{ "schema": "aaes/capability-pack/1", "provider": "aws", "version": "1.1.0", "description": "AWS pack: read-only IAM users, roles and account summary, Cost Explorer billing data and S3 object reads for one bucket prefix, plus Amazon Bedrock administration (model access, guardrails, Provisioned Throughput, invocation logging). The HTTP connector signs every request with Signature Version 4 and refuses malformed key material before calling AWS.", "notes": "Request signing, reviewed 2026-09-21: the authenticated form of every AWS API these endpoints belong to requires Signature Version 4 — a per-request HMAC-SHA256 computation over the canonical request derived from the secret access key, not a static header value. The http connector now performs it: the credential block declares sign: aws-v4, the connector derives the signing scope from the endpoint host (us-east-1/iam, us-east-1/ce; the S3 capability carries an explicit us-east-1/s3 scope because its shipped placeholder host derives none), signs with the stored key-pair document, and refuses — by name, before any network call — when the material is malformed, the scope is underivable, or the caller supplied signer-owned headers.\n\nEvery capability states sign: aws-v4 explicitly. The inject: header / inject_name: Authorization fields beside it name where the computed SigV4 Authorization header goes, which the validators require for this signing mode; they do not mean a stored header value is injected. There is no unsigned fallback and no verbatim injection of the key material. Signing limit: SigV4 is not a general execution-denial control — S3 GetObject can permit anonymous reads of publicly accessible objects, so an unsigned GET against a public object would succeed. The intended custody model for aws.s3.object.get therefore REQUIRES the registered bucket to be private, with authenticated access enforced by the bucket policy, the IAM principal's policy and S3 Block Public Access; do not rely on the absent signer to deny anything.\n\nRead scope of the 1.0.0 capabilities: they cover the read and audit path — who exists (IAM users and roles), what the account posture counters say (GetAccountSummary: users, roles, MFA state, quotas), what money is being spent (Cost Explorer GetCostAndUsage), and controlled reads of objects under one declared bucket prefix. Every AWS operation not named here is excluded.\n\nApart from the Amazon Bedrock operations registered in 1.1.0 and described below, all write and control-plane operations (any IAM create/attach/delete, any S3 PutObject/DeleteObject, EC2 RunInstances, and every other mutating call across every service) are excluded from this pack; each action's tier must be reviewed on its own before any of them is registered; so are all other services and all other read operations not named here — including STS AssumeRole and GetCallerIdentity, Organizations, CloudTrail lookup, Secrets Manager and KMS data-plane reads, and S3 ListBucket/ListObjectsV2 — none of them is registered because this review did not scope them. Replace before enabling: OBJECT_KEY and OBJECT_PREFIX, plus the S3 endpoint and egress allowlist authority.\n\nThe shipped S3 endpoint uses the reserved.invalid authority aws-s3-bucket.s3.us-east-1.amazonaws.com.invalid so the unbound pack resolves nowhere; before enabling, substitute the documented virtual-hosted S3 shape https://BUCKET.s3.REGION.amazonaws.com/OBJECT_KEY for your bucket and region, and substitute the egress allowlist authority in step. The resource locator s3://BUCKET/OBJECT_PREFIX declares the intended scope but does not enforce a prefix: the concrete key binding at enablement and the AWS IAM policy on the principal (s3:GetObject limited to that prefix) must implement the restriction. Credential model: customer_vault is the only generally supported production custody here — identity_federation and customer_broker resolvers fail construction without a TokenIssuer or BrokerClient (aaes/internal/custody/federation.go, broker.go), and inline is lab-only.\n\nThe IAM principal behind the access key should carry only the read permissions these five calls need (iam:ListUsers, iam:ListRoles, iam:GetAccountSummary, ce:GetCostAndUsage, s3:GetObject on the one bucket prefix); scopes are chosen at AWS, not in this pack. Cost Explorer is served only from the us-east-1 endpoint per the API reference and the AWS General Reference (commercial partition). The S3 read is registered at R0, the read floor: the validators enforce the verb floors, and shipped-pack discipline requires registration AT those floors rather than below or above them; object content under a bucket prefix is uncontrolled data, so policy SHOULD raise this tier at install.\n\nPartition scope: every endpoint and example in this pack is scoped to the commercial AWS partition (*.amazonaws.com); the China and GovCloud partitions and specialized S3 endpoint forms (access points, dual-stack, FIPS) need separate review before use. AAES has not been certified by AWS; these endpoints are configuration to review and test; the vendor has not endorsed it.\n\nAmazon Bedrock administration (added in 1.1.0): thirteen capabilities on the Bedrock control plane bedrock.us-east-1.amazonaws.com cover model access (list models, read one model's availability, accept a model access offer), guardrails (list, create, update, delete), Provisioned Throughput (list, buy, delete) and model invocation logging (read, set, delete). The host is a real AWS endpoint. For another Region, substitute bedrock.REGION.amazonaws.com in the endpoint and the egress allowlist together; the connector derives the SigV4 scope REGION/bedrock from that host. The FIPS hosts (bedrock-fips.REGION.amazonaws.com) need their own review. These capabilities name a separate key-pair reference, secret-ref-aws-bedrock-admin-sigv4-key-pair, so the read-only IAM principal above never holds Bedrock write permissions. Give that principal only the bedrock: actions for the capabilities you enable.