@composurecdk/bedrock 0.11.1 → 0.12.0

package/dist/esm/grants.js

@@ -1,51 +1,77 @@
 import { Effect, Grant as IamGrant, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { combine, grantVia } from "@composurecdk/core";
-import { invocationStatements, scopeOf } from "./inference-target.js";
+import { bedrockArn, environmentOf } from "./arn.js";
+import { invocationStatements, scopeOf, } from "./inference-target.js";
+const INVOKE_ACTION = "bedrock:InvokeModel";
 /**
  * Streaming operations (`InvokeModelWithResponseStream`, `ConverseStream`)
  * require both actions.
  *
  * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrock.html
  */
-const INVOKE_ACTIONS = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"];
-/** The versioned identifier `bedrock:GuardrailIdentifier` carries. */
-function identifierOf(guardrail) {
-    return `${guardrail.guardrailArn}:${guardrail.version}`;
+const INVOKE_ACTIONS = [INVOKE_ACTION, "bedrock:InvokeModelWithResponseStream"];
+/**
+ * Every guardrail in `scope`'s account and Region. The versioned identifiers
+ * `bedrock:GuardrailIdentifier` carries (`…:guardrail/<id>:<version>`) match
+ * it as a `StringLike` pattern.
+ */
+function anyGuardrailArn(scope) {
+    const { partition, region, account } = environmentOf(scope);
+    return bedrockArn(partition, "guardrail", "*", region, account);
+}
+function requirementOf(guardrail, scope) {
+    if (guardrail === "any") {
+        const arn = anyGuardrailArn(scope);
+        return { like: true, identifier: arn, applyArn: arn };
+    }
+    return {
+        like: false,
+        identifier: `${guardrail.guardrailArn}:${guardrail.version}`,
+        applyArn: guardrail.guardrailArn,
+    };
 }
-function grantInvoke(target, grantee, guardrail) {
-    const statements = invocationStatements(target, scopeOf(grantee.grantPrincipal));
-    const identifier = guardrail && identifierOf(guardrail);
+function withGuardrail(conditions, required) {
+    const match = required.like ? "StringLike" : "StringEquals";
+    return {
+        ...conditions,
+        [match]: {
+            ...conditions?.[match],
+            "bedrock:GuardrailIdentifier": required.identifier,
+        },
+    };
+}
+function grantInvoke(target, grantee, guardrail, streaming) {
+    const scope = scopeOf(grantee.grantPrincipal);
+    const actions = streaming ? INVOKE_ACTIONS : [INVOKE_ACTION];
+    const statements = invocationStatements(target, scope);
+    const required = guardrail && requirementOf(guardrail, scope);
     for (const { resourceArns, conditions } of statements) {
         IamGrant.addToPrincipal({
             grantee,
-            actions: INVOKE_ACTIONS,
+            actions,
             resourceArns,
-            conditions: identifier
-                ? {
-                    ...conditions,
-                    StringEquals: {
-                        ...conditions?.StringEquals,
-                        "bedrock:GuardrailIdentifier": identifier,
-                    },
-                }
-                : conditions,
+            conditions: required ? withGuardrail(conditions, required) : conditions,
         });
     }
-    if (!guardrail)
+    if (!required)
         return;
     grantee.grantPrincipal.addToPrincipalPolicy(new PolicyStatement({
         effect: Effect.DENY,
-        actions: INVOKE_ACTIONS,
+        actions,
         resources: statements.flatMap((s) => s.resourceArns),
-        conditions: { StringNotEquals: { "bedrock:GuardrailIdentifier": identifierOf(guardrail) } },
+        conditions: {
+            [required.like ? "StringNotLike" : "StringNotEquals"]: {
+                "bedrock:GuardrailIdentifier": required.identifier,
+            },
+        },
     }));
-    grantApply(guardrail, grantee);
+    grantApply(required.applyArn, grantee);
 }
-function grantApply(guardrail, grantee) {
+function grantApply(guardrailArn, grantee) {
     IamGrant.addToPrincipal({
         grantee,
         actions: ["bedrock:ApplyGuardrail"],
-        resourceArns: [guardrail.guardrailArn],
+        resourceArns: [guardrailArn],
     });
 }
 /**
@@ -62,15 +88,15 @@ export const modelGrants = {
      * Invoke the target through `InvokeModel`, `Converse` or their streaming
      * variants.
      *
-     * For a cross-Region profile this also grants the foundation model in the
-     * source Region and every Region the profile routes to, conditioned on
-     * `bedrock:InferenceProfileArn` so those models are reachable only through
-     * the profile.
+     * For a cross-Region profile this also grants the foundation model, in
+     * every Region or in the profile's listed `routingRegions`, conditioned on
+     * `bedrock:InferenceProfileArn` so the model is reachable only through the
+     * profile.
      *
      * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp01.html
      */
-    invoke: (target, { requireGuardrail } = {}) => grantVia(combine({ target, guardrail: requireGuardrail }), ({ target: resolved, guardrail }, grantee) => {
-        grantInvoke(resolved, grantee, guardrail);
+    invoke: (target, { requireGuardrail, streaming = true } = {}) => grantVia(combine({ target, guardrail: requireGuardrail }), ({ target: resolved, guardrail }, grantee) => {
+        grantInvoke(resolved, grantee, guardrail, streaming);
     }),
 };
 /**
@@ -84,7 +110,19 @@ export const guardrailGrants = {
      * `ApplyGuardrail` API or a model invocation that names it.
      */
     apply: (guardrail) => grantVia(guardrail, (resolved, grantee) => {
-        grantApply(resolved, grantee);
+        grantApply(resolved.guardrailArn, grantee);
+    }),
+    /**
+     * Apply any guardrail in the grantee's account and Region, for a caller
+     * that may name one at run time. Where the guardrail is known, `apply` it;
+     * where every call must carry one, `modelGrants.invoke(…, { requireGuardrail })`.
+     */
+    // A plain Grant rather than grantVia: there is no resource to resolve, only
+    // the grantee's own account and Region.
+    applyAny: () => ({
+        applyTo(grantee) {
+            grantApply(anyGuardrailArn(scopeOf(grantee.grantPrincipal)), grantee);
+        },
     }),
 };
 //# sourceMappingURL=grants.js.map

