AIF-C01 Fundamentals of Generative AI Practice Question

Exhibit

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "bedrock:InvokeModel",
            "Resource": "arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-text-lite-v1"
        }
    ]
}

Refer to the exhibit. A developer has attached this IAM policy to their user. When trying to invoke the Anthropic Claude v2 model using the Bedrock runtime, they receive an AccessDeniedException. Which change to the policy would resolve the issue?

⚠ Common exam trap

AWS often tests the nuance that Bedrock foundation model ARNs use a double colon (::) and omit the account ID, leading candidates to choose a wildcard Resource or a malformed ARN.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Change the Resource to arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-v2

The IAM policy's Resource element must specify the exact ARN of the foundation model being invoked. The original policy likely used a wildcard or incorrect ARN pattern. The correct ARN for Anthropic Claude v2 in us-east-1 is arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-v2, which grants permission to invoke that specific model via the Bedrock runtime.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add the bedrock:InvokeModelWithResponseStream action
Why it's wrong here
Incorrect. This action is for streaming responses; the issue is resource restriction, not action.
✗
Change the Action to bedrock:ListFoundationModels
Why it's wrong here
Incorrect. This action lists models but does not allow invocation.
✓
Change the Resource to arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-v2
Why this is correct
The policy's Resource currently points at a provisioned throughput ARN, which only authorises invoking models via a purchased throughput commitment. Switching to the foundation-model ARN grants access to on-demand invocation of Anthropic Claude v2, satisfying the Bedrock runtime call that triggered the AccessDeniedException.
✗
Remove the Resource element and set Effect to Deny
Why it's wrong here
Incorrect. Removing Resource would allow all resources if combined with Allow, but setting Effect to Deny would block all access.

Visual reference

Go deeper

AIF-C01 Fundamentals of Generative AI Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question