Bedrock — Inference Profiles

Directory: global/bedrock/

Files: profiles.tf, outputs.tf, variables.tf

What It Manages

Shared application inference profiles for org-wide R&D and experimentation. Per ADR-0007, all Bedrock invocations must use a Terraform-managed application inference profile — never a raw model ID.

Profiles

All profiles use EU cross-region inference (source: eu.anthropic.claude-*) to keep traffic within EU regions (eu-central-1, eu-west-1, eu-west-3).

Tags

Profiles inherit the global Tier 1 tag set via default_tags and override billing-mode to rd at the resource level, per ADR-0006.

Outputs

Consumer Guide

Each repository that invokes Bedrock through these profiles is responsible for granting its own IAM permissions. This infra repo creates the profiles; consuming repos own the invoke access.

What you need

1. The profile ARN — use it as the modelId parameter in Bedrock API calls (InvokeModel, Converse). Never pass a raw model ID.
2. IAM permissions on the calling role (Lambda, ECS task role, etc.).

Required IAM policy

Grant invoke access to both the application inference profile and the underlying foundation model. The * region on the foundation model is required because EU cross-region profiles route across eu-central-1, eu-west-1, and eu-west-3.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeBedrockProfile",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:eu-central-1:{ACCOUNT_ID}:application-inference-profile/<PROFILE_ID>"
      ]
    },
    {
      "Sid": "InvokeFoundationModel",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/<MODEL_ID>"
      ]
    }
  ]
}

Replace <PROFILE_ID> and <MODEL_ID> with the values from the profiles table above.

Known consumers

• ontopix/schemas-sdk — E2E tests via BEDROCK_INFERENCE_PROFILE_ARN
• Any service calling submitBatch() or enrich() from the schemas SDK
• General R&D and experimentation across the org

Adding a New Profile

1. Add an entry to the inference_profiles map in global/main.tf
2. Use an EU cross-region inference profile ARN as the model_arn
3. Follow the naming convention: rd-{model-short}
4. Run task infra:plan and request approval

Related

• ADR-0007: Bedrock Inference Profiles — Why application inference profiles are mandatory
• ADR-0006: AWS Resource Tagging — Tagging taxonomy