---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable IAM and boundary checks for Amazon Bedrock access

# Enable IAM and boundary checks for Amazon Bedrock access {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Enable IAM and Boundary Checks for Amazon Bedrock access.
AWS permissions for Amazon Bedrock are set using Identity and Access Management (IAM) policies. For example, the `bedrock:InvokeModel` policy allows an application to call `InvokeModel` function on
all available models in all AWS regions. Bedrock boundaries restrict the scope of permissions granted by IAM policies. For example, a boundary can limit the `bedrock:InvokeModel` permission to only the Haiku 3.5 model and
specific regions.

The sn_ai_security.bedrock_priviledge.permission_policy system property determines whether an application checks both the IAM policy and the Bedrock boundary configuration to verify whether a role is allowed to
perform a privileged operation.

When set to the recommended value of <kbd class="ph userinput">false</kbd>, the application validates both checks. If it is set to <kbd class="ph userinput">true</kbd>, then the application checks only on the IAM policy to decide whether a role is
privileged.

Set the sn_ai_security.bedrock_priviledge.permission_policy system property to <kbd class="ph userinput">false</kbd> or ensure that it doesn't exist in the sys_properties table to support defense in depth.

## More information {#sc-enable-multiple-permission__section_wc1_cqn_phc}

{#sc-enable-multiple-permission__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | sn_ai_security.bedrock_priviledge.permission_policy |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | false |
| Fallback value | false |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 4.8 * CVSS score: Medium * Security risk details: Unintended unauthorized access to all resources under one IAM policy on Amazon Bedrock and within multiple AWS regions. This could include all available AI models within all regions. {#sc-enable-multiple-permission__ul_g1g_3sf_xwb} |
| Functional impact | Based on the property value, the application either checks only the IAM policy or checks both the IAM policy and the Amazon Bedrock boundary configuration to verify whether a role has the required privileges. |
| Dependencies and prerequisites | None |
[ ]

{#sc-enable-multiple-permission__table_ajc_b43_3kb}