How do I resolve AWS Marketplace permissions errors that appear when I invoke third-party foundation models in Amazon Bedrock?

Short description

When you invoke a third-party model in Amazon Bedrock for the first time, you might get one of the following error messages:

• "AccessDeniedException: Model access is denied due to IAM user or service role is not authorized to perform the required AWS Marketplace actions (aws-marketplace:ViewSubscriptions, aws-marketplace:Subscribe) to enable access to this model."
• "AccessDeniedException: Model access is denied due to example-IAM-ARN is not authorized to perform: aws-marketplace:Subscribe on resource: * because no identity-based policy allows the action."

The preceding error messages can appear in model invocations, Amazon Bedrock knowledge base data sync operations, and Amazon Bedrock Agent invocations.

When you first invoke a third-party model, Amazon Bedrock automatically initiates an AWS Marketplace subscription. If the AWS Identity and Access Management (IAM) role that makes the request doesn't have the required AWS Marketplace permissions, then the automatic subscription fails. Subsequent invocations return "AccessDeniedException" errors. For more information, see Request access to models.

To automatically activate each model in each AWS account for the first time, your IAM role must have the required permissions.

Note: After you grant the necessary permissions, it might take up to 2 minutes for a subscription to complete. During this time, you might continue to receive an "AccessDeniedException" error.

After you activate a model, all the IAM roles in the account can invoke the model without AWS Marketplace permissions.

Note: Amazon, DeepSeek, Mistral AI, Meta, Qwen, and OpenAI, don't require AWS Marketplace permissions because these models aren't available in the AWS Marketplace.

If your organization must review End User License Agreements (EULAs), then review the EULA terms first before you allow access to the model. To block model access, use service control policies (SCPs) or IAM policies.

Resolution

Grant AWS Marketplace permissions to the IAM entity

Add the following IAM policy to the IAM entity that invokes the model:

}
    "Version": "2012-10-17",
    "Statement": [
         {
            "Effect": "Allow",
            "Action": [
               "aws-marketplace:Subscribe",
               "aws-marketplace:ViewSubscriptions"
            ],
            "Resource": "*"
         }
    ]
}

Have an administrator invoke the model

If you can't grant AWS Marketplace permissions to all users and roles, then an administrator with AWS Marketplace permissions must invoke the model. Then, all IAM users in the account can invoke the model without AWS Marketplace permissions. For more information, see Simplified model access in Amazon Bedrock.

Use the AWS API or CLI to activate the model

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

To use an IAM entity with the required AWS Marketplace permissions to programmatically activate the model but not invoke it, complete the following steps:

1. Run the following list-foundation-model-agreement-offers AWS CLI command:

   aws bedrock list-foundation-model-agreement-offers --model-id example-model-id1

   Note: Replace example-model-id with model ID. In the output, note the model's offer token to use in the next step.
2. Run the following create-foundation-model-agreement command to activate the model:

   aws bedrock create-foundation-model-agreement \
   --model-id example-model-id \
   --offer-token example-offer-token

   Note: Replace example-model-id with the model ID and example-offer-token with the offer token.

For more information, see Manage model access using SDK and CLI.

Note: For Anthropic models, you must complete the First Time Use (FTU) form before you run the create-foundation-model-agreement command. To submit your details, run the put-use-case-for-model-access command. For more information, see Step 2: [Required one-time for Anthropic models only] Put use case for first-time user.