AIF-C01 Applications of Foundation Models Practice Question

Exhibit

Refer to the exhibit.
{
  "error": {
    "message": "Access denied. Please ensure you have the correct permissions to access the requested model.",
    "type": "AccessDeniedException"
  }
}
(This error is returned when calling the InvokeModel API in Amazon Bedrock with model ID 'anthropic.claude-v2'.)

A developer is trying to invoke the Claude v2 model in Amazon Bedrock from a Lambda function. The Lambda function's IAM role has the following policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "bedrock:InvokeModel",
      "Resource": "*"
    }
  ]
}

When the Lambda function runs, it receives the error shown in the exhibit. Which additional step is most likely needed to resolve this issue?

⚠ Common exam trap

A common mix-up: candidates assume a wildcard IAM policy (Resource: '*') grants full access, but Bedrock requires an additional explicit model access approval that is independent of IAM, causing them to incorrectly focus on policy or region changes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Request access to the Anthropic Claude model through the Amazon Bedrock console.

Amazon Bedrock requires explicit user access approval for third-party foundation models like Anthropic Claude before they can be invoked. Even with a valid IAM policy allowing bedrock:InvokeModel on all resources, the model itself must be granted access via the Bedrock console's 'Model access' section. Without this step, the API returns an access denied error regardless of IAM permissions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Change the AWS region to one where Claude v2 is available.
Why it's wrong here
The error indicates an access-denied condition on the model, not a regional availability problem; relocating the function does not grant the missing model access. It is tempting because Bedrock models differ by region, but it would be correct only where the model is genuinely absent from the current region.
✗
Use a different model ID such as 'anthropic.claude-v1'.
Why it's wrong here
Switching to Claude v1 changes the model, not the missing permission; the error stems from lacking bedrock:InvokeModel access to the specific model, so a different model ID fails identically. It is tempting when a model is unavailable, but it would be correct only if Claude v2 were not offered in that region.
✓
Request access to the Anthropic Claude model through the Amazon Bedrock console.
Why this is correct
Model access in Amazon Bedrock is granted separately from IAM permissions. Even with bedrock:InvokeModel allowed, the account must first request access to the Anthropic Claude model in the Bedrock console, otherwise invocation returns an access-denied error despite the permissive policy.
✗
Add a condition to the IAM policy to specify the model ARN.
Why it's wrong here
A condition narrows an existing Allow but grants nothing new; the role already permits bedrock:InvokeModel on all resources, so the failure is a missing model-access grant, not an over-broad scope. It is tempting as least-privilege hardening, but it would be correct only when tightening an already-working policy.

Visual reference

Quick reference

Cloud Service Model Comparison

Model	You Manage	Provider Manages	Examples
IaaS	OS, runtime, apps, data	Hardware, hypervisor, networking	EC2, Azure VMs, GCP Compute Engine
PaaS	Apps and data	OS, runtime, middleware, hardware	Elastic Beanstalk, Azure App Service
SaaS	Data and settings only	Everything else	Microsoft 365, Salesforce, Workday
FaaS / Serverless	Function code only	Infra, scaling, runtime	Lambda, Azure Functions, Cloud Run
CaaS	Containers and apps	Kubernetes, OS, hardware	EKS, AKS, GKE

Go deeper

AIF-C01 Applications of Foundation Models Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Cloud Service Model Comparison

Related to this question