How to access Amazon Bedrock: from a fresh account to your first call.
Access to many Amazon Bedrock models is now on by default. For a first call you need an IAM identity that can invoke the model, AWS Marketplace permissions the first time you use a third-party model, a one-time use-case form for Anthropic models, a valid payment method, and a Region where the model runs. Then call the Converse API.
- Most Bedrock models no longer need a per-model access request. AWS enables access to many foundation models by default in every commercial Region where the model runs. The first time you call a third-party model sold through AWS Marketplace, Bedrock subscribes your account in the background.
- Five things must be true: your IAM identity can call bedrock:InvokeModel (the Converse API uses it too); it has AWS Marketplace subscribe permissions the first time a third-party model is used; Anthropic models have a submitted use-case form; the account has a valid payment method; and you call a Region where the model is available.
- Most AccessDeniedException errors come from one of those: a missing IAM action, missing Marketplace permissions on first use, no Anthropic use-case form yet, or a Service Control Policy that blocks the model.
- Funding: if your build qualifies, a vetted AWS partner can file POC funding for a GenAI test, or incremental workload (IW) funding if you already run on AWS. For startups this is typically $50K to $150K. Depends on the workload; AWS approves. You apply for Activate credits yourself.
IHow Bedrock model access works now
Older guides tell you to open a "Model access" page and request each model in each Region. AWS changed this. Access to many models is on by default, and the first call to a third-party model sets up the subscription for you.
The Bedrock user guide now says access to many foundation models is enabled by default, as long as the right AWS Marketplace permissions are in place, and that default access applies in all commercial Regions where the model is supported. To start, you pick a model from the model catalog and open it in the playground, or call it with the InvokeModel or Converse API. The Model access page with per-model requests remains in AWS GovCloud (US).
When you call a third-party model for the first time, Bedrock starts the AWS Marketplace subscription in the background. AWS says this setup can take up to 15 minutes, and that calls may succeed during it. If a prerequisite is missing, the subscription fails and later calls return AccessDeniedException. After you fix the permissions, AWS says it can take up to 2 minutes for the subscription to complete.
So "getting access" comes down to five checks: IAM (your identity can call the model), Marketplace permissions (only needed the first time a third-party model is used in the account), the Anthropic use-case form (once per account or organization), a valid payment method, and a Region where the model runs. The rest of this guide takes them in order.
You no longer request most models one by one. If an old tutorial sends you looking for a Model access page in a commercial Region, skip it: check IAM, the Marketplace permissions on first use, and the Anthropic form instead. Some models still need extra account-level access; if you have done everything and still get AccessDeniedException, AWS says to contact AWS Sales.
IIStep 1: Let the first call subscribe (Marketplace and the Anthropic form)
Third-party models sold through AWS Marketplace are subscribed on first use. Two things have to be in place before that first call.
Marketplace permissions. The IAM role that makes the first call needs aws-marketplace:Subscribe, aws-marketplace:Unsubscribe and aws-marketplace:ViewSubscriptions. These are only needed the first time a model is used in the account. After someone with those permissions has enabled the model, other identities can call it without them. The account also needs a valid payment method for Marketplace purchases.
Which models need this. AWS lists providers whose models are not sold through AWS Marketplace and need no subscription, including Amazon, DeepSeek, Google, Meta, Mistral AI, Qwen and others. Models from providers that are sold through Marketplace, such as Anthropic, are subscribed on first use.
The Anthropic use-case form. Before you call an Anthropic (Claude) model, submit the first-time use form once per account, or once at your organization's management account. You can do it by selecting an Anthropic model in the Bedrock console model catalog, or with the PutUseCaseForModelAccess API. It asks for your intended use and a website URL. Access is usually granted once it is submitted, but it can sit in a pending state; AWS emails you when it is done, and GetFoundationModelAvailability shows the status.
In an organization. To stop teams using a model, AWS says to deny bedrock:InvokeModel for that model with an SCP or IAM policy. Denying aws-marketplace:Subscribe alone does not block the first call, because Bedrock starts the subscription automatically.
Calling Claude for the first time from a role with no AWS Marketplace permissions, before the Anthropic use-case form is submitted. The call returns AccessDeniedException. Submit the form, grant the Marketplace actions to the role (or have an admin make the first call), then try again.
IIIStep 2: Grant the right IAM permissions (least privilege)
The principal making the request (an IAM user, an assumed role, a Lambda or ECS task role) needs a policy that allows the Bedrock runtime actions.
There are two runtime actions. bedrock:InvokeModel covers InvokeModel and the Converse API. bedrock:InvokeModelWithResponseStream covers streaming and ConverseStream. If your app lists models or reads model details at runtime, add control-plane reads such as bedrock:ListFoundationModels and bedrock:GetFoundationModel.
Scope the Resource to the foundation-model ARNs you use, so a service can call those models and nothing else. Cross-region inference profiles and Provisioned Throughput have their own ARNs, so grant the action on those too if you use them. AWS publishes managed policies such as AmazonBedrockFullAccess for prototyping; use a hand-scoped policy beyond a sandbox. Every Bedrock API call is recorded in CloudTrail, and you can turn on model invocation logging to capture requests and responses to S3 or CloudWatch.
