Question

A financial services company runs a customer-facing chatbot on Amazon Bedrock. Compliance requires that the application's IAM role be able to invoke ONLY the Anthropic Claude 3 Sonnet model and no other foundation models, even as new models become available in the account. Which approach enforces this requirement following least-privilege principles?

Accepted Answer

Attach an IAM policy that allows bedrock:InvokeModel and scopes the Resource to the specific model ARN for Claude 3 Sonnet.

Answer

Attach an IAM policy allowing bedrock:InvokeModel on Resource "*" and rely on Bedrock model access settings in the console to block other models.

Answer

Grant the role the AmazonBedrockFullAccess managed policy and add a Guardrail that denies topics unrelated to the approved model.

Answer

Attach a policy allowing bedrock:InvokeModel with a condition key bedrock:ModelId set to all Claude model families.