fix: allow bedrock marketplace auto-subscription for opencode user

[xnoto]

Summary

OpenCode failed on first invoke with:

Model access is denied due to IAM user or service role is not authorized to perform the required AWS Marketplace actions (aws-marketplace:ViewSubscriptions, aws-marketplace:Subscribe)

Since the Model access console page was retired, first invocation of a model auto-subscribes the account — performed by Bedrock via AWS Marketplace on the caller's behalf. The opencode-bedrock user lacked those actions, so any not-yet-subscribed model failed.

Adds the AWS-documented statement to the user policy, scoped with aws:CalledViaLast = bedrock.amazonaws.com so Subscribe can only be exercised through Bedrock.

Validation

• make test — all canonical pre-commit hooks pass (tofu validate -backend=false, tflint, checkov, fmt, terraform-docs, gitleaks)
• Purely additive IAM policy statement; CI plan authoritative

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:
# aws_iam_user_policy.bedrock_opencode will be updated in-place
~ resource "aws_iam_user_policy" "bedrock_opencode" {
id = "opencode-bedrock:bedrock-invoke"
name = "bedrock-invoke"
~ policy = jsonencode(
~ {
~ Statement = [
# (3 unchanged elements hidden)
{
Action = [
"bedrock:ListModelInvocationJobs",
]
Effect = "Allow"
Resource = "*"
Sid = "ListBatchJobs"
},
~ {
~ Action = [
- "s3:GetObject",
- "s3:PutObject",
- "s3:ListBucket",
+ "aws-marketplace:ViewSubscriptions",
+ "aws-marketplace:Subscribe",
]
+ Condition = {
+ StringEquals = {
+ "aws:CalledViaLast" = "bedrock.amazonaws.com"
}
}
~ Resource = [
- "arn:aws:s3:::mitw-bedrock-batch",
- "arn:aws:s3:::mitw-bedrock-batch/*",
] -> "*"
~ Sid = "BatchDataS3Access" -> "MarketplaceModelSubscription"
# (1 unchanged attribute hidden)
},
~ {
~ Action = [
- "iam:PassRole",
+ "s3:GetObject",
+ "s3:PutObject",
+ "s3:ListBucket",
]
- Condition = {
- StringEquals = {
- "iam:PassedToService" = "bedrock.amazonaws.com"
}
}
~ Resource = "arn:aws:iam::332355796717:role/bedrock-batch-inference" -> [
+ "arn:aws:s3:::mitw-bedrock-batch",
+ "arn:aws:s3:::mitw-bedrock-batch/*",
]
~ Sid = "PassBatchServiceRole" -> "BatchDataS3Access"
# (1 unchanged attribute hidden)
},
+ {
+ Action = [
+ "iam:PassRole",
]
+ Condition = {
+ StringEquals = {
+ "iam:PassedToService" = "bedrock.amazonaws.com"
}
}
+ Effect = "Allow"
+ Resource = "arn:aws:iam::332355796717:role/bedrock-batch-inference"
+ Sid = "PassBatchServiceRole"
},
]
# (1 unchanged attribute hidden)
}
)
# (1 unchanged attribute hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.