Fix Bedrock IAM for cross-region inference profiles#47
Merged
Conversation
Cross-region inference profiles (eu.anthropic.*) route to foundation models in eu-central-1, eu-north-1, eu-west-1, eu-west-3. IAM requires explicit access to the destination model ARNs, not just the inference profile. Condition scopes foundation model access to only work via our inference profiles. Fixes plan role, slack-alert role, and cost-report role.
Terraform PlanChanges detected — review required. Plan output |
LLM Plan ReviewAWS CLI error: LLM returned no structured output. |
…error - Use eu-* wildcard for foundation model ARNs instead of listing specific regions — Bedrock routes to any EU region dynamically. - Fail the pipeline when LLM review returns FAILED instead of silently passing through to the apply job.
Terraform PlanChanges detected — review required. Plan output |
LLM Plan ReviewRisk: 🟢 LOW Routine IAM policy updates for CI/CD roles with Bedrock inference profile additions and minor policy restructuring.
|
Alexanderamiri
added a commit
that referenced
this pull request
May 9, 2026
## Summary Cross-region inference profiles (`eu.anthropic.*`) route to foundation models in EU destination regions (eu-central-1, eu-north-1, eu-west-1, eu-west-3). IAM requires explicit access to the destination foundation model ARNs, not just the inference profile. This was hidden by the old `*:*` infra role and has been a latent bug on the Lambda roles (slack-alert, cost-report) — they'd fail if Bedrock routed to eu-north-1. Adds a second IAM statement with foundation model ARNs for all EU destination regions, scoped via `bedrock:InferenceProfileArn` condition so they only work through our inference profiles. Fixes: ci-infra-plan role, slack-alert Lambda role, cost-report Lambda role. ## Test plan - [ ] Plan job succeeds with LLM review (Bedrock call works) - [ ] Apply creates the IAM policy changes on Lambda roles
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cross-region inference profiles (
eu.anthropic.*) route to foundation models in EU destination regions (eu-central-1, eu-north-1, eu-west-1, eu-west-3). IAM requires explicit access to the destination foundation model ARNs, not just the inference profile.This was hidden by the old
*:*infra role and has been a latent bug on the Lambda roles (slack-alert, cost-report) — they'd fail if Bedrock routed to eu-north-1.Adds a second IAM statement with foundation model ARNs for all EU destination regions, scoped via
bedrock:InferenceProfileArncondition so they only work through our inference profiles.Fixes: ci-infra-plan role, slack-alert Lambda role, cost-report Lambda role.
Test plan