\n\nTiers sit at the floor of the declared actions. Accepting a model offer declares approve, buying Provisioned Throughput declares pay, and every delete is R3; these are irreversible actions and need a person. Updating a guardrail and changing the logging destination are R2 by the action floor, and policy should raise them where they protect production traffic. Every other operation in the Amazon Bedrock API index is excluded, among them GetUseCaseForModelAccess and PutUseCaseForModelAccess, ListFoundationModelAgreementOffers and DeleteFoundationModelAgreement, GetGuardrail, CreateGuardrailVersion and the enforced guardrail configuration operations, GetProvisionedModelThroughput and UpdateProvisionedModelThroughput, account data retention, resource policies, custom models and their deployments, marketplace model endpoints, prompt routers, inference profiles, Automated Reasoning policies, evaluation, customization, import, copy and batch invocation jobs, and tagging. Inference (bedrock-runtime), ApplyGuardrail, agents and knowledge bases are separate APIs and are not registered either.", "credential": { "secret_ref_id": "secret-ref-aws-sigv4-access-key-pair", "custody": "customer_vault", "inject": "header", "inject_name": "Authorization", "note": "An AWS SigV4 key pair for the commercial partition, held in the client's own secret manager. The stored material is the JSON signer-input document {\"access_key_id\":\"...\",\"secret_access_key\":\"...\",\"session_token\":\"...\"} (session_token optional; when present the connector sends X-Amz-Security-Token and includes it in SignedHeaders, so STS temporary credentials are supported). The credential block declares sign: aws-v4: the http connector signs each request with Signature Version 4 and never injects this material verbatim.\n\nMalformed or incomplete key material is refused by name at registration and at execution, before any network call; there is no unsigned fallback. Key rotation and least-privilege IAM policy remain the deployment's responsibility, as does executor memory/log/crash hygiene around the resolved material.", "sign": "aws-v4" }, "capabilities": [ { "capability_id": "aws.iam.users.list", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "iam.amazonaws.com" ], "endpoint": "https://iam.amazonaws.com/?Action=ListUsers&Version=2010-05-08", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-sigv4-access-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "aws-iam-account", "description": "List the account's IAM users (query protocol, global endpoint iam.amazonaws.com, API version 2010-05-08). User names, paths, ARNs and password-last-used timestamps are personal data.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.iam.roles.list", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "iam.amazonaws.com" ], "endpoint": "https://iam.amazonaws.com/?Action=ListRoles&Version=2010-05-08", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-sigv4-access-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "aws-iam-account", "description": "List the account's IAM roles, including their trust-policy documents, which reveal which principals may assume which role — internal security configuration.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.iam.account.summary.get", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "iam.amazonaws.com" ], "endpoint": "https://iam.amazonaws.com/?Action=GetAccountSummary&Version=2010-05-08", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-sigv4-access-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "aws-iam-account", "description": "Read IAM entity usage and quota counters for the account — users, roles, policies, MFA-device counts and whether account-level MFA and access keys are present — the posture summary an audit path starts from.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.ce.cost-and-usage.get", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "financial", "egress_allowlist": [ "ce.us-east-1.amazonaws.com" ], "endpoint": "https://ce.us-east-1.amazonaws.com/", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-sigv4-access-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "aws-billing-account", "description": "Read cost and usage metrics via Cost Explorer GetCostAndUsage (AWS JSON 1.1 protocol: POST to the commercial-partition endpoint ce.us-east-1.amazonaws.com with Content-Type: application/x-amz-json-1.1, the X-Amz-Target: AWSInsightsIndexService.GetCostAndUsage header, and a JSON body carrying TimePeriod, Granularity, Metrics, and optional Filter and GroupBy — a POST to / alone does not identify the governed AWS JSON operation; the X-Amz-Target header does). This is account financial data at the read floor, R0 — a lower bound: an R0 financial read can still be a serious confidentiality risk.\n\nThe read is of billing data and moves no money, so no cost ceiling is declared on the AAES action; per-request API pricing at the provider is the deployment's review.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.s3.object.get", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "aws-s3-bucket.s3.us-east-1.amazonaws.com.invalid" ], "endpoint": "https://aws-s3-bucket.s3.us-east-1.amazonaws.com.invalid/OBJECT_KEY", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-sigv4-access-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "aws-s3-bucket-prefix", "description": "Read one object by key from the registered bucket (virtual-hosted-style GET). The shipped authority aws-s3-bucket.s3.us-east-1.amazonaws.com.invalid is a reserved.invalid name that resolves nowhere; before enabling, substitute the documented virtual-hosted S3 shape https://BUCKET.s3.REGION.amazonaws.com/OBJECT_KEY for the concrete bucket and region, and substitute the egress allowlist authority in step. Scope is one bucket and the declared prefix, but the resource locator does not enforce the prefix — the concrete key binding at enablement and the AWS IAM policy on the principal (s3:GetObject limited to the prefix) must implement it.