Skip to main content

Enable AWS Bedrock foundation models

This article walks through the steps needed to activate AWS Bedrock foundation models for use with SurePath AI's Private portal

Updated over 3 months ago

Enable AWS Bedrock foundation models

A new process

AWS transitioned access to Amazon Bedrock foundation models from the previous "Model Access" request flow to Marketplace subscription offers. Access to all Amazon Bedrock foundation models is enabled by default with the correct AWS Marketplace permissions. When users select a model from the model catalog in the Amazon Bedrock console and open it in the playground or invoke the model using the API, access is automatically granted.

Method 1: Enable models using the Amazon Bedrock console (recommended)

The simplest way to enable a foundation model is to use the Amazon Bedrock console playground. This method automatically handles the marketplace subscription offer acceptance.

Prerequisites

  • The AWS account must have permissions to accept AWS Marketplace offers. Coordinate with the AWS account owner or cloud security team to confirm that accepting marketplace product offers is allowed for the role used to access the console.

  • The IAM role must have permissions for Amazon Bedrock APIs and any required AWS Marketplace actions as governed by your organization's policies.

Steps to enable a model

  • Sign in to the Amazon Bedrock console at https://console.aws.amazon.com/bedrock/.

  • In the left navigation pane, under Bedrock configurations, choose Model catalog.

  • Select the model to enable.

  • Choose Open in Playground.

  • Send a test prompt to the model in the playground.

  • If the model returns a response, the model is successfully enabled for the AWS account.

Handling delays

Due to marketplace subscription propagation delays, the first request may not succeed immediately:

  • If the first request fails or times out, wait a few moments and try again.

  • The model should respond successfully on the second attempt.

  • Once enabled, the model becomes available for all users in the AWS account across all regions where the model is supported.

Provider-specific requirements

  • Anthropic models: First-time customers must submit use case details once per account or once at the organization's management account. The Amazon Bedrock console will prompt for this information when selecting an Anthropic model. Access is granted immediately after successful submission.

Method 2: Enable models using the AWS CLI

For organizations that prefer command-line workflows or need to enable models programmatically, the AWS CLI provides an alternative method to accept marketplace subscription offers.

Prerequisites

  • The AWS account must have permissions to accept AWS Marketplace offers. Coordinate with the AWS account owner or cloud security team to confirm that accepting marketplace product offers is allowed for the role used to run these steps.

  • The AWS CLI must be installed and configured with credentials and the target Region where the model will be used.

  • The IAM role running these commands must have permissions for Amazon Bedrock APIs and any required AWS Marketplace actions as governed by your organization's policies.

Step 1: Identify the model ARN

  • In the AWS console, navigate to Amazon Bedrock, open the Model catalog, choose Providers, select the model, and copy the model ID/ARN shown for that model.

  • Use this value as the --model-id in the following commands.

Step 2: Sign in with IAM Identity Center (SSO)

aws sso login --profile <profile-name>

  • If you use sso-session configuration, you can log in by session name:

aws sso login --sso-session <session-name>

  • To run subsequent commands with the same profile, either set AWS_PROFILE=<profile-name> in your shell or append --profile <profile-name> to each command.

Note: An AWS SSO profile is required only if your organization uses IAM Identity Center for CLI authentication. If you already have valid credentials configured (for example, access keys or an assume-role profile), you can skip this step and run the commands with that profile.

Step 3: List available subscription offers

Run the following command to list the subscription offers for the selected model. Copy the offerToken value for use in the next step.

aws bedrock list-foundation-model-agreement-offers \  --model-id <model-arn>

PowerShell:

aws bedrock list-foundation-model-agreement-offers `  --model-id <model-arn>

Return only the offer token (concise output):

aws bedrock list-foundation-model-agreement-offers \  --model-id <model-arn> \  --query 'offers[].offerToken' \  --output text

PowerShell (concise output):

aws bedrock list-foundation-model-agreement-offers `  --model-id <model-arn> `  --query "offers[].offerToken" `  --output text

Step 4: Accept the offer (create the agreement)

Use the offerToken from the previous command to create the foundation model agreement (i.e., accept the subscription offer):

aws bedrock create-foundation-model-agreement \  --model-id <model-arn> \  --offer-token <offer-token>

PowerShell:

aws bedrock create-foundation-model-agreement `  --model-id <model-arn> `  --offer-token <offer-token>

Complete example

The following shows the full flow with made-up values.

In this example:

  • Profile: my-dev-profile

  • Model ID/ARN: anthropic.claude-3-5-sonnet-20240620-v1:0

Bash:

# 1) Sign in with SSO (if your org uses IAM Identity Center)
aws sso login --profile my-dev-profile

# 2) Use the profile for subsequent commands
export AWS_PROFILE=my-dev-profile

# 3) Get only the offer token
OFFER_TOKEN=$(aws bedrock list-foundation-model-agreement-offers \  --model-id anthropic.claude-3-5-sonnet-20240620-v1:0 \  --query 'offers[0].offerToken' \  --output text)

# Example: echo the token (shortened here)echo "$OFFER_TOKEN"# => AQICAFAKEOFFER...==

# 4) Create the agreement (accept the offer)
aws bedrock create-foundation-model-agreement \  --model-id anthropic.claude-3-5-sonnet-20240620-v1:0 \  --offer-token "$OFFER_TOKEN"

PowerShell:

# 1) Sign in with SSO (if your org uses IAM Identity Center)
aws sso login --profile my-dev-profile

# 2) Use the profile for subsequent commands
$env:AWS_PROFILE = "my-dev-profile"

# 3) Get only the offer token
$offerToken = aws bedrock list-foundation-model-agreement-offers `  --model-id anthropic.claude-3-5-sonnet-20240620-v1:0 `  --query "offers[0].offerToken" `  --output text

# Example: write the token (shortened here)Write-Output $offerToken# => AQICAFAKEOFFER...==

# 4) Create the agreement (accept the offer)
aws bedrock create-foundation-model-agreement `  --model-id anthropic.claude-3-5-sonnet-20240620-v1:0 `  --offer-token $offerToken

Propagation and first-invocation timing

After the first invocation, allow up to 15 minutes for the marketplace subscription to fully propagate. During this period:

  • The first call may succeed even though the subscription is not fully activated.

  • Subsequent calls may fail while propagation is in progress.

  • After approximately 15 minutes, all calls should succeed consistently.

If errors persist beyond 15 minutes, verify that the agreement was created for the correct Region and that the AWS account has permissions to accept AWS Marketplace offers.

Additional notes

  • Some providers' models are not sold through AWS Marketplace and do not have product IDs. Access control for these models is managed via Amazon Bedrock permissions rather than marketplace product scoping.

References

Related Articles
Model connectors
Updating Access Permissions for SurePath AI's CloudFormation Stack
Connecting an AWS Knowledge Base to Microsoft Sharepoint
Connecting an AWS Knowledge Base to Confluence
Did this answer your question?