package/dist/esm/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,QAAQ,EAAmB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAE,OAAO,EAAc,QAAQ,EAAmB,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAwB,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;AAcxF,sEAAsE;AACtE,SAAS,YAAY,CAAC,SAA6B;IACjD,OAAO,GAAG,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAClB,MAAuB,EACvB,OAAmB,EACnB,SAAyC;IAEzC,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,SAAS,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;IACxD,KAAK,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,UAAU,EAAE,CAAC;QACtD,QAAQ,CAAC,cAAc,CAAC;YACtB,OAAO;YACP,OAAO,EAAE,cAAc;YACvB,YAAY;YACZ,UAAU,EAAE,UAAU;gBACpB,CAAC,CAAC;oBACE,GAAG,UAAU;oBACb,YAAY,EAAE;wBACZ,GAAG,UAAU,EAAE,YAAY;wBAC3B,6BAA6B,EAAE,UAAU;qBAC1C;iBACF;gBACH,CAAC,CAAC,UAAU;SACf,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,OAAO,CAAC,cAAc,CAAC,oBAAoB,CACzC,IAAI,eAAe,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;QACpD,UAAU,EAAE,EAAE,eAAe,EAAE,EAAE,6BAA6B,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE;KAC5F,CAAC,CACH,CAAC;IACF,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,SAA6B,EAAE,OAAmB;IACpE,QAAQ,CAAC,cAAc,CAAC;QACtB,OAAO;QACP,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACnC,YAAY,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB;;;;;;;;;;OAUG;IACH,MAAM,EAAE,CACN,MAAmC,EACnC,EAAE,gBAAgB,KAA8B,EAAE,EAC/B,EAAE,CACrB,QAAQ,CACN,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,EAChD,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,OAAmB,EAAE,EAAE;QACvD,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC,CACF;CACJ,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B;;;OAGG;IACH,KAAK,EAAE,CAAC,SAAyC,EAAqB,EAAE,CACtE,QAAQ,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAmB,EAAE,EAAE;QACpD,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC;CACL,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,QAAQ,EAAmB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAElG,OAAO,EAAE,OAAO,EAAc,QAAQ,EAAmB,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAGL,oBAAoB,EACpB,OAAO,GACR,MAAM,uBAAuB,CAAC;AAE/B,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,uCAAuC,CAAC,CAAC;AAoChF;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAA6B;IACpD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CACpB,SAAqC,EACrC,KAA6B;IAE7B,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,GAAG,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,OAAO,EAAE;QAC5D,QAAQ,EAAE,SAAS,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,UAA6C,EAC7C,QAA8B;IAE9B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC;IAC5D,OAAO;QACL,GAAG,UAAU;QACb,CAAC,KAAK,CAAC,EAAE;YACP,GAAG,UAAU,EAAE,CAAC,KAAK,CAAC;YACtB,6BAA6B,EAAE,QAAQ,CAAC,UAAU;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,MAAuB,EACvB,OAAmB,EACnB,SAAiD,EACjD,SAAkB;IAElB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,SAAS,IAAI,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,KAAK,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,UAAU,EAAE,CAAC;QACtD,QAAQ,CAAC,cAAc,CAAC;YACtB,OAAO;YACP,OAAO;YACP,YAAY;YACZ,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU;SACxE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,OAAO,CAAC,cAAc,CAAC,oBAAoB,CACzC,IAAI,eAAe,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,OAAO;QACP,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;QACpD,UAAU,EAAE;YACV,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE;gBACrD,6BAA6B,EAAE,QAAQ,CAAC,UAAU;aACnD;SACF;KACF,CAAC,CACH,CAAC;IACF,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB,EAAE,OAAmB;IAC3D,QAAQ,CAAC,cAAc,CAAC;QACtB,OAAO;QACP,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACnC,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB;;;;;;;;;;OAUG;IACH,MAAM,EAAE,CACN,MAAmC,EACnC,EAAE,gBAAgB,EAAE,SAAS,GAAG,IAAI,KAA8B,EAAE,EACjD,EAAE,CACrB,QAAQ,CACN,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,EAChD,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,OAAmB,EAAE,EAAE;QACvD,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC,CACF;CACJ,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B;;;OAGG;IACH,KAAK,EAAE,CAAC,SAAyC,EAAqB,EAAE,CACtE,QAAQ,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAmB,EAAE,EAAE;QACpD,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC,CAAC;IACJ;;;;OAIG;IACH,4EAA4E;IAC5E,wCAAwC;IACxC,QAAQ,EAAE,GAAsB,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,OAAO;YACb,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;CACH,CAAC"}

