{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeDomainInferenceProfiles",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonDataZoneDomain": "${datazone:domainId}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        },
        "Null": {
          "aws:ResourceTag/AmazonDataZoneProject": "true"
        }
      }
    },
    {
      "Sid": "ListFoundationModels",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BedrockCreateSessionWithTagsPermissions",
      "Effect": "Allow",
      "Action": [
        "bedrock:CreateSession",
        "bedrock:TagResource"
      ],
      "Resource": "arn:aws:bedrock:*:*:session/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:RequestTag/AmazonDataZoneUser": "${datazone:userId}",
          "aws:ResourceTag/AmazonDataZoneUser": "${datazone:userId}",
          "aws:RequestTag/AmazonDataZoneDomain": "${datazone:domainId}",
          "aws:ResourceTag/AmazonDataZoneDomain": "${datazone:domainId}"
        },
        "StringNotEquals": {
          "aws:RequestTag/AmazonDataZoneUser": "",
          "aws:ResourceTag/AmazonDataZoneUser": "",
          "aws:RequestTag/AmazonDataZoneDomain": "",
          "aws:ResourceTag/AmazonDataZoneDomain": ""
        },
        "ForAllValues:StringLike": {
          "aws:TagKeys": "AmazonDataZone*"
        },
        "Null": {
          "aws:RequestTag/AmazonDataZoneProject": "true",
          "aws:ResourceTag/AmazonDataZoneProject": "true"
        }
      }
    },
    {
      "Sid": "BedrockSessionPermissions",
      "Effect": "Allow",
      "Action": [
        "bedrock:GetSession",
        "bedrock:UpdateSession",
        "bedrock:DeleteSession",
        "bedrock:EndSession",
        "bedrock:CreateInvocation",
        "bedrock:ListInvocations",
        "bedrock:PutInvocationStep",
        "bedrock:GetInvocationStep",
        "bedrock:ListInvocationSteps",
        "bedrock:ListTagsForResource"
      ],
      "Resource": "arn:aws:bedrock:*:*:session/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/AmazonDataZoneUser": "${datazone:userId}",
          "aws:ResourceTag/AmazonDataZoneDomain": "${datazone:domainId}"
        },
        "StringNotEquals": {
          "aws:ResourceTag/AmazonDataZoneUser": "",
          "aws:ResourceTag/AmazonDataZoneDomain": ""
        },
        "Null": {
          "aws:ResourceTag/AmazonDataZoneProject": "true"
        }
      }
    },
    {
      "Sid": "BedrockListSessionsPermissions",
      "Effect": "Allow",
      "Action": "bedrock:ListSessions",
      "Resource": "*"
    }
  ]
}