Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Bedrock Powered by AWS Mantle

Amazon Bedrock Powered by AWS Mantle (service prefix: bedrock-mantle) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

Actions defined by Amazon Bedrock Powered by AWS Mantle
Permission-only actions for Amazon Bedrock Powered by AWS Mantle
Resource types defined by Amazon Bedrock Powered by AWS Mantle
Condition keys for Amazon Bedrock Powered by AWS Mantle

Actions defined by Amazon Bedrock Powered by AWS Mantle

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ArchiveProject	Grants permission to archive a specific project	project*	aws:ResourceTag/${TagKey}	Write
AssociateCustomizedModel	Grants permission to associate a customized model with a project	customized-model*	aws:ResourceTag/${TagKey} bedrock-mantle:CustomizedModelArn bedrock-mantle:ProjectArn	Write
AssociateCustomizedModel		project*	aws:ResourceTag/${TagKey} bedrock-mantle:CustomizedModelArn bedrock-mantle:ProjectArn	Write
CancelFineTuningJob	Grants permission to cancel an in-progress fine tuning job	project*	aws:ResourceTag/${TagKey} bedrock-mantle:FineTuningJob	Write
CancelInference	Grants permission to cancel an in-progress inference request	project*	aws:ResourceTag/${TagKey}	Write
CreateCustomizedModel	Grants permission to import a customized model with custom weights	customized-model*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFile	Grants permission to create a file in a project	project*	aws:ResourceTag/${TagKey}	Write
CreateFineTuningJob	Grants permission to create a fine tuning job	project*	aws:ResourceTag/${TagKey} bedrock-mantle:Files bedrock-mantle:Model	Write
CreateInference	Grants permission to create a chat completion inference request	project*	aws:ResourceTag/${TagKey} bedrock-mantle:Model bedrock-mantle:ServiceTier	Write
CreateProject	Grants permission to create a project	project*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys bedrock-mantle:DataRetentionMode	Write
CreateReservation	Grants permission to create a capacity reservation for a model	project*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys bedrock-mantle:ProjectArn bedrock-mantle:ReservationArn	Write
CreateReservation		reservation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys bedrock-mantle:ProjectArn bedrock-mantle:ReservationArn	Write
DeleteCustomizedModel	Grants permission to delete a customized model	customized-model*	aws:ResourceTag/${TagKey}	Write
DeleteFile	Grants permission to delete a specific file	project*	aws:ResourceTag/${TagKey} bedrock-mantle:Files	Write
DeleteInference	Grants permission to delete a specific inference request	project*	aws:ResourceTag/${TagKey}	Write
DeleteReservation	Grants permission to delete a capacity reservation	project*	aws:ResourceTag/${TagKey} bedrock-mantle:ProjectArn bedrock-mantle:ReservationArn	Write
DeleteReservation	Grants permission to delete a capacity reservation	reservation*	aws:ResourceTag/${TagKey} bedrock-mantle:ProjectArn bedrock-mantle:ReservationArn	Write
DisassociateCustomizedModel	Grants permission to disassociate a customized model from a project	customized-model*	aws:ResourceTag/${TagKey} bedrock-mantle:CustomizedModelArn bedrock-mantle:ProjectArn	Write
DisassociateCustomizedModel		project*	aws:ResourceTag/${TagKey} bedrock-mantle:CustomizedModelArn bedrock-mantle:ProjectArn	Write
GetAccountDataRetention	Grants permission to retrieve the account-wide data retention setting			Read
GetCustomizedModel	Grants permission to get customized model	customized-model*	aws:ResourceTag/${TagKey}	Read
GetFile	Grants permission to retrieve information about a specific file	project*	aws:ResourceTag/${TagKey} bedrock-mantle:Files	Read
GetFineTuningJob	Grants permission to retrieve details of a specific fine tuning job	project*	aws:ResourceTag/${TagKey} bedrock-mantle:FineTuningJob	Read
GetInference	Grants permission to retrieve details of a specific inference request	project*	aws:ResourceTag/${TagKey}	Read
GetModel	Grants permission to retrieve information about a specific model	project*	aws:ResourceTag/${TagKey}	Read
GetProject	Grants permission to retrieve details of a specific project	project*	aws:ResourceTag/${TagKey}	Read
GetReservation	Grants permission to get reservation	reservation*	aws:ResourceTag/${TagKey}	Read
ListCustomizedModelAssociations	Grants permission to list project associations for a customized model	customized-model*	aws:ResourceTag/${TagKey}	List
ListCustomizedModels	Grants permission to list customized models	customized-model*	aws:ResourceTag/${TagKey}	List
ListFiles	Grants permission to list all available files in a project	project*	aws:ResourceTag/${TagKey}	List
ListFineTuningJobs	Grants permission to list all available fine tuning jobs in a project	project*	aws:ResourceTag/${TagKey}	List
ListModels	Grants permission to list all available models in a project	project*	aws:ResourceTag/${TagKey}	List
ListProjects	Grants permission to list projects	project*	aws:ResourceTag/${TagKey}	List
ListReservations	Grants permission to list reservations	reservation*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for a resource	customized-model	aws:ResourceTag/${TagKey}	Read
		project	aws:ResourceTag/${TagKey}
		reservation	aws:ResourceTag/${TagKey}
PutAccountDataRetention	Grants permission to set the account-wide data retention setting		bedrock-mantle:DataRetentionMode	Write
TagResource	Grants permission to tag a resource	customized-model	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		project	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		reservation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a resource	customized-model	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		project	aws:ResourceTag/${TagKey} aws:TagKeys
		reservation	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateProject	Grants permission to update a specific project	project*	aws:ResourceTag/${TagKey} bedrock-mantle:DataRetentionMode	Write
UpdateReservation	Grants permission to update reservation	project*	aws:ResourceTag/${TagKey} bedrock-mantle:ProjectArn bedrock-mantle:ReservationArn	Write
UpdateReservation	Grants permission to update reservation	reservation*	aws:ResourceTag/${TagKey} bedrock-mantle:ProjectArn bedrock-mantle:ReservationArn	Write