package/dist/esm/index.d.ts

@@ -1,6 +1,6 @@
 export { type ApplicationInferenceProfileBuilderProps, type ApplicationInferenceProfileBuilderResult, createApplicationInferenceProfileBuilder, type IApplicationInferenceProfileBuilder, } from "./application-inference-profile-builder.js";
 export { type ApplicationInferenceProfile, foundationModelFor, type GeographicInferenceProfile, type GeographicInferenceProfileOptions, type GlobalInferenceProfile, INFERENCE_PROFILE_GEOGRAPHIES, type InferenceProfile, type InferenceProfileGeography, inferenceProfile, } from "./inference-profile.js";
-export { type InferenceTarget, invocationArns } from "./inference-target.js";
+export { type InferenceTarget, type InferenceTargetIdOptions, inferenceTarget, invocationArns, } from "./inference-target.js";
 export { guardrailGrants, type ModelInvokeGrantOptions, modelGrants } from "./grants.js";
 export { createGuardrailBuilder, type GuardrailBuilderProps, type GuardrailBuilderResult, type GuardrailReference, type IGuardrailBuilder, } from "./guardrail-builder.js";
 export { GUARDRAIL_DEFAULTS } from "./guardrail-defaults.js";

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,uCAAuC,EAC5C,KAAK,wCAAwC,EAC7C,wCAAwC,EACxC,KAAK,mCAAmC,GACzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,kBAAkB,EAClB,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,KAAK,uBAAuB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,mCAAmC,EACnC,KAAK,8BAA8B,EACnC,iCAAiC,EACjC,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,EACxC,KAAK,gCAAgC,GACtC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uCAAuC,EACvC,KAAK,iCAAiC,GACvC,MAAM,sCAAsC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,uCAAuC,EAC5C,KAAK,wCAAwC,EAC7C,wCAAwC,EACxC,KAAK,mCAAmC,GACzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,kBAAkB,EAClB,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,eAAe,EACf,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,KAAK,uBAAuB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,mCAAmC,EACnC,KAAK,8BAA8B,EACnC,iCAAiC,EACjC,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,EACxC,KAAK,gCAAgC,GACtC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uCAAuC,EACvC,KAAK,iCAAiC,GACvC,MAAM,sCAAsC,CAAC"}

package/dist/esm/index.js

@@ -1,6 +1,6 @@
 export { createApplicationInferenceProfileBuilder, } from "./application-inference-profile-builder.js";
 export { foundationModelFor, INFERENCE_PROFILE_GEOGRAPHIES, inferenceProfile, } from "./inference-profile.js";
-export { invocationArns } from "./inference-target.js";
+export { inferenceTarget, invocationArns, } from "./inference-target.js";
 export { guardrailGrants, modelGrants } from "./grants.js";
 export { createGuardrailBuilder, } from "./guardrail-builder.js";
 export { GUARDRAIL_DEFAULTS } from "./guardrail-defaults.js";

