedrock resource	advanced-prompt-optimization-job*	aws:ResourceTag/${TagKey}	Read
		agent*	aws:ResourceTag/${TagKey}
		agent-alias*	aws:ResourceTag/${TagKey}
		application-inference-profile*	aws:ResourceTag/${TagKey}
		async-invoke*	aws:ResourceTag/${TagKey}
		automated-reasoning-policy*	aws:ResourceTag/${TagKey}
		automated-reasoning-policy-version*	aws:ResourceTag/${TagKey}
		blueprint*	aws:ResourceTag/${TagKey}
		blueprint-optimization-invocation*	aws:ResourceTag/${TagKey}
		custom-model*	aws:ResourceTag/${TagKey}
		custom-model-deployment*	aws:ResourceTag/${TagKey}
		data-automation-invocation-job*	aws:ResourceTag/${TagKey}
		data-automation-library*	aws:ResourceTag/${TagKey}
		data-automation-library-ingestion-job*	aws:ResourceTag/${TagKey}
		data-automation-project*	aws:ResourceTag/${TagKey}
		evaluation-job*	aws:ResourceTag/${TagKey}
		flow*	aws:ResourceTag/${TagKey}
		flow-alias*	aws:ResourceTag/${TagKey}
		guardrail*	aws:ResourceTag/${TagKey}
		imported-model*	aws:ResourceTag/${TagKey}
		knowledge-base*	aws:ResourceTag/${TagKey}
		model-copy-job*	aws:ResourceTag/${TagKey}
		model-customization-job*	aws:ResourceTag/${TagKey}
		model-evaluation-job*	aws:ResourceTag/${TagKey}
		model-import-job*	aws:ResourceTag/${TagKey}
		model-invocation-job*	aws:ResourceTag/${TagKey}
		prompt*	aws:ResourceTag/${TagKey}
		prompt-router*	aws:ResourceTag/${TagKey}
		prompt-version*	aws:ResourceTag/${TagKey}
		provisioned-model*	aws:ResourceTag/${TagKey}
		session*	aws:ResourceTag/${TagKey}
OptimizePrompt	Grants permission to optimize a prompt with user input			Read
PrepareAgent	Grants permission to prepare an existing agent to receive runtime requests	agent*	aws:ResourceTag/${TagKey}	Write
PrepareFlow	Grants permission to apply the latest changes made to a prompt flow, so that they are reflected at runtime	flow*	aws:ResourceTag/${TagKey}	Write
PutAccountDataRetention	Sets the account-wide data retention mode for Amazon Bedrock		bedrock:DataRetentionMode	Write
PutEnforcedGuardrailConfiguration	Grants permission to set account-level enforced guardrail configuration			Write
PutFoundationModelEntitlement	Grants permission to put entitlement to access a serverless foundation model. Do not use to restrict model access			Write
PutInvocationStep	Grants permission to put an invocation step into an invocation in session	session*	aws:ResourceTag/${TagKey}	Write
PutModelInvocationLoggingConfiguration	Grants permission to create an existing Invocation logging configuration			Write
PutUseCaseForModelAccess	Grants permission to put a use case for model access			Write
RegisterMarketplaceModelEndpoint	Grants permission to register a sagemaker endpoint as a marketplace model endpoint	bedrock-marketplace-model-endpoint*		Write
Rerank	Grants permission to rank documents based on user input			Write
Retrieve	Grants permission to retrieve ingested data from a knowledge base	knowledge-base*	aws:ResourceTag/${TagKey}	Read
RetrieveAndGenerate	Grants permission to send user input to perform retrieval and generation			Write
StartAutomatedReasoningPolicyBuildWorkflow	Grants permission to start a build workflow for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Write
StartAutomatedReasoningPolicyTestWorkflow	Grants permission to start a test workflow for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Write
StartFlowExecution	Grants permission to start an execution of a flow alias	flow*	aws:ResourceTag/${TagKey}	Write
StartFlowExecution	Grants permission to start an execution of a flow alias	flow-alias*	aws:ResourceTag/${TagKey}	Write
StartIngestionJob	Grants permission to start an ingestion job	knowledge-base*	aws:ResourceTag/${TagKey}	Write
StopAdvancedPromptOptimizationJob	Grants permission to stop an advanced prompt optimization job while in progress	advanced-prompt-optimization-job*	aws:ResourceTag/${TagKey}	Write
StopEvaluationJob	Grants permission to stop a evaluation job while in progress	evaluation-job*	aws:ResourceTag/${TagKey}	Write