\n\nRegistered at R0, the read floor: validators enforce the verb floors, and shipped-pack discipline requires registration AT those floors; object content under a prefix is uncontrolled data, so policy SHOULD raise this tier at install. The bucket must be private for this custody model: GetObject can permit anonymous reads of public objects, so the absent signer is not an execution-denial control — see the pack notes.\n\nArchived objects refuse server-side until restored. Signing scope is declared explicitly (us-east-1/s3) because the shipped placeholder host derives none; after substitution of a real BUCKET.s3.REGION.amazonaws.com endpoint the connector derives scope from the endpoint.", "requires_review": true, "sign_region": "us-east-1", "sign_service": "s3", "sign": "aws-v4" }, { "capability_id": "aws.bedrock.foundation-models.list", "version": "1.1.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/foundation-models", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "aws-bedrock-control-plane", "description": "List the Amazon Bedrock foundation models the account can use in the endpoint's Region (ListFoundationModels), with provider, modalities, inference types and lifecycle status. Optional filters by provider, customization type, inference type and output modality.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.foundation-model-availability.get", "version": "1.1.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/foundation-model-availability/MODEL_ID", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "aws-bedrock-control-plane", "description": "Read one foundation model's access state (GetFoundationModelAvailability): agreement availability, authorization status, entitlement availability and Region availability. This is the model-access check. MODEL_ID is a placeholder to bind before enabling.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.foundation-model-agreement.create", "version": "1.1.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/create-foundation-model-agreement", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "create", "approve" ], "resource_id": "aws-bedrock-control-plane", "description": "Request a model access agreement for one model (CreateFoundationModelAgreement). The JSON body carries modelId and the offerToken of the offer being accepted. Accepting an offer agrees to its terms for the account, so the capability declares approve and registers at R3: a person approves each request. Choosing the offer and reading its terms happen before the call.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.guardrails.list", "version": "1.1.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/guardrails", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "aws-bedrock-control-plane", "description": "List the account's guardrails (ListGuardrails): id, ARN, name, status and version. Without guardrailIdentifier the call returns the DRAFT version of every guardrail; with it, every version of that guardrail.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.guardrail.create", "version": "1.1.0", "kind": "tool", "risk_tier": "R2", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/guardrails", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "create" ], "resource_id": "aws-bedrock-control-plane", "description": "Create a guardrail (CreateGuardrail) with content filters, denied topics, word filters, sensitive-information filters and contextual grounding checks. name, blockedInputMessaging and blockedOutputsMessaging are required. The new guardrail is a DRAFT; this pack does not register CreateGuardrailVersion.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.guardrail.update", "version": "1.1.0", "kind": "tool", "risk_tier": "R2", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/guardrails/GUARDRAIL_ID", "method": "PUT", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "update" ], "resource_id": "aws-bedrock-control-plane", "description": "Replace the configuration of a guardrail's DRAFT (UpdateGuardrail). An update can weaken or switch off filters that protect model traffic, so policy should raise this tier for production guardrails. GUARDRAIL_ID is a placeholder (id or ARN) to bind before enabling.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.guardrail.delete", "version": "1.1.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/guardrails/GUARDRAIL_ID", "method": "DELETE", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "delete" ], "resource_id": "aws-bedrock-control-plane", "description": "Delete a guardrail (DeleteGuardrail). With only the identifier, every version of the guardrail is deleted; the optional guardrailVersion query parameter deletes one version. The Bedrock API index has no operation that restores a deleted guardrail. GUARDRAIL_ID is a placeholder to bind before enabling.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.provisioned-throughput.list", "version": "1.1.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/provisioned-model-throughputs", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "aws-bedrock-control-plane", "description": "List the account's Provisioned Throughputs (ListProvisionedModelThroughputs): model, model units, status, commitment duration and commitment expiration time.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.provisioned-throughput.create", "version": "1.1.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "financial", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/provisioned-model-throughput", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "create", "pay" ], "resource_id": "aws-bedrock-provisioned-throughput", "description": "Buy dedicated throughput for a model (CreateProvisionedModelThroughput) with modelId, modelUnits and provisionedModelName. AWS bills it hourly, and an optional commitmentDuration (OneMonth or SixMonths) commits the account for that term; AWS documents that a Provisioned Throughput cannot be deleted before its commitment term is over. The capability declares pay at R3. The request body sets the amount, so a deployment that needs a bound must declare a cost ceiling at install.