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,wCAAwC,GAEzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAEL,kBAAkB,EAIlB,6BAA6B,EAG7B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAwB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAgC,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EACL,sBAAsB,GAKvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAGL,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,GAIxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAA4C,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,mCAAmC,EAEnC,iCAAiC,GAIlC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uCAAuC,GAExC,MAAM,sCAAsC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,wCAAwC,GAEzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAEL,kBAAkB,EAIlB,6BAA6B,EAG7B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,eAAe,EACf,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAgC,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EACL,sBAAsB,GAKvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAGL,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,GAIxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAA4C,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,mCAAmC,EAEnC,iCAAiC,GAIlC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uCAAuC,GAExC,MAAM,sCAAsC,CAAC"}

package/dist/esm/inference-profile.d.ts

@@ -9,7 +9,7 @@ import { FoundationModelIdentifier } from "aws-cdk-lib/aws-bedrock";
  *
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html
  */
-export declare const INFERENCE_PROFILE_GEOGRAPHIES: readonly ["us", "eu", "apac", "jp", "au", "us-gov"];
+export declare const INFERENCE_PROFILE_GEOGRAPHIES: readonly ["us", "eu", "apac", "jp", "au", "in", "us-gov"];
 /** A known geography prefix. See {@link INFERENCE_PROFILE_GEOGRAPHIES}. */
 export type InferenceProfileGeography = (typeof INFERENCE_PROFILE_GEOGRAPHIES)[number];
 /**
@@ -26,11 +26,18 @@ export interface GeographicInferenceProfile {
     /** The id to invoke, e.g. `eu.anthropic.claude-haiku-4-5-20251001-v1:0`. */
     readonly profileId: string;
     /**
-     * Every Region the profile may route to from the source Region, as listed
-     * by `aws bedrock get-inference-profile` or the model's page in the Bedrock
-     * user guide. The source Region is always granted, listed or not.
+     * The Regions the profile routes to from the source Region, as listed by
+     * `aws bedrock get-inference-profile`. AWS chooses and extends that list,
+     * so a copy of it is a snapshot. Bedrock checks the model in every Region
+     * the profile may route to, so once AWS adds one, a grant built from the
+     * copy denies every call through the profile.
+     *
+     * Omitted, the grant covers the foundation model in every Region, still
+     * only through this profile. List the Regions when the policy must name
+     * each one, for a service control policy or a policy scanner. The source
+     * Region is always granted.
      */
-    readonly routingRegions: readonly string[];
+    readonly routingRegions?: readonly string[];
 }
 /**
  * A system-defined inference profile that routes requests to any supported
@@ -68,10 +75,20 @@ export interface ApplicationInferenceProfile {
 }
 /** Options for {@link inferenceProfile.geographic}. */
 export type GeographicInferenceProfileOptions = Pick<GeographicInferenceProfile, "model" | "geography" | "routingRegions">;
+/**
+ * The segment of `id` before its first dot, and whether it marks a
+ * system-defined profile id. Undefined when `id` has no such segment.
+ * @internal
+ */
+export declare function idPrefix(id: string): {
+    prefix: string;
+    isProfile: boolean;
+} | undefined;
+/** Throws unless `id` is a non-empty literal string. @internal */
+export declare function assertLiteralId(id: string, label: string): void;
 declare function geographic(options: GeographicInferenceProfileOptions): GeographicInferenceProfile;
 declare function global(model: FoundationModelIdentifier): GlobalInferenceProfile;
-declare function parse(profileId: string): GlobalInferenceProfile;
-declare function parse(profileId: string, routingRegions: readonly string[]): InferenceProfile;
+declare function parse(profileId: string, routingRegions?: readonly string[]): InferenceProfile;
 /**
  * Factories for {@link InferenceProfile} values.
  *
@@ -80,7 +97,6 @@ declare function parse(profileId: string, routingRegions: readonly string[]): In
  * const haiku = inferenceProfile.geographic({
  *   model: FoundationModelIdentifier.ANTHROPIC_CLAUDE_HAIKU_4_5_20251001_V1_0,
  *   geography: "eu",
- *   routingRegions: ["eu-central-1", "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-3"],
  * });
  * haiku.profileId; // "eu.anthropic.claude-haiku-4-5-20251001-v1:0"
  * ```
@@ -93,7 +109,7 @@ export declare const inferenceProfile: {
     /**
      * Reads a profile id such as `eu.anthropic.claude-haiku-4-5-20251001-v1:0`.
      * Throws unless the id starts with a known geography or `global`. A
-     * geographic id needs its `routingRegions`; a global id takes none.
+     * geographic id may take its `routingRegions`; a global id takes none.
      */
     parse: typeof parse;
 };

package/dist/esm/inference-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inference-profile.d.ts","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,qDAAsD,CAAC;AAEjG,2EAA2E;AAC3E,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAIvF;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,GAAG,sBAAsB,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,GAAG,gBAAgB,CAAC;CAC/D;AAED,uDAAuD;AACvD,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,0BAA0B,EAC1B,OAAO,GAAG,WAAW,GAAG,gBAAgB,CACzC,CAAC;AA4CF,iBAAS,UAAU,CAAC,OAAO,EAAE,iCAAiC,GAAG,0BAA0B,CAiB1F;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CAGxE;AAaD,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAAC;AAC1D,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAkBvF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB;IAC3B,8CAA8C;;IAE9C,4DAA4D;;IAE5D;;;;OAIG;;CAEJ,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAE/E"}