StopFlowExecution	Grants permission to stop an execution of a flow alias	flow*	aws:ResourceTag/${TagKey}	Write
		flow-alias*	aws:ResourceTag/${TagKey}
		flow-execution*
StopIngestionJob	Grants permission to stop an ingestion job	knowledge-base*	aws:ResourceTag/${TagKey}	Write
StopModelCustomizationJob	Grants permission to stop a Bedrock model customization job while in progress	model-customization-job*	aws:ResourceTag/${TagKey}	Write
StopModelInvocationJob	Grants permission to stop a model invocation job that you started earlier	model-invocation-job*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to Tag a Bedrock resource	advanced-prompt-optimization-job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		agent	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		agent-alias	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		application-inference-profile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		async-invoke	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		automated-reasoning-policy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		automated-reasoning-policy-version	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		blueprint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		blueprint-optimization-invocation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		custom-model	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		custom-model-deployment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		data-automation-invocation-job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		data-automation-library	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		data-automation-library-ingestion-job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		data-automation-project	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		evaluation-job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		flow	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		flow-alias	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		guardrail	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		imported-model	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		knowledge-base	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		model-copy-job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		model-customization-job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		model-evaluation-job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		model-import-job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		model-invocation-job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		prompt	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		prompt-router	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		prompt-version	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		provisioned-model	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		session	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to Untag a Bedrock resource	advanced-prompt-optimization-job	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		agent	aws:ResourceTag/${TagKey} aws:TagKeys
		agent-alias	aws:ResourceTag/${TagKey} aws:TagKeys
		application-inference-profile	aws:ResourceTag/${TagKey} aws:TagKeys
		async-invoke	aws:ResourceTag/${TagKey} aws:TagKeys
		automated-reasoning-policy	aws:ResourceTag/${TagKey} aws:TagKeys
		automated-reasoning-policy-version	aws:ResourceTag/${TagKey} aws:TagKeys
		blueprint	aws:ResourceTag/${TagKey} aws:TagKeys
		blueprint-optimization-invocation	aws:ResourceTag/${TagKey} aws:TagKeys
		custom-model	aws:ResourceTag/${TagKey} aws:TagKeys
		custom-model-deployment	aws:ResourceTag/${TagKey} aws:TagKeys
		data-automation-invocation-job	aws:ResourceTag/${TagKey} aws:TagKeys
		data-automation-library	aws:ResourceTag/${TagKey} aws:TagKeys
		data-automation-library-ingestion-job	aws:ResourceTag/${TagKey} aws:TagKeys
		data-automation-project	aws:ResourceTag/${TagKey} aws:TagKeys
		evaluation-job	aws:ResourceTag/${TagKey} aws:TagKeys
		flow	aws:ResourceTag/${TagKey} aws:TagKeys
		flow-alias	aws:ResourceTag/${TagKey} aws:TagKeys
		guardrail	aws:ResourceTag/${TagKey} aws:TagKeys