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "BedrockInvokeScopedModels",
"Effect": "Allow",
"Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
"Resource": [
"arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-sonnet",
"arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2"
]
}]
}
Model IDs and ARNs are illustrative; copy the exact values from the Bedrock console. The role that makes the first call to a third-party model also needs aws-marketplace:Subscribe, aws-marketplace:Unsubscribe and aws-marketplace:ViewSubscriptions. If you call through a cross-region inference profile, add the profile ARN to Resource.
IVStep 3: Choose a Region (and when to use cross-region inference)
Bedrock processes your request in the Region you call, and not every model runs in every Region. The Region decides which models you can use, where data is processed and your latency.
Weigh three things. Data residency: prompts and responses are processed in the Region you call, so keep EU data in an EU Region and so on. Latency: pick a Region near your users or app. Model availability: new models often reach US Regions first, so the nearest Region may not have the newest model. When these conflict, availability usually decides.
A common silent failure is calling a Region where the model is not offered. Make sure the region_name you pass to the bedrock-runtime client is a Region where the model runs. Per AWS, once an identity has subscribed to a model in one Region, the model is available to it in all Regions where the model is offered.
When one Region cannot give you the throughput you need, use a cross-region inference profile. You call a profile ID (for example a US or EU profile) and Bedrock routes the request to Regions within that geography. Pick a home Region first and add a profile when you hit limits. See cross-region inference.
| Factor | What it controls | Rule of thumb | Watch out for |
|---|---|---|---|
| Data residency | Where prompts and outputs are processed | Match the Region to your compliance boundary | Cross-region profiles stay within the geography you pick |
| Latency | Round-trip time to the model | Pick a Region near your users or app | The closest Region may lack the newest model |
| Model availability | Which models exist there | New models often reach US Regions first | A model in us-east-1 may not be in eu-central-1 yet |
| Throughput | Capacity headroom under load | Use a cross-region inference profile when one Region is constrained | Profiles need their own ARN in your IAM policy |
VStep 4: Pick your models (Anthropic, Amazon, Meta and the rest)
You no longer request each model. Pick the set you will call, and check whether any of them needs a first-use step.
A typical first set is one workhorse chat model (such as Claude Sonnet), one small model for high-volume calls (Claude Haiku, Nova Lite or a small Mistral model) and one embeddings model (Titan Text Embeddings or Cohere Embed). You call each by its model ID (for example an anthropic.*, amazon.*, meta.* or mistral.* identifier). With the Converse API, switching models is usually a one-line change to modelId, as long as your IAM policy allows the new model and it runs in your Region.
| Provider | Example models | First-use step | Notes |
|---|---|---|---|
| Anthropic | Claude Haiku, Sonnet, Opus | Use-case form once, plus Marketplace subscription on first call | The form can sit in a pending state; check GetFoundationModelAvailability |
| Amazon | Nova, Titan Text and Embeddings | None (not sold through Marketplace) | Low friction; Nova for low cost and latency |
| Meta | Llama | None (not sold through Marketplace) | Open-weight models |
| Mistral AI | Mistral Large and smaller models | None (not sold through Marketplace) | Fast, cost-efficient throughput |
| DeepSeek, Qwen and others | Reasoning and open models | None for the providers AWS lists as not sold through Marketplace | Check the user guide for the current list |
| Other Marketplace providers | For example Cohere, Stability AI, AI21 | Marketplace subscription on first call | Needs Marketplace permissions and a payment method the first time |
VIStep 5: Verify with a first call (Converse API)
Prove the whole path with one small call. Converse uses one request format across chat models, so the same snippet checks Claude, Llama, Nova and Mistral by changing only the model ID.
Three ways to check. The console playground answers if the model works for your console identity. The AWS CLI (aws bedrock-runtime converse) checks your credentials, Region, IAM and the model at once. The SDK is what your app will use. For Anthropic models, GetFoundationModelAvailability shows whether the agreement is AVAILABLE, PENDING, NOT_AVAILABLE or in ERROR.
import boto3
brt = boto3.client("bedrock-runtime", region_name="us-east-1") # a Region where the model runs
resp = brt.converse(
modelId="anthropic.claude-sonnet", # the exact model ID from the console
messages=[{"role": "user", "content": [{"text": "Reply with the single word: connected."}]}],
inferenceConfig={"maxTokens": 16, "temperature": 0},
)
print(resp["output"]["message"]["content"][0]["text"])
If this prints a reply, IAM, Region, first-use setup and credentials all line up. Model IDs are illustrative; copy the exact ID from the console.
