AWS Bedrock Runtime 2026-08-30

Use these rules for applications calling AWS Bedrock Runtime as available on 2026-08-30. Apply the relevant language and framework security guidance alongside these rules. Verify optional APIs, fields, and safeguards against the deployed model and endpoint; later documentation does not establish that they were available in this snapshot. Treat model access, retrieved data, generated output, and external actions as separate trust boundaries.

Identity and credentials

• Use workload roles and short-lived credentials instead of embedded access keys.
• Prefer SigV4 credentials to Bedrock API keys. Where a bearer key is required, generate short-term keys from the workload's own session and refresh them. Deny bedrock:CallWithBearerToken with StringEquals on bedrock:bearerTokenType set to LONG_TERM; if Mantle access is enabled, use a separate deny on bedrock-mantle:CallWithBearerToken with bedrock-mantle:bearerTokenType. Restrict iam:CreateServiceSpecificCredential. Short-term key generation cannot be blocked, but usage can be denied; a key carries its principal's permissions until the session expires or 12 hours elapse, whichever comes first. Never hand one to a browser or client, or put it in prompts, tool context, or logs.
• Give each workload only the Bedrock actions, models, guardrails, agents, and resources it requires.
• Separate roles, accounts, regions, environments, tenants, and privilege levels where compromise must not spread.
• Restrict sts:AssumeRole trust policies with exact principals, conditions, external IDs, and session constraints.
• Never