Bedrock API key has no administrative or full-access grants

# Attach a minimal inline policy to the IAM user owning the Bedrock API key
resource "aws_iam_user_policy" "<example_resource_name>" {
  name = "least-priv-bedrock"
  user = "<example_resource_name>"

  # CRITICAL: allow only the specific action required; avoids admin or bedrock:* full access
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["bedrock:InvokeModel"]
      Resource = "*"
    }]
  })
}

# CloudFormation: attach least-privilege policy to the IAM user owning the Bedrock API key
Resources:
  <example_resource_name>:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: least-priv-bedrock
      Users:
        - <example_resource_name>
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - bedrock:InvokeModel  # CRITICAL: allow only needed Bedrock action to avoid admin or bedrock:* permissions
            Resource: "*"  # Limits access scope to only InvokeModel on any resource