Amazon Bedrock MAP Tagging using the AWS CLI

Must have AWS Migration Program Engagement number (MPE ID number), also known as your project number, in your Migration Plan.

Enable IAM principal cost allocation tags in your AWS Billing and Cost Management console. For more information, see IAM principal cost allocation tags in the AWS Billing User Guide.

Activate the map-migrated tag as a cost allocation tag (CAT) in the Billing console under Cost allocation tags. Cost allocation tags are available for both resource tags and IAM principal tags.

Your role must have permission to tag IAM roles. If your role has the IAMFullAccess AWS-managed policy attached, you can skip this step. Otherwise, ensure your role has the iam:TagRole and iam:ListRoleTags permissions.

Identify the IAM role used for your Bedrock API calls. This is the role assumed by your application or service when invoking Bedrock models.

Use the AWS CLI to apply the map-migrated tag to the role:

$ aws iam tag-role --role-name MyBedrockRole --tags "Key=map-migrated,Value=migYOUR_MPE_ID"

Replace MyBedrockRole with the name of your IAM role and YOUR_MPE_ID with your MPE ID.

Verify the tag was applied correctly:

$ aws iam list-role-tags --role-name MyBedrockRole

The output should show the map-migrated tag:

{
  "Tags": [
    {
      "Key": "map-migrated",
      "Value": "mig123456789"
    }
  ]
}

Must have AWS Migration Program Engagement number (MPE ID number), also known as your project number, in your Migration Plan.

Customers must gain access to supported foundation models only by using the Amazon Bedrock Console or API.

If using volume-based discounts (such as Provisioned Throughput for supported foundation models), these must be purchased only using the Amazon Bedrock Console or API.

Your role must have access to the inference profile API actions. If your role has the AmazonBedrockFullAccess AWS-managed policy attached, you can skip this step. Otherwise, follow the steps at Creating IAM policies and create the following policy, which allows a role to do inference profile-related actions and run model inference using all foundation models and inference profiles.

{
  "Version": "2012-10-17", 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel*",
        "bedrock:CreateInferenceProfile"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/*",
        "arn:aws:bedrock:*:*:inference-profile/*",
        "arn:aws:bedrock:*:*:application-inference-profile/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:GetInferenceProfile",
        "bedrock:ListInferenceProfiles",
        "bedrock:DeleteInferenceProfile",
        "bedrock:TagResource",
        "bedrock:UntagResource",
        "bedrock:ListTagsForResource"
      ],
      "Resource": [
        "arn:aws:bedrock:*:*:inference-profile/*",
        "arn:aws:bedrock:*:*:application-inference-profile/*"
      ]
    }
  ]
}

Download and install the latest version of the AWS CLI.

Create the application inference profile with specific parameters.

Create an application inference profile: Open a new terminal on a machine that has the AWS CLI installed and configured and run the following CLI command:

$ aws bedrock create-inference-profile \
  --inference-profile-name "myappinferenceprofile" \
  --model-source "copyFrom=arn:aws:bedrock:us-east-1:123456789123:inference-profile/us.amazon.nova-pro-v1:0"

Enter a new name for the application inference profile and define a model source. The profile is created using a copy of the system inference profile using the "copyFrom" parameter. In this case I am using the Amazon Nova Pro system inference profile using its ARN. The model source is composed using the format:

arn:aws:bedrock:region:accountID:inference-profile/inferenceProfileId

Replace the placeholders for your selected region where the new application inference profile will be created in and add your account ID. Select your preferred system inference profile ID from the list of available system inference profiles. The CLI output shows the created inference profile ARN and status as active.

{
"inferenceProfileArn": "arn:aws:bedrock:us-east-1:123456789123:application-inference-profile/k1c3lwu20lem",
"status": "ACTIVE"
}

The inferenceProfileArn that can be used in other inference profile-related actions and that can be used with model invocation and Amazon Bedrock resources.

Once the profile is created, obtain its ARN and use it to apply the "map-migrated" tag to it. This is done using the AWS tagging API.

Use the bedrock tag-resource CLI command to tag the created inference profile with the map-migrated tag and the value of your MAP ID following the tagging guidelines.

$ aws bedrock tag-resource --resource-arn "arn:aws:bedrock:us-east-1:123456789123:application-inference-profile/k1c3lwu20lem" --tags "key=map-migrated,value=mig123456789"

For the –resource-arn, Use the generated ARN from previous step. Add the -–tags parameter using the key value pair as shown above replace the value to your corresponding MAP ID with the prefix of "mig".

You can list and update inference profiles and their review their tags. To confirm that the application inference profile is correctly tagged, you can list application profiles using the following CLI command:

$ aws bedrock list-inference-profiles --type-equals "APPLICATION"

This will list all application inference profiles showing the ARN, profile name and ID for each.

{
  "inferenceProfileSummaries": [
    {
      "inferenceProfileName": "myappinferenceprofile",
      "createdAt": "2025-01-14T21:21:54.414544+00:00",
      "updatedAt": "2025-01-14T21:21:54.414544+00:00",
      "inferenceProfileArn": "arn:aws:bedrock:us-east-1:123456789123:application-inference-profile/k1c3lwu20lem",
      "models": [
        {
          "modelArn": "arn:aws:bedrock:us-east-1::foundation-model/amazon.nova-pro-v1:0"
        },
        {
          "modelArn": "arn:aws:bedrock:us-west-2::foundation-model/amazon.nova-pro-v1:0"
        },
        {
          "modelArn": "arn:aws:bedrock:us-east-2::foundation-model/amazon.nova-pro-v1:0"
        }
      ],
      "inferenceProfileId": "k1c3lwu20lem",
      "status": "ACTIVE",
      "type": "APPLICATION"
    }
  ]
}

If you know the inference Profile ID you can get the specific profile details using the CLI command:

$ aws bedrock get-inference-profile --inference-profile-identifier "k1c3lwu20lem"

{
  "inferenceProfileName": "myappinferenceprofile",
  "createdAt": "2025-01-14T21:21:54.414544+00:00",
  "updatedAt": "2025-01-14T21:21:54.414544+00:00",
  "inferenceProfileArn": "arn:aws:bedrock:us-east-1:123456789123:application-inference-profile/k1c3lwu20lem",
  "models": [
    {
      "modelArn": "arn:aws:bedrock:us-east-1::foundation-model/amazon.nova-pro-v1:0"
    },
    {
      "modelArn": "arn:aws:bedrock:us-west-2::foundation-model/amazon.nova-pro-v1:0"
    },
    {
      "modelArn": "arn:aws:bedrock:us-east-2::foundation-model/amazon.nova-pro-v1:0"
    }
  ],
  "inferenceProfileId": "k1c3lwu20lem",
  "status": "ACTIVE",
  "type": "APPLICATION"
}

Using the ARN of the corresponding profile, use the following CLI command to list the resource tags:

$ aws bedrock list-tags-for-resource \
  --resource-arn "arn:aws:bedrock:us-east-1:123456789123:application-inference-profile/k1c3lwu20lem"

The output will list tags associated with the profile.

{
  "tags": [
    {
      "key": "map-migrated",
      "value": "mig123456789"
    }
  ]
}