Create a custom service role for batch inference
To use a custom service role for batch inference instead of the one Amazon Bedrock automatically creates for you in the AWS Management Console, create an IAM role and attach the following permissions by following the steps at Creating a role to delegate permissions to an AWS service.
Trust relationship
The following trust policy allows Amazon Bedrock to assume this role and submit and manage batch inference jobs. Replace the values as necessary. The policy contains optional condition keys (see Condition keys for Amazon Bedrock and AWS global condition context keys) in the Condition field that we recommend you use as a security best practice.
Note
As a best practice for security purposes, replace the * with specific batch inference job IDs after you have created them.
Identity-based permissions for the batch inference service role.
The following topics describe and provide examples of permissions policies that you might need to attach to your custom batch inference service role, depending on your use case.
Topics
(Required) Permissions to access input and output data in Amazon S3
To allow a service role to access the Amazon S3 bucket containing your input data and the bucket to which to write your output data, attach the following policy to the service role. Replace values as necessary.
(Optional) Permissions to use a customer managed key
If you encrypt your batch inference data with a customer managed AWS KMS key instead of an AWS managed key, the service role also needs permissions on that key. Two separate cases apply, and you only need the permissions for the cases that match your setup:
kms:Decrypt– required when your input data is in an Amazon S3 bucket encrypted with a customer managed key, so that the service role can read your input files.kms:GenerateDataKey– required when you choose a customer managed key for your output data, either by settings3EncryptionKeyIdin the API or by choosing Customize encryption settings (advanced) in the AWS Management Console, so that the service role can write your output files.
To grant both, attach the following policy to the service role. Replace region, account-id, and key-id with your own values. If you use a different key for input and output, add a statement for each key.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "BatchInferenceCustomerManagedKey", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:region:account-id:key/key-id", "Condition": { "StringEquals": { "kms:ViaService": "s3.region.amazonaws.com" } } } ] }
Note
The kms:ViaService condition specifies Amazon S3, not Amazon Bedrock, because the service role's calls to AWS KMS are made through Amazon S3 when it reads your input files and writes your output files. This condition is optional; omit it if you don't want to restrict the key to Amazon S3.
Important
If these key permissions are missing, the job is still accepted when you submit it and then fails a few minutes later. The failure message reports that Amazon Bedrock could not validate GetObject or PutObject permissions for your Amazon S3 bucket, and does not mention AWS KMS. If you see that message and the Amazon S3 permissions in the preceding section are already correct, check the key permissions described here.
(Optional) Permissions to run batch inference with inference profiles
To run batch inference with an inference profile, a service role must have permissions to invoke the inference profile in an AWS Region, in addition to the model in each Region in the inference profile.
For permissions to invoke with a cross-Region (system-defined) inference profile, use the following policy as a template for the permissions policy to attach to your service role:
For permissions to invoke with an application inference profile, use the following policy as a template for the permissions policy to attach to your service role: