bedrock

bedrockAka

aws-bedrock

A read-only policy generated by Guardrails that lists the APIs that&#92;nshould be added to the guardrails-managed (hard) boundary policy,&#92;nthereby enabling them to be assigned to users and roles.&#92;nThis value will change depending on the value of the value of the&#92;n`AWS &gt; Bedrock &gt; Permissions &gt; Lockdown &gt; API Boundary` policy&#92;n

AWS > Turbot > Permissions > Compiled > API Boundary

AWS > Account

AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-bedrock

A calculated policy that Guardrails uses to create a compiled list of ALL permissions for AWS Bedrock&#92;nthat is used as input to the control that manages the IAM stack.&#92;n

AWS > Turbot > Permissions > Compiled > Service Permissions

AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-bedrock

A calculated policy that Guardrails uses to create a compiled list of ALL permissions for AWS Bedrock&#92;nthat is used as input to the stack that manages the Guardrails IAM permissions objects.&#92;n

AWS > Turbot > Permissions > Compiled > Levels

AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-bedrock

Configure whether the AWS Bedrock API is enabled.&#92;n&#92;n**Note:** Disabling the service disables the API for ALL users and roles, and Guardrails will have no access to the API.&#92;n

AWS > Bedrock

AWS > Bedrock > API Enabled

A list of AWS regions in which AWS Bedrock resources are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all AWS Bedrock resources&#39; Approved &gt; Regions policies.&#92;n

AWS > Bedrock > Approved Regions [Default]

Configure whether the AWS Bedrock service is enabled.&#92;nThis will only affect Guardrails managed User Roles and will allow the Guardrails managed user to access AWS Bedrock service.&#92;n  - `Enabled` policy allows Guardrails managed users to perform all the actions for the service&#92;n  - `Enabled: Metadata Only` policy allows Guardrails managed users to perform only the metadata level actions for the service (like `describe*`, `list*`)&#92;n&#92;n**Note:**&#92;n  - `Disabled` policy disables the service but does NOT disable the API for Guardrails or SuperUsers&#92;n  - All the resource data stored in the Guardrails CMDB is considered to be metadata&#92;n  - For more information related to permissions and grant levels, please check the [documentation](https://turbot.com/guardrails/docs/concepts/iam/permissions)&#92;n

AWS > Bedrock > Enabled

AWS > Bedrock > Permissions > Levels

AWS > Bedrock > Permissions > Lockdown

Configure whether permissions policies are in effect for AWS Bedrock.&#92;n&#92;nThis setting does not affect account level permissions (AWS/Admin, AWS/Owner, etc)&#92;n&#92;n**Note:** The behavior of this policy depends on the value of AWS &gt; Permissions.&#92;n

AWS > Bedrock > Permissions

AWS > Bedrock > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to an AWS account.&#92;nPermissions levels defined will appear in the UI to assign access to Guardrails users.&#92;nThis policy provides a default for Permissions &gt; Levels in each service,&#92;nhowever you can explicitly override the setting for each service if desired&#92;n

A map of AWS API to Guardrails Permission Level used to customize Guardrails&#39; standard permissions.&#92;nYou can add, remove or redefine the mapping of AWS API operations to Guardrails permissions levels here.&#92;n&#92;n**Note:** Modifiers are cumulative - if you add a permission to the Metadata level, it is also added to ReadOnly, Operator and Admin.&#92;nModifier policies set here apply ONLY to the AWS level&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;glacier:createvault&quot;: admin&#92;n  - &quot;glacier:ListVaults&quot;: metadata&#92;n  - &quot;s3:DeleteBucket&quot;: none&#92;n```&#92;n

AWS > Bedrock > Permissions > Lockdown > API Boundary

Configure whether the AWS bedrock API is enabled for all users and roles in guardrails-managed boundary policies.&#92;n&#92;n**Note:** Disabling the service disables the API for ALL users and roles, and Guardrails will have no access to the API.&#92;n

A list of AWS regions in which AWS Bedrock resources are supported for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all AWS Bedrock resources&#39; Regions policies.&#92;n

AWS > Bedrock > Regions

AWS > Region

AWS/Bedrock/Admin

AWS/Bedrock/Metadata

AWS/Bedrock/Operator

aws-acm

aws-amplify

aws-apigateway

aws-appconfig

aws-appfabric

aws-appflow

aws-appmesh

aws-appstream

aws-appsync

aws-artifact

aws-athena

aws-auditmanager

aws-backup

aws-batch

aws-billing

aws-braket

aws-chatbot

aws-chime

aws-cisv1

aws-cisv1-4

aws-cisv2-0

aws-cisv3-0

aws-cleanrooms

aws-cloud9

aws-clouddirectory

aws-cloudformation

aws-cloudfront

aws-cloudhsm

aws-cloudmap

aws-cloudsearch

aws-cloudshell

aws-cloudtrail

aws-cloudwatch

aws-codebuild

aws-codecommit

aws-codedeploy

aws-codepipeline

aws-codestar

aws-codewhisperer

aws-cognito

aws-comprehend

aws-computeoptimizer

aws-config

aws-connect

aws-datapipeline

aws-datasync

aws-dax

aws-devicefarm

aws-directconnect

aws-directoryservice

aws-dms

aws-docdb

aws-dynamodb

aws-ec2

aws-ec2imagebuilder

aws-ecr

aws-ecs

aws-efs

aws-eks

aws-elasticache

aws-elasticbeanstalk

aws-elasticinference

aws-elasticsearch

aws-elastictranscoder

aws-emr

aws-eventbridgepipes

aws-eventbridgescheduler

aws-events

aws-fms

aws-fsx

aws-gamelift

aws-glacier

aws-globalaccelerator

aws-glue

aws-gluedatabrew

aws-greengrass

aws-guardduty

aws-health

aws-hipaa

aws-iam

aws-inspector

aws-iot

aws-iot1click

aws-iotanalytics

aws-iotevents

aws-iotsitewise

aws-iotthingsgraph

aws-kendra

aws-kinesis

aws-kms

aws-lakeformation

aws-lambda

aws-lex

aws-lightsail

aws-location

aws-logs

aws-machinelearning

aws-macie

Mod: aws-bedrock

Recommended Version

Resource Types

IAM Roles

Policies