AIF-C01 Applications of Foundation Models Practice Question

Exhibit

Refer to the exhibit.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "bedrock:InvokeModel",
            "Resource": "arn:aws:bedrock:us-east-1:123456789012:model/amazon.titan-text-express-v1"
        }
    ]
}

A security engineer creates the above IAM policy to allow a user to invoke an Amazon Bedrock model. However, invocation fails. What is the issue?

⚠ Common exam trap

AWS often tests the distinction between 'model' and 'foundation-model' in Bedrock ARNs, as candidates may assume all Bedrock models use the same resource type, overlooking that foundation models require a specific path.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The ARN should use "foundation-model" instead of "model".

The IAM policy's resource ARN incorrectly uses 'model' in the path, but Amazon Bedrock requires 'foundation-model' to reference foundation models. The correct ARN format for invoking a Bedrock foundation model is 'arn:aws:bedrock:region::foundation-model/model-id'. Using 'model' instead of 'foundation-model' causes the policy to not match any valid Bedrock resource, resulting in an invocation failure.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The action should be "bedrock:InvokeModelWithResponseStream".
Why it's wrong here
InvokeModel is the correct action for synchronous invocation; InvokeModelWithResponseStream is for streaming.
✗
The resource ARN is missing the account ID.
Why it's wrong here
The account ID is present (123456789012).
✓
The ARN should use "foundation-model" instead of "model".
Why this is correct
The resource type for foundation models is 'foundation-model', not 'model'.
✗
The statement is missing a condition for the model ID.
Why it's wrong here
Conditions are optional; the resource ARN already specifies the model ID.

Go deeper

AIF-C01 Applications of Foundation Models Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question