		imported-model	aws:ResourceTag/${TagKey} aws:TagKeys
		knowledge-base	aws:ResourceTag/${TagKey} aws:TagKeys
		model-copy-job	aws:ResourceTag/${TagKey} aws:TagKeys
		model-customization-job	aws:ResourceTag/${TagKey} aws:TagKeys
		model-evaluation-job	aws:ResourceTag/${TagKey} aws:TagKeys
		model-import-job	aws:ResourceTag/${TagKey} aws:TagKeys
		model-invocation-job	aws:ResourceTag/${TagKey} aws:TagKeys
		prompt	aws:ResourceTag/${TagKey} aws:TagKeys
		prompt-router	aws:ResourceTag/${TagKey} aws:TagKeys
		prompt-version	aws:ResourceTag/${TagKey} aws:TagKeys
		provisioned-model	aws:ResourceTag/${TagKey} aws:TagKeys
		session	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAgent	Grants permission to update an existing agent	agent*	aws:ResourceTag/${TagKey}	Write
UpdateAgentActionGroup	Grants permission to update an existing action group	agent*	aws:ResourceTag/${TagKey}	Write
UpdateAgentAlias	Grants permission to update an existing alias	agent-alias*	aws:ResourceTag/${TagKey}	Write
UpdateAgentCollaborator	Grants permission to update an existing collaborator	agent*	aws:ResourceTag/${TagKey}	Write
UpdateAgentKnowledgeBase	Grants permission to update a knowledge base associated with an agent	agent*	aws:ResourceTag/${TagKey}	Write
UpdateAgentKnowledgeBase		knowledge-base*	aws:ResourceTag/${TagKey}	Write
UpdateAutomatedReasoningPolicy	Grants permission to update an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Write
UpdateAutomatedReasoningPolicyAnnotations	Grants permission to update annotations for a build workflow for an automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Write
UpdateAutomatedReasoningPolicyTestCase	Grants permission to update a test case for automated reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Write
UpdateBlueprint	Grants permission to update a blueprint for data automation	blueprint*	aws:ResourceTag/${TagKey}	Write
UpdateCustomModelDeployment	Grants permission to update an existing custom model deployment with a new custom model	custom-model*	aws:ResourceTag/${TagKey}	Write
UpdateCustomModelDeployment		custom-model-deployment*	aws:ResourceTag/${TagKey}	Write
UpdateDataAutomationLibrary	Grants permission to update a Data Automation Library	data-automation-library*	aws:ResourceTag/${TagKey}	Write
UpdateDataAutomationProject	Grants permission to update a data automation project	blueprint	aws:ResourceTag/${TagKey}	Write
		data-automation-project*	aws:ResourceTag/${TagKey}
		data-automation-project*	aws:ResourceTag/${TagKey}
UpdateDataSource	Grants permission to update a data source	knowledge-base*	aws:ResourceTag/${TagKey}	Write
UpdateFlow	Grants permission to update a prompt flow	flow*	aws:ResourceTag/${TagKey}	Write
UpdateFlowAlias	Grants permission to update the configuration of an alias of a prompt flow	flow-alias*	aws:ResourceTag/${TagKey}	Write
UpdateGuardrail	Grants permission to update a guardrail	automated-reasoning-policy	aws:ResourceTag/${TagKey}	Write
		automated-reasoning-policy-version	aws:ResourceTag/${TagKey}
		guardrail*	aws:ResourceTag/${TagKey}
		guardrail-profile
UpdateKnowledgeBase	Grants permission to update a knowledge base	knowledge-base*	aws:ResourceTag/${TagKey}	Write
UpdateMarketplaceModelEndpoint	Grants permission to update a marketplace model endpoint	bedrock-marketplace-model-endpoint*		Write
UpdatePrompt	Grants permission to update a prompt	prompt*	aws:ResourceTag/${TagKey}	Write
UpdateProvisionedModelThroughput	Grants permission to update a provisioned model throughput that you created earlier	custom-model*	aws:ResourceTag/${TagKey}	Write
		foundation-model*
		provisioned-model*	aws:ResourceTag/${TagKey}
UpdateSession	Grants permission to update an existing session	session*	aws:ResourceTag/${TagKey}	Write
ValidateFlowDefinition	Grants permission to validate prompt flow definitions			Read

Permission-only actions for Amazon Bedrock

The following actions are defined by Amazon Bedrock but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllowVendedLogDeliveryForResource	Grants permission to configure vended log delivery for a knowledge base	knowledge-base	aws:ResourceTag/${TagKey}	Permissions management, Write
