Question

A financial services company runs a multi-account AWS Organization. A data science team in a sandbox account must be allowed to invoke ONLY Anthropic Claude 3 Haiku in Amazon Bedrock, while all other foundation models must be blocked organization-wide for that account regardless of any permissive IAM policies the team creates. The security team wants a governance control that cannot be overridden by account administrators. Which approach BEST enforces this requirement?

Accepted Answer

Attach a Service Control Policy (SCP) to the sandbox account's OU that denies bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream for all foundation model ARNs except the Claude 3 Haiku model ARN

Answer

Create an IAM permissions boundary in the sandbox account that allows only the Claude 3 Haiku model ARN and attach it to all IAM roles

Answer

Configure a Bedrock guardrail with denied topics that block prompts intended for models other than Claude 3 Haiku

Answer

Use an identity-based IAM policy on the data science team's role that allows bedrock:InvokeModel only on the Claude 3 Haiku model ARN