Amazon Bedrock MAP Tagging using the AWS CLI

Must have an active MAP 2.0 Migration plan and Migration Program Engagement (MPE) number accepted after Dec 16 2024

Customers must gain access to supported foundation models only by using the Amazon Bedrock Console or API.

If using volume-based discounts (such as Provisioned Throughput for supported foundation models), these must be purchased only using the Amazon Bedrock Console or API.

Your role must have access to the inference profile API actions. If your role has the AmazonBedrockFullAccess AWS-managed policy attached, you can skip this step. Otherwise, follow the steps at Creating IAM policies and create the following policy, which allows a role to do inference profile-related actions and run model inference using all foundation models and inference profiles.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel*",
        "bedrock:CreateInferenceProfile"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/*",
        "arn:aws:bedrock:*:*:inference-profile/*",
        "arn:aws:bedrock:*:*:application-inference-profile/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:GetInferenceProfile",
        "bedrock:ListInferenceProfiles",
        "bedrock:DeleteInferenceProfile",
        "bedrock:TagResource",
        "bedrock:UntagResource",
        "bedrock:ListTagsForResource"
      ],
      "Resource": [
        "arn:aws:bedrock:*:*:inference-profile/*",
        "arn:aws:bedrock:*:*:application-inference-profile/*"
      ]
    }
  ]
}

Download and install the latest version of the AWS CLI.

Create the application inference profile with specific parameters.

Create an application inference profile: Open a new terminal on a machine that has the AWS CLI installed and configured and run the following CLI command:

$ aws bedrock create-inference-profile --inference-profile-name "myappinferenceprofile" --modelsource
"copyFrom=arn:aws:bedrock:us-east-1:123456789123:inference-profile/us.amazon.nova-pro-v1:0"

Enter a new name for the application inference profile and define a model source. The profile is created using a copy of the system inference profile using the “copyFrom” parameter. In this case I am using the Amazon Nova Pro system inference profile using its ARN. The model source is composed using the format:

arn:aws:bedrock:region:accountID:myInferenceProfile/ Inference Profile ID 

Replace the placeholders for your selected region where the new application inference profile will be created in and add your account ID. Select your preferred system inference profile ID from the list of available system inference profiles. The CLI output shows the created inference profile ARN and status as active.

{
"inferenceProfileArn": "arn:aws:bedrock:us-east-1:123456789123:application-inference-profile/k1c3lwu20lem",
"status": "ACTIVE"
}

The inferenceProfileArn that can be used in other inference profile-related actions and that can be used with model invocation and Amazon Bedrock resources.

Once the profile is created, obtain its ARN and use it to apply the “map-migrated” tag to it. This is done using the AWS tagging API.

Use the bedrock tag-resource CLI command to tag the created inference profile with the map-migrated tag and the value of your MAP agreement ID following the tagging guidelines.

$ aws bedrock tag-resource --resource-arn "arn:aws:bedrock:us-east-1:123456789123:applicationinference-
profile/k1c3lwu20lem" --tags "key=map-migrated,value=mig123456789"

For the –resource-arn, Use the generated ARN from previous step. Add the -–tags parameter using the key value pair as shown above replace the value to your corresponding MAP agreement ID with the prefix of “mig”.

You can list and update inference profiles and their review their tags. To confirm that the application inference profile is correctly tagged, you can list application profiles using the following CLI command:

$ aws bedrock list-inference-profiles --type-equals "APPLICATION"

This will list all application inference profiles showing the ARN, profile name and ID for each.

{
  "inferenceProfileSummaries": [
    {
      "inferenceProfileName": "myappinferenceprofile",
      "createdAt": "2025-01-14T21:21:54.414544+00:00",
      "updatedAt": "2025-01-14T21:21:54.414544+00:00",
      "inferenceProfileArn": "arn:aws:bedrock:us-east-1:123456789123:applicationinference-profile/53frgmx3ozbk",
      "models": [
        {
          "modelArn": "arn:aws:bedrock:us-east-1::foundation-model/amazon.nova-prov1:0"
        },
        {
          "modelArn": "arn:aws:bedrock:us-west-2::foundation-model/amazon.nova-prov1:0"
        },
        {
          "modelArn": "arn:aws:bedrock:us-east-2::foundation-model/amazon.nova-prov1:0"
        }
      ],
      "inferenceProfileId": "53frgmx3ozbk",
      "status": "ACTIVE",
      "type": "APPLICATION"
    }
  ]
}

If you know the inference Profile ID you can get the specific profile details using the CLI command:

{
  "inferenceProfileName": "myappinferenceprofile",
  "createdAt": "2025-01-14T21:21:54.414544+00:00",
  "updatedAt": "2025-01-14T21:21:54.414544+00:00",
  "inferenceProfileArn": "arn:aws:bedrock:us-east-1:123456789123:application-inferenceprofile/53frgmx3ozbk",
  "models": [
    {
      "modelArn": "arn:aws:bedrock:us-east-1::foundation-model/amazon.nova-pro-v1:0"
    },
    {
      "modelArn": "arn:aws:bedrock:us-west-2::foundation-model/amazon.nova-pro-v1:0"
    },
    {
      "modelArn": "arn:aws:bedrock:us-east-2::foundation-model/amazon.nova-pro-v1:0"
    }
  ],
  "inferenceProfileId": "53frgmx3ozbk",
  "status": "ACTIVE",
  "type": "APPLICATION"
}

Using the ARN of the corresponding profile, use the following CLI command to list the resource tags:

$ aws bedrock list-tags-for-resource --resource-arn "arn:aws:bedrock:us-east-
1:123456789123:application-inference-profile/k1c3lwu20lem"

The output will list tags associated with the profile.

{
  "tags": [
    {
      "key": "map-migrated",
      "value": "mig123456789"
    }
  ]
}