A security engineer needs to grant a Lambda function permission to call only a single Anthropic Claude model on Amazon Bedrock and nothing else. Which approach follows AWS best practices?
Show answerHide answer
Least privilege means an IAM role with a policy that allows only bedrock:InvokeModel and restricts the Resource to the specific model ARN. AdministratorAccess violates least privilege. Long-lived access keys in environment variables are an anti-pattern compared to roles, and Bedrock model endpoints are not made publicly accessible — access is controlled through IAM.
Read the full explanation →