{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"c31b77ee7d674dcc7c06e69b2ba569be9b26c99f6a6e2e5124608e97fd6a937e","entry":{"id":"aws/bedrock-model-access","name":"Amazon Bedrock - model access and API keys","vendor":"Amazon Web Services","summary":"In commercial Regions most Bedrock models switch on automatically the first time you call them, provided the calling identity has AWS Marketplace subscribe permissions and the account has a valid payment method. Anthropic models also need a one-time first-time-use (use case) form. Optionally generate a Bedrock API key.","aliases":["bedrock","amazon-bedrock","bedrock-claude"],"category":"ai","group":"B","homepage":"https://aws.amazon.com/bedrock/","docs":["https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html","https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"model-access","url":"https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html","title":"Request access to models - Amazon Bedrock User Guide","accessed":"2026-10-25","supports":"Access enabled by default on first invocation in commercial Regions; Model access page only for GovCloud; prerequisites (aws-marketplace:Subscribe/Unsubscribe/ViewSubscriptions, Anthropic First Time Use form, valid payment method); setup up to 15 minutes, up to 2 minutes after fixing permissions; FTU needs a use-case description and website URL (portfolio/GitHub acceptable for individuals); FTU once per account or org management account, again in opt-in Regions; agreement can be PENDING with AccessDeniedException until AVAILABLE, email sent when done; GetFoundationModelAvailability; invoking a 3P model accepts its EULA; some models need extra access via AWS Sales; deny bedrock:InvokeModel to block access.","kind":"official"},{"id":"api-keys","url":"https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html","title":"API keys - Amazon Bedrock User Guide","accessed":"2026-10-25","supports":"Short-term keys (up to 12 hours, recommended for production) and long-term keys (creates an IAM user, exploration only, Region-bound); AWS_BEARER_TOKEN_BEDROCK; deactivate/reset/delete compromised keys; limit key age with iam:ServiceSpecificCredentialAgeDays.","kind":"official"},{"id":"tp-licenses","url":"https://aws.amazon.com/legal/bedrock/third-party-models/","title":"Amazon Bedrock Serverless Third-Party Model License Agreements","accessed":"2026-10-25","supports":"Third-party model EULAs that apply on first use (linked from the model access page; not read in full).","kind":"official"}],"allowed_domains":["aws.amazon.com"],"account_model":{"summary":"Model access is decided per AWS account (accounts in one AWS Organization can differ). The Anthropic use-case form is filed once per account, or once at the Organization's management account and inherited by member accounts."},"prerequisites":[{"entry":"aws/account-and-iam","note":"An activated AWS account with a valid payment method and a non-root identity."}],"have_ready":[{"kind":"payment_card","description":"A valid payment method on the AWS account that can be used for AWS Marketplace purchases.","needed_for":["first-invoke"],"auto_check":"none","source":"model-access"},{"kind":"live_website","description":"A company website for the Anthropic use-case form (individuals may give a portfolio, GitHub profile or project URL).","needed_for":["anthropic-ftu"],"auto_check":"website_live","source":"model-access"},{"kind":"other","description":"Company name, industry, whether users are internal or external, and a description of the use case (up to 8,192 characters).","needed_for":["anthropic-ftu"],"auto_check":"none","source":"model-access"}],"steps":[{"id":"choose-region","title":"Choose a Region where the model is offered","summary":"Check the model card for supported Regions; long-term API keys and some access settings are Region-bound.","route":"guided","depends_on":[],"gate":"none","sources":["model-access","api-keys"]},{"id":"marketplace-permissions","title":"Give the calling identity AWS Marketplace permissions","summary":"Attach a policy allowing aws-marketplace:Subscribe, Unsubscribe and ViewSubscriptions (or AmazonBedrockFullAccess) to the role or user that will make the first call. Only needed the first time a model is used in the account.","route":"api","depends_on":["choose-region"],"gate":"none","sources":["model-access"]},{"id":"anthropic-ftu","title":"Submit the Anthropic first-time-use form (Anthropic models only)","summary":"Open an Anthropic