fix(graphql-generation-transformer): grant InvokeModel on inference profile and underlying models

The @generation transformer builds an AppSync->Bedrock IAM role that
scoped bedrock:InvokeModel to a single regional foundation-model ARN
(arn:<partition>:bedrock:<region>::foundation-model/<modelId>). For a
cross-region inference profile id (us./eu./apac. prefix) that ARN is
wrong: invoking a profile requires InvokeModel on the inference-profile
ARN AND on the underlying regional foundation-model ARNs the profile
routes to. As a result, customers using a cross-region profile model id
with @generation hit runtime AccessDenied.

When the model id matches /^(us|eu|apac)\./ the role now grants
InvokeModel on both the inference-profile ARN
(arn:<partition>:bedrock:<region>:<account>:inference-profile/<modelId>)
and the underlying foundation-model ARN with a wildcard region
(arn:<partition>:bedrock:*::foundation-model/<foundationModelId>), where
the underlying model id is the profile id with the region prefix
stripped. Plain foundation-model ids keep the existing single-ARN
behavior. All ARNs use CDK account/region/partition tokens.

Added unit/snapshot tests proving a plain FM id grants only the
foundation-model ARN (unchanged) and an inference-profile id grants both
the profile ARN and the wildcard-region foundation-model ARN. The
generation transformer unit tests run offline and all 16 pass.

---
Prompt: Draft the OPTION A product fix as its own branch/PR. The
@generation transformer scopes bedrock:InvokeModel to a single
foundation-model ARN; for a cross-region inference profile id that ARN
is wrong, so @generation + cross-region profile hits AccessDenied.
Implement granting InvokeModel on both the inference-profile ARN and the
underlying regional foundation-model ARNs (wildcard region), add tests,
build, commit, push, and open a draft PR off main.

Author: sarayev

packages/amplify-graphql-generation-transformer/src/__tests__/__snapshots__/amplify-graphql-generation-transformer.test.ts.snap

@@ -148,6 +148,62 @@ function createUserAgent(request) {
 }
 `;
 
+exports[`generation route bedrock InvokeModel IAM resources cross-region inference profile id grants the profile ARN and wildcard-region foundation-model ARN 1`] = `
+[
+  {
+    "Fn::Join": [
+      "",
+      [
+        "arn:",
+        {
+          "Ref": "AWS::Partition",
+        },
+        ":bedrock:",
+        {
+          "Ref": "AWS::Region",
+        },
+        ":",
+        {
+          "Ref": "AWS::AccountId",
+        },
+        ":inference-profile/us.anthropic.claude-haiku-4-5-20251001-v1:0",
+      ],
+    ],
+  },
+  {
+    "Fn::Join": [
+      "",
+      [
+        "arn:",
+        {
+          "Ref": "AWS::Partition",
+        },
+        ":bedrock:*::foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0",
+      ],
+    ],
+  },
+]
+`;
+
+exports[`generation route bedrock InvokeModel IAM resources plain foundation-model id grants the foundation-model ARN only 1`] = `
+{
+  "Fn::Join": [
+    "",
+    [
+      "arn:",
+      {
+        "Ref": "AWS::Partition",
+      },
+      ":bedrock:",
+      {
+        "Ref": "AWS::Region",
+      },
+      "::foundation-model/anthropic.claude-3-haiku-20240307-v1:0",
+    ],
+  ],
+}
+`;
+
 exports[`generation route custom query 1`] = `
 {
   "Fn::Join": [

packages/amplify-graphql-generation-transformer/src/__tests__/amplify-graphql-generation-transformer.test.ts

@@ -326,6 +326,55 @@ describe('generation route invalid inference configuration', () => {
 });
 // });
 