+{"version":3,"file":"inference-profile.d.ts","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,2DAQhC,CAAC;AAEX,2EAA2E;AAC3E,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAMvF;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,GAAG,sBAAsB,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,GAAG,gBAAgB,CAAC;CAC/D;AAED,uDAAuD;AACvD,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,0BAA0B,EAC1B,OAAO,GAAG,WAAW,GAAG,gBAAgB,CACzC,CAAC;AAKF;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAKvF;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAI/D;AA4BD,iBAAS,UAAU,CAAC,OAAO,EAAE,iCAAiC,GAAG,0BAA0B,CAiB1F;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CAGxE;AAcD,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAYtF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB;IAC3B,8CAA8C;;IAE9C,4DAA4D;;IAE5D;;;;OAIG;;CAEJ,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAE/E"}

package/dist/esm/inference-profile.js

@@ -10,32 +10,48 @@ import { FoundationModelIdentifier } from "aws-cdk-lib/aws-bedrock";
  *
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html
  */
-export const INFERENCE_PROFILE_GEOGRAPHIES = ["us", "eu", "apac", "jp", "au", "us-gov"];
+export const INFERENCE_PROFILE_GEOGRAPHIES = [
+    "us",
+    "eu",
+    "apac",
+    "jp",
+    "au",
+    "in",
+    "us-gov",
+];
 const GLOBAL_PREFIX = "global";
+const PROFILE_PREFIXES = [GLOBAL_PREFIX, ...INFERENCE_PROFILE_GEOGRAPHIES];
 const GEOGRAPHY_PATTERN = /^[a-z]+(-[a-z]+)*$/;
 const REGION_PATTERN = /^[a-z]{2}(-[a-z]+)+-\d+$/;
-function isProfilePrefix(prefix) {
-    return (prefix === GLOBAL_PREFIX ||
-        INFERENCE_PROFILE_GEOGRAPHIES.includes(prefix));
-}
-function prefixOf(id) {
+/**
+ * The segment of `id` before its first dot, and whether it marks a
+ * system-defined profile id. Undefined when `id` has no such segment.
+ * @internal
+ */
+export function idPrefix(id) {
     const dot = id.indexOf(".");
-    return dot > 0 ? id.slice(0, dot) : undefined;
+    if (dot <= 0)
+        return undefined;
+    const prefix = id.slice(0, dot);
+    return { prefix, isProfile: PROFILE_PREFIXES.includes(prefix) };
+}
+/** Throws unless `id` is a non-empty literal string. @internal */
+export function assertLiteralId(id, label) {
+    if (Token.isUnresolved(id) || id === "") {
+        throw new Error(`${label} must be a non-empty literal string.`);
+    }
 }
 function assertModel(model) {
     const { modelId } = model;
-    if (Token.isUnresolved(modelId) || modelId === "") {
-        throw new Error("Inference profile model id must be a non-empty literal string.");
-    }
-    const prefix = prefixOf(modelId);
-    if (prefix !== undefined && isProfilePrefix(prefix)) {
+    assertLiteralId(modelId, "Inference profile model id");
+    if (idPrefix(modelId)?.isProfile) {
         throw new Error(`"${modelId}" is an inference profile id, not a foundation model id. ` +
-            `Use inferenceProfile.parse("${modelId}", …) instead.`);
+            `Use inferenceProfile.parse("${modelId}") instead.`);
     }
 }
 function assertRoutingRegions(profileId, regions) {
     if (regions.length === 0) {
-        throw new Error(`Inference profile "${profileId}": routingRegions must not be empty.`);
+        throw new Error(`Inference profile "${profileId}": routingRegions must not be empty; omit it to grant every Region.`);
     }
     for (const region of regions) {
         if (Token.isUnresolved(region) || !REGION_PATTERN.test(region)) {
@@ -44,19 +60,20 @@ function assertRoutingRegions(profileId, regions) {
     }
 }
 function geographic(options) {
-    const { model, geography } = options;
+    const { model, geography, routingRegions } = options;
     assertModel(model);
     if (geography === GLOBAL_PREFIX || !GEOGRAPHY_PATTERN.test(geography)) {
         throw new Error(`"${geography}" is not a geography prefix. Use inferenceProfile.global() for a global profile.`);
     }
     const profileId = `${geography}.${model.modelId}`;
-    assertRoutingRegions(profileId, options.routingRegions);
+    if (routingRegions !== undefined)
+        assertRoutingRegions(profileId, routingRegions);
     return Object.freeze({
         kind: "geographic",
         geography,
         model,
         profileId,
-        routingRegions: Object.freeze([...new Set(options.routingRegions)]),
+        ...(routingRegions && { routingRegions: Object.freeze([...new Set(routingRegions)]) }),
     });
 }
 function global(model) {
@@ -64,11 +81,12 @@ function global(model) {
     return Object.freeze({ kind: "global", model, profileId: `${GLOBAL_PREFIX}.${model.modelId}` });
 }
 function splitProfileId(profileId) {
-    const prefix = prefixOf(profileId);
-    if (prefix === undefined || !isProfilePrefix(prefix)) {
+    const parsed = idPrefix(profileId);
+    if (!parsed?.isProfile) {
         throw new Error(`"${profileId}" is not a system-defined inference profile id. Expected one of the ` +
-            `prefixes: ${[GLOBAL_PREFIX, ...INFERENCE_PROFILE_GEOGRAPHIES].join(", ")}.`);
+            `prefixes: ${PROFILE_PREFIXES.join(", ")}.`);
     }
+    const { prefix } = parsed;
     return { prefix, modelId: profileId.slice(prefix.length + 1) };
 }
 function parse(profileId, routingRegions) {
@@ -80,9 +98,6 @@ function parse(profileId, routingRegions) {
         }
         return global(model);
     }
-    if (routingRegions === undefined) {
-        throw new Error(`Inference profile "${profileId}" is geographic and needs its routingRegions.`);
-    }
     return geographic({ model, geography: prefix, routingRegions });
 }
 /**
@@ -93,7 +108,6 @@ function parse(profileId, routingRegions) {
  * const haiku = inferenceProfile.geographic({
  *   model: FoundationModelIdentifier.ANTHROPIC_CLAUDE_HAIKU_4_5_20251001_V1_0,
  *   geography: "eu",
- *   routingRegions: ["eu-central-1", "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-3"],
  * });
  * haiku.profileId; // "eu.anthropic.claude-haiku-4-5-20251001-v1:0"
  * ```
@@ -106,7 +120,7 @@ export const inferenceProfile = {
     /**
      * Reads a profile id such as `eu.anthropic.claude-haiku-4-5-20251001-v1:0`.
      * Throws unless the id starts with a known geography or `global`. A
-     * geographic id needs its `routingRegions`; a global id takes none.
+     * geographic id may take its `routingRegions`; a global id takes none.
      */
     parse,
 };