model in the Model catalog (or the Anthropic provider page) and fill in the use-case form, or call PutUseCaseForModelAccess. You submit it yourself. Skip if the Organization's management account already did.","route":"copilot","depends_on":["marketplace-permissions"],"gate":"human_submit","url":"https://console.aws.amazon.com/bedrock/home#/providers/anthropic","lead_time":{"official":{"text":"In most cases access is granted as soon as the form is submitted, but the agreement can sit in PENDING; AWS emails when it is set up.","source":"model-access"}},"fields":[{"label":"Company name","from_profile":"legal_name"},{"label":"Company website","from_profile":"website"}],"preflight":["website_live"],"recovery":[{"hiccup":"AccessDeniedException right after submitting the form.","fix":"Call GetFoundationModelAvailability and wait for agreementAvailability AVAILABLE (PENDING means still being set up).","source":"model-access"},{"hiccup":"Works in one Region but not in an opt-in Region.","fix":"The form must be filled again in opt-in Regions.","source":"model-access"}],"optional":true},{"id":"first-invoke","title":"Make the first call to the model","summary":"Open the model in the playground or call InvokeModel/Converse. Bedrock starts the Marketplace subscription in the background. By using a third-party model for the first time you accept its EULA.","route":"api","depends_on":["marketplace-permissions"],"gate":"human_terms","lead_time":{"official":{"text":"Subscription setup takes up to 15 minutes; after fixing missing permissions allow up to 2 minutes.","source":"model-access"}},"recovery":[{"hiccup":"AccessDeniedException on first call.","fix":"Check the identity has the aws-marketplace permissions, the account has a valid payment method, the Anthropic form is done (for Claude), and any IAM condition (e.g. aws:SourceIp) is satisfied by the calling host.","source":"model-access"},{"hiccup":"All prerequisites met and the model is in the Region, but still AccessDeniedException.","fix":"Some models need extra account-level access; contact AWS Sales.","source":"model-access"}]},{"id":"api-key","title":"Generate a Bedrock API key (optional)","summary":"In Bedrock > API keys, generate a short-term key (up to 12 hours, recommended) or a long-term key with an expiry (exploration only; it creates an IAM user). verapli captures it into your env file as AWS_BEARER_TOKEN_BEDROCK.","route":"copilot","depends_on":["first-invoke"],"gate":"human_submit","url":"https://console.aws.amazon.com/bedrock/","recovery":[{"hiccup":"Error: Credential should be scoped to a valid region.","fix":"Long-term keys only work in the Region they were made in; switch Region in the console and generate one there.","source":"api-keys"}],"capture":{"env":"AWS_BEARER_TOKEN_BEDROCK","kind":"api_key"},"optional":true}],"outputs":[{"name":"AWS_BEARER_TOKEN_BEDROCK","description":"Bedrock API key sent as a bearer token.","secret":true,"example_format":"opaque bearer token","from_step":"api-key"},{"name":"BEDROCK_MODEL_ID","description":"Model or inference profile id to call.","secret":false,"example_format":"us.anthropic.claude-…"}],"terms_notes":[{"kind":"rules_say","severity":"amber","title":"First call accepts the model EULA","text":"Invoking a third-party model for the first time counts as agreeing to its End User License Agreement. To review first, block bedrock:InvokeModel with IAM/SCP and allow it after review. Plain-English summary, not legal advice.","source":"model-access"},{"kind":"rules_say","severity":"yellow","text":"Denying aws-marketplace:Subscribe alone does not stop the first invocation; deny bedrock:InvokeModel to block a model.","source":"model-access"},{"kind":"rules_say","severity":"amber","text":"Long-term Bedrock API keys are meant for exploration only; use short-term keys in production and limit key age.","source":"api-keys"}],"stripe_projects":false,"api_provisioning":{"available":"yes","notes":"ListFoundationModelAgreementOffers, PutUseCaseForModelAccess, CreateFoundationModelAgreement and GetFoundationModelAvailability manage access by API (AWS CLI 2.27.42 or later); keys via the token generator or iam create-service-specific-credential.","docs":["https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html","https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html"],"source":"model-access"},"detect":{"env_names":["AWS_BEARER_TOKEN_BEDROCK"],"packages":["@aws-sdk/client-bedrock-runtime","@anthropic-ai/bedrock-sdk"]}}}