AssociateThirdPartyKnowledgeBase	Grants permission to use 3rd party platform to store knowledge data		bedrock:ThirdPartyKnowledgeBaseCredentialsSecretArn	Write
DeleteResourcePolicy	Deletes a previously created Bedrock resource policy	custom-model	aws:ResourceTag/${TagKey}	Write
		guardrail	aws:ResourceTag/${TagKey}
		guardrail-profile
		knowledge-base	aws:ResourceTag/${TagKey}
GetBlueprintRecommendation	Grants permission to retrieve blueprint recommendation			Read
GetResourcePolicy	Gets the resource policy document for a Bedrock resource	custom-model	aws:ResourceTag/${TagKey}	Read
		guardrail	aws:ResourceTag/${TagKey}
		guardrail-profile
		knowledge-base	aws:ResourceTag/${TagKey}
InvokeAutomatedReasoningPolicy	Grants permission to invoke an Automated Reasoning policy	automated-reasoning-policy*	aws:ResourceTag/${TagKey}	Read
InvokeAutomatedReasoningPolicy	Grants permission to invoke an Automated Reasoning policy	automated-reasoning-policy-version*	aws:ResourceTag/${TagKey}	Read
InvokeBlueprintRecommendationAsync	Grants permission to invoke blueprint recommendations asynchronously	data-automation-profile*		Write
InvokeBuilder	Grants permission to use the conversational builder which aids in building supported bedrock resources			Write
PutResourcePolicy	Adds a resource policy for a Bedrock resource	custom-model	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		guardrail	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		guardrail-profile	aws:RequestTag/${TagKey} aws:TagKeys
		knowledge-base	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
RenderPrompt	Grants permission to render an existing prompt or its version	prompt*	aws:ResourceTag/${TagKey}	Read
RenderPrompt		prompt-version*	aws:ResourceTag/${TagKey}	Read

Resource types defined by Amazon Bedrock

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
advanced-prompt-optimization-job	arn:${Partition}:bedrock:${Region}:${Account}:advanced-prompt-optimization-job/${ResourceId}	aws:ResourceTag/${TagKey}
agent	arn:${Partition}:bedrock:${Region}:${Account}:agent/${AgentId}	aws:ResourceTag/${TagKey}
agent-alias	arn:${Partition}:bedrock:${Region}:${Account}:agent-alias/${AgentId}/${AgentAliasId}	aws:ResourceTag/${TagKey}
application-inference-profile	arn:${Partition}:bedrock:${Region}:${Account}:application-inference-profile/${ResourceId}	aws:ResourceTag/${TagKey}
async-invoke	arn:${Partition}:bedrock:${Region}:${Account}:async-invoke/${ResourceId}	aws:ResourceTag/${TagKey}
automated-reasoning-policy	arn:${Partition}:bedrock:${Region}:${Account}:automated-reasoning-policy/${AutomatedReasoningPolicyId}	aws:ResourceTag/${TagKey}
automated-reasoning-policy-version	arn:${Partition}:bedrock:${Region}:${Account}:automated-reasoning-policy/${AutomatedReasoningPolicyId}:${AutomatedReasoningPolicyVersion}	aws:ResourceTag/${TagKey}
bedrock-marketplace-model-endpoint	arn:${Partition}:bedrock:${Region}:${Account}:marketplace/model-endpoint/all-access
blueprint	arn:${Partition}:bedrock:${Region}:${Account}:blueprint/${BlueprintId}	aws:ResourceTag/${TagKey}
blueprint-optimization-invocation	arn:${Partition}:bedrock:${Region}:${Account}:blueprint-optimization-invocation/${ResourceId}	aws:ResourceTag/${TagKey}
custom-model	arn:${Partition}:bedrock:${Region}:${Account}:custom-model/${ResourceId}	aws:ResourceTag/${TagKey}
custom-model-deployment	arn:${Partition}:bedrock:${Region}:${Account}:custom-model-deployment/${ResourceId}	aws:ResourceTag/${TagKey}
data-automation-invocation-job	arn:${Partition}:bedrock:${Region}:${Account}:data-automation-invocation/${JobId}	aws:ResourceTag/${TagKey}
data-automation-library	arn:${Partition}:bedrock:${Region}:${Account}:data-automation-library/${DataAutomationLibraryId}	aws:ResourceTag/${TagKey}
data-automation-library-ingestion-job	arn:${Partition}:bedrock:${Region}:${Account}:data-automation-library-ingestion-job/${IngestionJobId}	aws:ResourceTag/${TagKey}
