Skip to main content

Enable AWS Bedrock foundation models

Walks through enabling AWS Bedrock models via console or CLI using Marketplace subscriptions. Covers prerequisites, IAM, propagation timing, and provider requirements.

A new process

AWS transitioned access to Amazon Bedrock foundation models. It moved from the previous "Model Access" request flow to Marketplace subscription offers. Access to all Amazon Bedrock foundation models is enabled by default. This requires the correct AWS Marketplace permissions. Users select a model from the model catalog in the Amazon Bedrock console. Then they open it in the playground or invoke the model using the API. Access is automatically granted.

Method 1: Enable models using the Amazon Bedrock console (recommended)

Admins can enable a foundation model in more than one way. The simplest way is to use the Amazon Bedrock console playground. This method automatically handles the marketplace subscription offer acceptance.

Prerequisites

  • The AWS account must have permissions to accept AWS Marketplace offers. Coordinate with the AWS account owner or cloud security team. Confirm that accepting marketplace product offers is allowed for the role. This role is used to access the console.

  • The IAM role must have permissions for Amazon Bedrock APIs. It must also have permissions for any required AWS Marketplace actions. These actions are governed by the organization's policies.

Steps to enable a model

  • Sign in to the Amazon Bedrock console at https://console.aws.amazon.com/bedrock/.

  • In the left navigation pane, under Bedrock configurations, choose Model catalog.

  • Select the model to enable.

  • Choose Open in Playground.

  • Send a test prompt to the model in the playground.

  • The model may return a response. If so, the model is successfully enabled for the AWS account.

Handling delays

Due to marketplace subscription propagation delays, the first request may not succeed immediately:

  • If the first request fails or times out, wait a few moments. Then try again.

  • The model should respond successfully on the second attempt.

  • Once enabled, the model becomes available for all users in the AWS account. This applies across all regions where the model is supported.

Provider-specific requirements

  • Anthropic models: First-time customers must submit use case details once per account. They can also do this once at the organization's management account. The Amazon Bedrock console will prompt for this information when selecting an Anthropic model. Access is granted immediately after successful submission.

Method 2: Enable models using the AWS CLI

Some organizations prefer command-line workflows or need to enable models programmatically. For these organizations, the AWS CLI provides an alternative method. It lets them accept marketplace subscription offers.

Prerequisites

  • The AWS account must have permissions to accept AWS Marketplace offers. Coordinate with the AWS account owner or cloud security team. Confirm that accepting marketplace product offers is allowed for the role. This role is used to run these steps.

  • The AWS CLI must be installed. It must also be configured with credentials. The configuration must also include the target Region where the model will be used.

  • The IAM role running these commands must have permissions for Amazon Bedrock APIs. It must also have permissions for any required AWS Marketplace actions. These actions are governed by the organization's policies.

Step 1: Identify the model ARN

  • In the AWS console, navigate to Amazon Bedrock and open the Model catalog. Then choose Providers and select the model. Copy the model ID/ARN shown for that model.

  • Use this value as the --model-id in the following commands.

Step 2: Sign in with IAM Identity Center (SSO)

aws sso login --profile <profile-name>

  • Admins using sso-session configuration can log in by session name:

aws sso login --sso-session <session-name>

  • To run subsequent commands with the same profile, either set AWS_PROFILE=<profile-name> in the shell. Or append --profile <profile-name> to each command.

Note: An AWS SSO profile may be required. This applies only if the organization uses IAM Identity Center for CLI authentication. Valid credentials may already be configured (for example, access keys or an assume-role profile). If so, admins can skip this step. They can run the commands with that profile instead.

Step 3: List available subscription offers

Run the following command to list the subscription offers for the selected model. Copy the offerToken value for use in the next step.

aws bedrock list-foundation-model-agreement-offers \  --model-id <model-arn>

PowerShell:

aws bedrock list-foundation-model-agreement-offers `  --model-id <model-arn>

Return only the offer token (concise output):

aws bedrock list-foundation-model-agreement-offers \  --model-id <model-arn> \  --query 'offers[].offerToken' \  --output text

PowerShell (concise output):

aws bedrock list-foundation-model-agreement-offers `  --model-id <model-arn> `  --query "offers[].offerToken" `  --output text

Step 4: Accept the offer (create the agreement)

Use the offerToken from the previous command to create the foundation model agreement. This is the same as accepting the subscription offer:

aws bedrock create-foundation-model-agreement \  --model-id <model-arn> \  --offer-token <offer-token>

PowerShell:

aws bedrock create-foundation-model-agreement `  --model-id <model-arn> `  --offer-token <offer-token>

Complete example

The following shows the full flow with made-up values.

In this example:

  • Profile: my-dev-profile

  • Model ID/ARN: anthropic.claude-3-5-sonnet-20240620-v1:0

Bash:

# 1) Sign in with SSO (if your org uses IAM Identity Center)aws sso login --profile my-dev-profile# 2) Use the profile for subsequent commandsexport AWS_PROFILE=my-dev-profile# 3) Get only the offer tokenOFFER_TOKEN=$(aws bedrock list-foundation-model-agreement-offers \  --model-id anthropic.claude-3-5-sonnet-20240620-v1:0 \  --query 'offers[0].offerToken' \  --output text)# Example: echo the token (shortened here)echo "$OFFER_TOKEN"# => AQICAFAKEOFFER...==# 4) Create the agreement (accept the offer)aws bedrock create-foundation-model-agreement \  --model-id anthropic.claude-3-5-sonnet-20240620-v1:0 \  --offer-token "$OFFER_TOKEN"

PowerShell:

# 1) Sign in with SSO (if your org uses IAM Identity Center)aws sso login --profile my-dev-profile# 2) Use the profile for subsequent commands$env:AWS_PROFILE = "my-dev-profile"# 3) Get only the offer token$offerToken = aws bedrock list-foundation-model-agreement-offers `  --model-id anthropic.claude-3-5-sonnet-20240620-v1:0 `  --query "offers[0].offerToken" `  --output text# Example: write the token (shortened here)Write-Output $offerToken# => AQICAFAKEOFFER...==# 4) Create the agreement (accept the offer)aws bedrock create-foundation-model-agreement `  --model-id anthropic.claude-3-5-sonnet-20240620-v1:0 `  --offer-token $offerToken

Propagation and first-invocation timing

After the first invocation, allow up to 15 minutes. This gives the marketplace subscription time to fully propagate. During this period:

  • The first call may succeed even though the subscription is not fully activated.

  • Subsequent calls may fail while propagation is in progress.

  • After approximately 15 minutes, all calls should succeed consistently.

Errors may persist beyond 15 minutes. If so, verify that the agreement was created for the correct Region. Also confirm that the AWS account has permissions to accept AWS Marketplace offers.

Additional notes

  • Some providers' models are not sold through AWS Marketplace. They also do not have product IDs. Access control for these models is managed via Amazon Bedrock permissions. It is not managed through marketplace product scoping.

References

After enabling models, configure them for use in F5 Workforce AI Security. Do this by creating a Model connector.

Related Articles
Did this answer your question?