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.provisioned-throughput.delete", "version": "1.1.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/provisioned-model-throughput/PROVISIONED_MODEL_ID", "method": "DELETE", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "delete" ], "resource_id": "aws-bedrock-provisioned-throughput", "description": "Delete a Provisioned Throughput (DeleteProvisionedModelThroughput). AWS refuses the call before the commitment term is over. Capacity released this way is gone. PROVISIONED_MODEL_ID is a placeholder (id or ARN) to bind before enabling.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.invocation-logging.get", "version": "1.1.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/logging/modelinvocations", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "aws-bedrock-control-plane", "description": "Read the account's model invocation logging configuration in the Region (GetModelInvocationLoggingConfiguration): the CloudWatch Logs and S3 destinations and which data types (text, image, embedding, video, audio) are delivered.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.invocation-logging.put", "version": "1.1.0", "kind": "tool", "risk_tier": "R2", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/logging/modelinvocations", "method": "PUT", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "update" ], "resource_id": "aws-bedrock-control-plane", "description": "Set the model invocation logging configuration (PutModelInvocationLoggingConfiguration). The body names the log group, bucket and role that receive prompts and responses, so a change moves where model traffic is recorded. Policy should raise this tier where those logs hold regulated content.", "requires_review": true, "sign": "aws-v4" }, { "capability_id": "aws.bedrock.invocation-logging.delete", "version": "1.1.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "bedrock.us-east-1.amazonaws.com" ], "endpoint": "https://bedrock.us-east-1.amazonaws.com/logging/modelinvocations", "method": "DELETE", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-aws-bedrock-admin-sigv4-key-pair", "inject": "header", "inject_name": "Authorization", "actions": [ "delete" ], "resource_id": "aws-bedrock-control-plane", "description": "Delete the model invocation logging configuration (DeleteModelInvocationLoggingConfiguration), which stops invocation logging in the Region. Invocations made while logging is off are never recorded, so the gap cannot be repaired afterwards.", "requires_review": true, "sign": "aws-v4" } ], "resources": [ { "resource_id": "aws-iam-account", "kind": "api", "locator": "https://iam.amazonaws.com/doc/2010-05-08/", "data_class": "pii", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" }, { "resource_id": "aws-billing-account", "kind": "api", "locator": "https://ce.us-east-1.amazonaws.com/", "data_class": "financial", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" }, { "resource_id": "aws-s3-bucket-prefix", "kind": "bucket", "locator": "s3://BUCKET/OBJECT_PREFIX", "data_class": "internal", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" }, { "resource_id": "aws-bedrock-control-plane", "kind": "api", "locator": "https://bedrock.us-east-1.amazonaws.com/", "data_class": "internal", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" }, { "resource_id": "aws-bedrock-provisioned-throughput", "kind": "api", "locator": "https://bedrock.us-east-1.amazonaws.com/provisioned-model-throughputs", "data_class": "financial", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" } ], "review": { "state": "library", "date": "2026-10-22", "sources": [ "https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListUsers.html (retrieved 2026-09-21)", "https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListRoles.html (retrieved 2026-09-21)", "https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html (retrieved 2026-09-21)", "https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsage.html (retrieved 2026-09-21)", "https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html (retrieved 2026-09-21)", "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html (retrieved 2026-09-21)", "https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/Welcome.html (retrieved 2026-09-21)", "https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/CommonParameters.html (retrieved 2026-09-21)", "https://docs.aws.amazon.com/general/latest/gr/rande.html (retrieved 2026-09-21)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_ListFoundationModels.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_GetFoundationModelAvailability.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_CreateFoundationModelAgreement.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_ListGuardrails.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_CreateGuardrail.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_ListProvisionedModelThroughputs.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_CreateProvisionedModelThroughput.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteProvisionedModelThroughput.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_GetModelInvocationLoggingConfiguration.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_PutModelInvocationLoggingConfiguration.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteModelInvocationLoggingConfiguration.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/general/latest/gr/bedrock.html (retrieved 2026-10-22)", "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Operations_Amazon_Bedrock.html (retrieved 2026-10-22)" ], "reviewer_id": "owner-delegated" } }