data-automation-profile	arn:${Partition}:bedrock:${Region}:${Account}:data-automation-profile/${ProfileId}
data-automation-project	arn:${Partition}:bedrock:${Region}:${Account}:data-automation-project/${ProjectId}	aws:ResourceTag/${TagKey}
default-prompt-router	arn:${Partition}:bedrock:${Region}:${Account}:default-prompt-router/${ResourceId}
evaluation-job	arn:${Partition}:bedrock:${Region}:${Account}:evaluation-job/${ResourceId}	aws:ResourceTag/${TagKey}
flow	arn:${Partition}:bedrock:${Region}:${Account}:flow/${FlowId}	aws:ResourceTag/${TagKey}
flow-alias	arn:${Partition}:bedrock:${Region}:${Account}:flow/${FlowId}/alias/${FlowAliasId}	aws:ResourceTag/${TagKey}
flow-execution	arn:${Partition}:bedrock:${Region}:${Account}:flow/${FlowId}/alias/${FlowAliasId}/execution/${FlowExecutionId}
foundation-model	arn:${Partition}:bedrock:${Region}::foundation-model/${ResourceId}
guardrail	arn:${Partition}:bedrock:${Region}:${Account}:guardrail/${GuardrailId}	aws:ResourceTag/${TagKey}
guardrail-profile	arn:${Partition}:bedrock:${Region}:${Account}:guardrail-profile/${ResourceId}
imported-model	arn:${Partition}:bedrock:${Region}:${Account}:imported-model/${ResourceId}	aws:ResourceTag/${TagKey}
inference-profile	arn:${Partition}:bedrock:${Region}:${Account}:inference-profile/${ResourceId}
knowledge-base	arn:${Partition}:bedrock:${Region}:${Account}:knowledge-base/${KnowledgeBaseId}	aws:ResourceTag/${TagKey}
model-copy-job	arn:${Partition}:bedrock:${Region}:${Account}:model-copy-job/${ResourceId}	aws:ResourceTag/${TagKey}
model-customization-job	arn:${Partition}:bedrock:${Region}:${Account}:model-customization-job/${ResourceId}	aws:ResourceTag/${TagKey}
model-evaluation-job	arn:${Partition}:bedrock:${Region}:${Account}:model-evaluation-job/${ResourceId}	aws:ResourceTag/${TagKey}
model-import-job	arn:${Partition}:bedrock:${Region}:${Account}:model-import-job/${ResourceId}	aws:ResourceTag/${TagKey}
model-invocation-job	arn:${Partition}:bedrock:${Region}:${Account}:model-invocation-job/${JobIdentifier}	aws:ResourceTag/${TagKey}
prompt	arn:${Partition}:bedrock:${Region}:${Account}:prompt/${PromptId}	aws:ResourceTag/${TagKey}
prompt-router	arn:${Partition}:bedrock:${Region}:${Account}:prompt-router/${ResourceId}	aws:ResourceTag/${TagKey}
prompt-version	arn:${Partition}:bedrock:${Region}:${Account}:prompt/${PromptId}:${PromptVersion}	aws:ResourceTag/${TagKey}
provisioned-model	arn:${Partition}:bedrock:${Region}:${Account}:provisioned-model/${ResourceId}	aws:ResourceTag/${TagKey}
session	arn:${Partition}:bedrock:${Region}:${Account}:session/${SessionId}	aws:ResourceTag/${TagKey}
system-tool	arn:${Partition}:bedrock::${Account}:system-tool/${ResourceId}

Condition keys for Amazon Bedrock

Amazon Bedrock defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by creating requests based on the allowed set of values for each of the mandatory tags	String
aws:ResourceTag/${TagKey}	Filters access by having actions based on the tag value associated with the resource	String
aws:TagKeys	Filters access by creating requests based on the presence of mandatory tags in the request	ArrayOfString
bedrock:BearerTokenType	Filters access by the Short-term or Long-term bearer tokens	String
bedrock:DataRetentionMode	Filters access by the specified Data Retention Mode	String
bedrock:GuardrailIdentifier	Filters access by the GuardrailIdentifier containing the GuardrailArn or the GuardrailArn:NumericVersion	ARN
bedrock:InferenceProfileArn	Filters access by the specified inference profile	ARN
bedrock:InlineAgentName	Filters access by the Inline Agent Names, this will be used in InvokeInlineAgent API names	String
bedrock:PromptRouterArn	Filters access by the specified prompt router	ARN
bedrock:ServiceTier	Filters access by the specified ServiceTier	String
bedrock:ThirdPartyKnowledgeBaseCredentialsSecretArn	Filters access by the secretArn containing the credentials of the third party platform	ARN

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Aurora DSQL (dsql)

Amazon Bedrock Agentcore (bedrock-agentcore)