package/dist/esm/inference-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"inference-profile.js","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAU,CAAC;AAKjG,MAAM,aAAa,GAAG,QAAQ,CAAC;AAkE/B,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAElD,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,CACL,MAAM,KAAK,aAAa;QACvB,6BAAmD,CAAC,QAAQ,CAAC,MAAM,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU;IAC1B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,KAAgC;IACnD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,2DAA2D;YACpE,+BAA+B,OAAO,gBAAgB,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB,EAAE,OAA0B;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,sCAAsC,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,OAAO,MAAM,qCAAqC,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACrC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,SAAS,KAAK,aAAa,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,kFAAkF,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IAClD,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,YAAY;QAClB,SAAS;QACT,KAAK;QACL,SAAS;QACT,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAgC;IAC9C,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,sEAAsE;YACjF,aAAa,CAAC,aAAa,EAAE,GAAG,6BAA6B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAID,SAAS,KAAK,CAAC,SAAiB,EAAE,cAAkC;IAClE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,wEAAwE,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,8CAA8C;IAC9C,UAAU;IACV,4DAA4D;IAC5D,MAAM;IACN;;;;OAIG;IACH,KAAK;CACN,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,IAAI,yBAAyB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"inference-profile.js","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,QAAQ;CACA,CAAC;AAKX,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,MAAM,gBAAgB,GAAsB,CAAC,aAAa,EAAE,GAAG,6BAA6B,CAAC,CAAC;AAyE9F,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAU;IACjC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,KAAa;IACvD,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAgC;IACnD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,eAAe,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,2DAA2D;YACpE,+BAA+B,OAAO,aAAa,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB,EAAE,OAA0B;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,qEAAqE,CACrG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,OAAO,MAAM,qCAAqC,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACrD,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,SAAS,KAAK,aAAa,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,kFAAkF,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IAClD,IAAI,cAAc,KAAK,SAAS;QAAE,oBAAoB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,YAAY;QAClB,SAAS;QACT,KAAK;QACL,SAAS;QACT,GAAG,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAgC;IAC9C,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,sEAAsE;YACjF,aAAa,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,KAAK,CAAC,SAAiB,EAAE,cAAkC;IAClE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,wEAAwE,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,8CAA8C;IAC9C,UAAU;IACV,4DAA4D;IAC5D,MAAM;IACN;;;;OAIG;IACH,KAAK;CACN,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,IAAI,yBAAyB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC"}

