What permissions does the AWS AmazonBedrockReadOnly Managed Policy grant?

What the AmazonBedrockReadOnly managed policy actually covers

AmazonBedrockReadOnly is a read-only AWS managed policy for Amazon Bedrock. Its practical effect is to let a principal inspect Bedrock configuration, models, applications, and related metadata, but not alter them. That makes it useful for visibility, review, and support tasks where you want assurance about how Bedrock is configured without granting the ability to change production settings.

The key distinction is between viewing and modifying. Read-only access should support discovery and troubleshooting, not deployment or administration. If a workflow needs creation, update, or deletion rights, this policy is the wrong baseline because it is intentionally scoped to observation rather than control.

How to use read-only access without expanding privilege

In practice, this policy is best suited to auditors, security reviewers, platform engineers, and support roles that need to inspect Bedrock resources. It fits well when the goal is to verify configuration state, confirm inventory, or investigate an issue without risking unintended changes. For that reason, it should usually be combined with a clear role design and explicit separation between review access and operator access.

The important judgment is that read-only does not guarantee low risk by itself. A principal that can inspect settings may still learn model names, deployment details, integration patterns, or other operational context that is useful to an attacker if the identity is compromised. AWS IAM policy evaluation still matters because effective access is the result of all applicable policies, not this managed policy alone. AWS IAM Policies and Roles Guide explains how policy evaluation, permission boundaries, and role chaining interact to determine the final permission set.

Because the policy only grants inspection rights, teams should treat it as a visibility control rather than a complete governance control. If you need to understand whether the identity can do more than Bedrock read actions, review attached identity-based policies, resource-based policies, session policies, and any permissions boundary before assuming the access is truly limited.

What to check before you trust a Bedrock read-only role

Before relying on this policy for safe review access, confirm the principal has no supporting permissions elsewhere that turn read-only into effective write access. This is especially important in environments with broad role assumptions, inherited group membership, or multiple policy attachments. A read-only managed policy can look benign while the overall role remains over-privileged.

You should also confirm whether the role is used by a human reviewer, an automation workflow, or another system component. Read-only access for humans is a different risk profile from read-only access for a machine process, because the latter can be reused, chained, or copied into other automation paths more easily. AWS distinguishes between permission intent and final effective access, so validation has to happen at the role level, not the policy-name level. Cloud PAM and CIEM Guide is useful when you need to right-size effective permissions instead of assuming the attached policy tells the full story.

If the purpose is audit or troubleshooting, verify that the principal can observe only what is needed for that task. The most common implementation mistake is to grant read-only access as a temporary convenience and then leave it in place permanently, which creates a durable visibility surface even when no active administration is required.

Risk and Threat Considerations

Read-only access can still create exposure if it is broader than the job requires or if it is attached to a role that can be assumed widely. The main risk is not direct modification, but information exposure and privilege confusion, where an observer can map resources, settings, and operational relationships that help later abuse.

Failure mechanism: The policy is treated as inherently safe, while other attached permissions, inherited access, or role assumptions quietly expand the effective permission set beyond read-only inspection.

Impact: Attackers or insiders who obtain the role can use the visibility it provides to inventory resources, identify weak points, and prepare for follow-on abuse, even if they cannot directly change Bedrock settings.

Practitioner Guidance

What to verify: Confirm the role has no write-capable companion permissions, no broad permission boundary exceptions, and no resource-based policy path that overrides the intended read-only scope.

Common mistake: Teams often treat a managed policy name as the full access story. In AWS, the effective result comes from the whole authorization chain, so the safe question is not “what does this policy say?” but “what can the principal actually do?”

Practitioner takeaway: Use AmazonBedrockReadOnly for inspection tasks only, then validate the full effective permission set before you treat the role as harmless.

Related resources from NHI Mgmt Group

• What permissions does the AWS AmazonEC2FullAccess managed policy grant?
• What permissions does the AWS AmazonECS_FullAccess managed policy grant?
• What permissions does the AWS AmazonGuardDutyFullAccess managed policy grant?
• What permissions does the AWS AmazonGuardDutyReadOnlyAccess managed policy grant?