Permission-only actions for Amazon Bedrock Powered by AWS Mantle

The following actions are defined by Amazon Bedrock Powered by AWS Mantle but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CallWithBearerToken	Grants permission to make API calls using bearer token authentication		bedrock-mantle:BearerTokenType	List

Resource types defined by Amazon Bedrock Powered by AWS Mantle

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
customized-model	arn:${Partition}:bedrock-mantle:${Region}:${Account}:customized-model/${ResourceId}	aws:ResourceTag/${TagKey}
project	arn:${Partition}:bedrock-mantle:${Region}:${Account}:project/${ResourceId}	aws:ResourceTag/${TagKey}
reservation	arn:${Partition}:bedrock-mantle:${Region}:${Account}:reservation/${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Bedrock Powered by AWS Mantle

Amazon Bedrock Powered by AWS Mantle defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
bedrock-mantle:BearerTokenType	Filters access by the Short-term or Long-term bearer tokens	String
bedrock-mantle:CustomizedModelArn	Filters access by the ARN of the customized model being associated or referenced in cross-resource operations	String
bedrock-mantle:DataRetentionMode	Filters access by the data retention mode being set on a project or account	String
bedrock-mantle:Files	Filters access by the specified file identifiers	ArrayOfString
bedrock-mantle:FineTuningJob	Filters access by the specified fine-tuning job identifier	String
bedrock-mantle:Model	Filters access by the specified Model	String
bedrock-mantle:ProjectArn	Filters access by the ARN of the project being associated or referenced in cross-resource operations	String
bedrock-mantle:ReservationArn	Filters access by the ARN of the reservation being referenced in cross-resource operations	String
bedrock-mantle:ServiceTier	Filters access by the specified ServiceTier	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Bedrock Agentcore (bedrock-agentcore)

Amazon Bio Discovery (researchstudio)