package/dist/esm/inference-target.d.ts

@@ -1,6 +1,6 @@
-import type { FoundationModelIdentifier, IModel } from "aws-cdk-lib/aws-bedrock";
+import { FoundationModelIdentifier, type IModel } from "aws-cdk-lib/aws-bedrock";
 import { type IConstruct } from "constructs";
-import type { ApplicationInferenceProfile, InferenceProfile } from "./inference-profile.js";
+import { type ApplicationInferenceProfile, type InferenceProfile } from "./inference-profile.js";
 /**
  * Anything a caller can invoke: an in-Region foundation model, a
  * system-defined or application inference profile, or any {@link IModel} (a
@@ -17,7 +17,9 @@ export interface InvocationStatement {
 /**
  * The statements for invoking `target` from the Region `scope` deploys to:
  * those the Bedrock user guide prescribes, and for an application profile the
- * shape verified against live IAM.
+ * shape verified against live IAM. A geographic profile without
+ * `routingRegions` grants the model in every Region rather than an
+ * enumerated list, still only through the profile (#628).
  *
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html#geographic-cris-iam-setup
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html#global-cris-iam-setup
@@ -37,7 +39,9 @@ export declare function sourceArn(source: FoundationModelIdentifier | InferenceP
  *
  * {@link modelGrants.invoke} applies these with the conditions the Bedrock
  * user guide prescribes; use this list where you write a policy yourself,
- * such as a service control policy.
+ * such as a service control policy. A geographic profile without
+ * `routingRegions` yields one Region-wildcard model ARN, so list the Regions
+ * on the profile when the policy must name each one.
  *
  * @param scope - Resolves partition, Region and account from its stack. Omit
  *   for the `AWS::` pseudo-parameters.
@@ -45,4 +49,38 @@ export declare function sourceArn(source: FoundationModelIdentifier | InferenceP
 export declare function invocationArns(target: InferenceTarget, scope?: IConstruct): string[];
 /** @internal */
 export declare function scopeOf(principal: unknown): IConstruct | undefined;
+/** Options for {@link inferenceTarget.fromId}. */
+export interface InferenceTargetIdOptions {
+    /** For a geographic profile id: see {@link GeographicInferenceProfile.routingRegions}. */
+    readonly routingRegions?: readonly string[];
+}
+/**
+ * Resolves an id that arrives as a string, such as from configuration, to the
+ * target it names:
+ *
+ * - `anthropic.claude-…` → a `FoundationModelIdentifier`;
+ * - `eu.anthropic.claude-…` or `global.anthropic.claude-…` → a system-defined
+ *   profile, via {@link inferenceProfile.parse};
+ * - a provisioned-model ARN → `{ modelArn }`.
+ *
+ * A two-segment id with an unknown first segment throws rather than being
+ * taken for a model named after a geography. A system-defined or application
+ * profile ARN throws too: the model it routes to cannot be read from it, and
+ * a grant on the ARN alone would be incomplete. Pass the profile value instead.
+ */
+declare function fromId(id: string, options?: InferenceTargetIdOptions): InferenceTarget;
+/**
+ * Factories for {@link InferenceTarget} values.
+ *
+ * @example
+ * ```ts
+ * const ids = ["anthropic.claude-sonnet-5-5", "us.anthropic.claude-haiku-4-5-20251001-v1:0"];
+ * createFunctionBuilder().grant(...ids.map((id) => modelGrants.invoke(inferenceTarget.fromId(id))));
+ * ```
+ */
+export declare const inferenceTarget: {
+    /** Resolves a model id, system-defined profile id or provisioned-model ARN. */
+    fromId: typeof fromId;
+};
+export {};
 //# sourceMappingURL=inference-target.d.ts.map

