Question

A security team manages a 60-account AWS Organization using SCPs. To enforce a strict governance model, they replaced the default FullAWSAccess policy on the root and all OUs with a custom allow-list SCP that explicitly permits only the services currently approved (e.g., ec2, s3, rds, lambda, cloudwatch). A development team now reports that they cannot use Amazon Bedrock in their sandbox account, even though their IAM roles grant full Bedrock permissions and there is no explicit deny anywhere. What is the most likely cause and the correct remediation?

Accepted Answer

The allow-list SCP does not include the bedrock service actions, so the permission is implicitly denied; add bedrock actions to the allow-list SCP applied to the relevant OU or account.

Answer

SCPs cannot control access to newer services like Bedrock; the team must use a permission boundary on the IAM roles instead to allow Bedrock.

Answer

The account is missing the FullAWSAccess SCP which is required in addition to custom SCPs; re-attach FullAWSAccess to restore access.

Answer

The IAM role's trust policy must be updated to include the bedrock.amazonaws.com service principal before Bedrock can be invoked.