---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable multiple (permission policy and boundary) checks to ensure that the Role is privileged in AWS/Bedrock

# Enable multiple (permission policy and boundary) checks to ensure that the Role is privileged in AWS/Bedrock {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use a system property to determine what checks are used to verify whether a role is allowed to perform a privileged operation.
AWS Permission can be set using Identity and Access Management (IAM) policies such as `bedrock:InvokeModel` that allow an application to call InvokeModel function on all available models in all regions. Boundary in
bedrock is used to limit the maximum permission such as `Limit bedrock:InvokeModel` to only the haiku-3.5 model and specific regions.

The sn_ai_security.bedrock_priviledge.permission_policy system property determines whether an application checks both IAM policy and the bedrock boundary configuration to verify whether a role is allowed to
perform a privileged operation.

This property enables multiple (permission policy and boundary) checks to ensure that the role is privileged in AWS/Bedrock. If it is not set to the recommended value of <kbd class="ph userinput">false</kbd>, then the application relies
only on IAM policy to decide whether a role is privileged.

Set the sn_ai_security.bedrock_priviledge.permission_policy system property to <kbd class="ph userinput">false</kbd> or ensure that it doesn't exist in the System Properties \[sys_properties\] table to help ensure defense
in depth.

## More information {#sc-enable-multiple-permission-policy-and-boundary-checks-to-ensure-that-the-role-is-privileged-in-aws-bedrock__section_wc1_cqn_phc}

{#sc-enable-multiple-permission-policy-and-boundary-checks-to-ensure-that-the-role-is-privileged-in-aws-bedrock__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | sn_ai_security.bedrock_priviledge.permission_policy |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | false |
| Fallback value | false |
| Category | [Access control](https://servicenow-prod.fluidtopics.net/xAmazkRh5FKyeb7q4TQGWw "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 4.8 * CVSS score: Medium * Security risk details: Unintended unauthorized access to all resources under one IAM policy on AWS bedrock and within multiple regions. This could include all available AI models within all regions of AWS. {#sc-enable-multiple-permission-policy-and-boundary-checks-to-ensure-that-the-role-is-privileged-in-aws-bedrock__ul_g1g_3sf_xwb} |
| Functional impact | Based on the property value, the application checks either IAM policy only within AWS or also checks boundary configuration within AWS/Bedrock along with IAM policy in order to verify whether a role associated to a request is privileged or not. |
| Dependencies and prerequisites | None |
[ ]

{#sc-enable-multiple-permission-policy-and-boundary-checks-to-ensure-that-the-role-is-privileged-in-aws-bedrock__table_ajc_b43_3kb}