+describe('generation route bedrock InvokeModel IAM resources', () => {
+  const generationRoute = (aiModel: string): string => `
+    type Query {
+        generate(description: String!): String
+        @generation(
+          aiModel: "${aiModel}",
+          systemPrompt: "Make a string based on the description."
+        )
+    }
+  `;
+
+  const getBedrockInvokeResources = (out: DeploymentResources, fieldName: string): unknown => {
+    const stackName = `GenerationBedrockDataSource${fieldName}Stack`;
+    const stack = out.stacks[stackName];
+    expect(stack).toBeDefined();
+
+    const role = Object.values(stack.Resources ?? {}).find(
+      (resource: any) => resource.Type === 'AWS::IAM::Role' && resource.Properties?.Policies,
+    ) as any;
+    expect(role).toBeDefined();
+
+    const statement = role.Properties.Policies[0].PolicyDocument.Statement.find(
+      (s: any) => Array.isArray(s.Action) ? s.Action.includes('bedrock:InvokeModel') : s.Action === 'bedrock:InvokeModel',
+    );
+    expect(statement).toBeDefined();
+    return statement.Resource;
+  };
+
+  test('plain foundation-model id grants the foundation-model ARN only', () => {
+    const out = transform(generationRoute('anthropic.claude-3-haiku-20240307-v1:0'));
+    const resources = getBedrockInvokeResources(out, 'Generate');
+    const serialized = JSON.stringify(resources);
+
+    expect(serialized).toContain('foundation-model/anthropic.claude-3-haiku-20240307-v1:0');
+    expect(serialized).not.toContain('inference-profile');
+    expect(resources).toMatchSnapshot();
+  });
+
+  test('cross-region inference profile id grants the profile ARN and wildcard-region foundation-model ARN', () => {
+    const out = transform(generationRoute('us.anthropic.claude-haiku-4-5-20251001-v1:0'));
+    const resources = getBedrockInvokeResources(out, 'Generate');
+    const serialized = JSON.stringify(resources);
+
+    expect(serialized).toContain('inference-profile/us.anthropic.claude-haiku-4-5-20251001-v1:0');
+    expect(serialized).toContain('foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0');
+    expect(resources).toMatchSnapshot();
+  });
+});
+
 const getResolverResource = (queryName: string, resources?: Record<string, any>): Record<string, any> => {
   const resolverName = `Query${queryName}Resolver`;
   return resources?.[resolverName];

packages/amplify-graphql-generation-transformer/src/grapqhl-generation-transformer.ts

@@ -207,14 +207,47 @@ export class GenerationTransformer extends TransformerPluginBase {
             new iam.PolicyStatement({
               effect: iam.Effect.ALLOW,
               actions: ['bedrock:InvokeModel'],
-              resources: [`arn:${cdk.Stack.of(dataSourceScope).partition}:bedrock:${region}::foundation-model/${bedrockModelId}`],
+              resources: this.bedrockInvokeModelResources(dataSourceScope, region, bedrockModelId),
             }),
           ],
         }),
       },
     });
   }
 
+  /**
+   * Builds the list of resource ARNs that `bedrock:InvokeModel` is granted on for a given model id.
+   *
+   * For a plain foundation-model id (e.g. `anthropic.claude-3-haiku-20240307-v1:0`) this is the
+   * single regional foundation-model ARN, preserving the original behavior.
+   *
+   * For a cross-region inference profile id (prefixed with `us.`, `eu.`, or `apac.`) invoking the
+   * profile requires `bedrock:InvokeModel` on BOTH the inference-profile ARN AND the underlying
+   * regional foundation-model ARNs the profile routes to. The underlying model id is the profile id
+   * with the region prefix stripped, and the foundation-model ARN is granted with a wildcard region
+   * so it covers every region the profile may dispatch to. Without this, customers using a
+   * cross-region profile with `@generation` hit runtime AccessDenied.
+   *
+   * @param {Construct} scope - The construct scope used to resolve account/partition tokens.
+   * @param {string} region - The AWS region for the Bedrock service.
+   * @param {string} bedrockModelId - The foundation-model id or cross-region inference profile id.
+   * @returns {string[]} The resource ARNs to grant `bedrock:InvokeModel` on.
+   */
+  private bedrockInvokeModelResources(scope: Construct, region: string, bedrockModelId: string): string[] {
+    const { partition, account } = cdk.Stack.of(scope);
+    const inferenceProfileMatch = bedrockModelId.match(/^(us|eu|apac)\.(.+)$/);
+
+    if (inferenceProfileMatch) {
+      const foundationModelId = inferenceProfileMatch[2];
+      return [
+        `arn:${partition}:bedrock:${region}:${account}:inference-profile/${bedrockModelId}`,
+        `arn:${partition}:bedrock:*::foundation-model/${foundationModelId}`,
+      ];
+    }
+
+    return [`arn:${partition}:bedrock:${region}::foundation-model/${bedrockModelId}`];
+  }
+
   private bedrockDataSourceName(fieldName: string): string {
     return `GenerationBedrockDataSource${toUpper(fieldName)}`;
   }