VIICommon access errors and how to fix them
Most "I can't access Bedrock" reports come down to a few causes. Read the error type first: each one points at a different check.
| Symptom or error | Most likely cause | Fix |
|---|---|---|
| AccessDeniedException on the first call to a third-party model | The role lacks AWS Marketplace permissions, the Anthropic use-case form is missing, or there is no valid payment method | Grant aws-marketplace:Subscribe, Unsubscribe and ViewSubscriptions, submit the Anthropic form, check the payment method, then retry |
| AccessDeniedException on any call | IAM lacks bedrock:InvokeModel (or InvokeModelWithResponseStream for streaming), or an SCP denies the model | Allow the action on the model ARN (Step 2); check SCPs with your platform team |
| Anthropic calls fail after the form was submitted | The model agreement is still pending | Check GetFoundationModelAvailability; wait for the AWS email |
| Still denied after every check | The model needs extra account-level access | Per AWS, contact AWS Sales for access options |
| ValidationException: invalid model ID | Misspelled model ID, or the model is not offered in this Region | Copy the exact ID from the console; check the Region or use a cross-region inference profile |
| Works in the playground, fails in code | The SDK identity or Region differs from the console session | Give the SDK principal the Bedrock IAM actions and match region_name to a Region where the model runs |
| UnrecognizedClientException or a credentials error | The SDK is not authenticated, or points at the wrong account | Configure valid credentials for the right account (environment, profile or role) |
| ThrottlingException | On-demand request or token limits for the model | Retry with backoff, use a cross-region inference profile, or request a quota increase |
| Cross-region profile call denied | IAM allows the base model ARN but not the profile ARN | Add the inference profile ARN to the policy Resource list |
VIIIAccess is free; running it is not. Who files AWS funding
Turning Bedrock on and making a first call cost nothing. The bill arrives with real traffic.
The cost levers are the usual ones: route high-volume calls to small models, run latency-tolerant work as batch (AWS prices it 50% below on-demand for select models), turn on prompt caching for repeated context, and use Provisioned Throughput only at steady, high volume. See Bedrock pricing and the Bedrock API.
On funding: if your build qualifies, your matched AWS partner can file POC (proof of concept) funding to test a GenAI use case, or incremental workload (IW) funding if you already run on AWS and are launching new work. If you are moving to AWS from another cloud, it can file MAP migration funding. For startups this is typically $50K to $150K. Depends on the workload; AWS approves. See AWS partner funding.
AWS Activate credits are separate, and you apply yourself at aws.amazon.com/startups/credits: Activate Founders gives $1,000 to start, up to $5,000; Activate Portfolio gives up to $200,000 with an Org ID from your VC, accelerator or angel group if it is an Activate Provider. A consulting partner cannot file Activate for you. If you only need access and Activate credits, you do not need a partner.
The five checks, side by side
Five things must be true for a first call to work. If a call fails, find the error and you know which check to fix.
| Check | What it is | Where you set it | Error if missing |
|---|---|---|---|
| 1. IAM permission | Your identity may call the model | IAM policy: bedrock:InvokeModel (and InvokeModelWithResponseStream) | AccessDeniedException |
| 2. Marketplace permissions | First call to a third-party model can subscribe | IAM policy: aws-marketplace:Subscribe, Unsubscribe, ViewSubscriptions | AccessDeniedException after the first call |
| 3. Anthropic use-case form | One-time form for Claude models | Console model catalog, or PutUseCaseForModelAccess | AccessDeniedException; status PENDING or NOT_AVAILABLE |
| 4. Region | The model runs where you call it | SDK region_name, or a cross-region inference profile | ValidationException or ResourceNotFoundException |
| 5. Credentials and payment | SDK signed in to the right account; valid payment method | Environment, profile or role; billing settings | UnrecognizedClientException, or a failed subscription |
How a match works (example)
- You tell us about the work
You fill in a short form: what you run today, what you want to move, test or build, your stage and your region.
- We pick one partner
We read your answers and pick one vetted AWS consulting partner that fits the work, the stack and the region. We reply within 24 hours; your matched partner reaches out within 5 business days.
- The partner checks POC funding
Your matched partner scopes the test with you. Then it checks whether the test qualifies for POC (proof of concept) funding. A POC can fit whether or not you run on AWS today.
- The partner files, AWS decides
If the work qualifies, the partner files the funding request with AWS. AWS reviews it and decides. The amount depends on the workload.
- You pay nothing
CloudRoute is free for startups. Partners pay CloudRoute a monthly membership plus 10% of AWS-approved funding.
AWS Activate credits are separate, and you apply for them yourself. Use Activate Founders if no investor backs you. Use Activate Portfolio with the Org ID or invite from your VC, accelerator, incubator or angel group if it is an Activate Provider. A consulting partner cannot apply for Activate on your behalf.
Common questions
How do I access Amazon Bedrock for the first time?
Do I still need to request model access in the Bedrock console?
Why do I get AccessDeniedException when I call a Bedrock model?
What IAM permissions does Amazon Bedrock require?
What is the Anthropic use-case form on Bedrock?
Which Region should I choose for Bedrock?
How do I verify my Bedrock access is working?
How much does Bedrock cost, and who files AWS funding?
Get Bedrock set up with a partner who can file the funding.
CloudRoute matches you with one vetted AWS partner that can handle the Bedrock setup (IAM, Marketplace permissions, the Anthropic form, Region, first call) and build the workload. If the build qualifies, the partner files POC or incremental workload (IW) funding, typically $50K to $150K for startups. Depends on the workload; AWS approves. CloudRoute is free for startups.