package/dist/esm/inference-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inference-target.d.ts","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE5F;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACzB,yBAAyB,GAAG,gBAAgB,GAAG,2BAA2B,GAAG,MAAM,CAAC;AAEtF,gBAAgB;AAChB,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,IAAI,gBAAgB,CAEtF;AAUD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/D;AA4BD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,UAAU,GACjB,mBAAmB,EAAE,CASvB;AA4DD;;;GAGG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,yBAAyB,GAAG,gBAAgB,EACpD,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,CAKR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,EAAE,CAEpF;AAED,gBAAgB;AAChB,wBAAgB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAElE"}
+{"version":3,"file":"inference-target.d.ts","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAExD,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EAKtB,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACzB,yBAAyB,GAAG,gBAAgB,GAAG,2BAA2B,GAAG,MAAM,CAAC;AAEtF,gBAAgB;AAChB,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,IAAI,gBAAgB,CAEtF;AAUD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,UAAU,GACjB,mBAAmB,EAAE,CASvB;AA6DD;;;GAGG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,yBAAyB,GAAG,gBAAgB,EACpD,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,CAKR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,EAAE,CAEpF;AAED,gBAAgB;AAChB,wBAAgB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAElE;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAID;;;;;;;;;;;;;GAaG;AACH,iBAAS,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,wBAA6B,GAAG,eAAe,CA6BnF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;IAC1B,+EAA+E;;CAEhF,CAAC"}

package/dist/esm/inference-target.js

@@ -1,5 +1,7 @@
-import { Arn, ArnFormat, Aws, Stack } from "aws-cdk-lib";
+import { FoundationModelIdentifier } from "aws-cdk-lib/aws-bedrock";
 import { Construct } from "constructs";
+import { bedrockArn, environmentOf } from "./arn.js";
+import { assertLiteralId, idPrefix, INFERENCE_PROFILE_GEOGRAPHIES, inferenceProfile, } from "./inference-profile.js";
 /** @internal */
 export function isInferenceProfile(target) {
     return "kind" in target && (target.kind === "geographic" || target.kind === "global");
@@ -10,26 +12,12 @@ function isApplicationProfile(target) {
 function isModel(target) {
     return "modelArn" in target;
 }
-function environmentOf(scope) {
-    return scope === undefined
-        ? { partition: Aws.PARTITION, region: Aws.REGION, account: Aws.ACCOUNT_ID }
-        : Stack.of(scope);
-}
-function bedrockArn(partition, resource, resourceName, region, account = "") {
-    return Arn.format({
-        partition,
-        service: "bedrock",
-        region,
-        account,
-        resource,
-        resourceName,
-        arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
-    });
-}
 /**
  * The statements for invoking `target` from the Region `scope` deploys to:
  * those the Bedrock user guide prescribes, and for an application profile the
- * shape verified against live IAM.
+ * shape verified against live IAM. A geographic profile without
+ * `routingRegions` grants the model in every Region rather than an
+ * enumerated list, still only through the profile (#628).
  *
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html#geographic-cris-iam-setup
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html#global-cris-iam-setup
@@ -76,7 +64,9 @@ function sourceStatements(target, scope, viaProfile) {
     const models = target.kind === "geographic"
         ? [
             {
-                resourceArns: [...new Set([sourceRegion, ...target.routingRegions])].map((region) => modelArn(modelId, region)),
+                resourceArns: (target.routingRegions
+                    ? [...new Set([sourceRegion, ...target.routingRegions])]
+                    : ["*"]).map((region) => modelArn(modelId, region)),
                 conditions: { StringEquals: via },
             },
         ]
@@ -110,7 +100,9 @@ export function sourceArn(source, scope) {
  *
  * {@link modelGrants.invoke} applies these with the conditions the Bedrock
  * user guide prescribes; use this list where you write a policy yourself,
- * such as a service control policy.
+ * such as a service control policy. A geographic profile without
+ * `routingRegions` yields one Region-wildcard model ARN, so list the Regions
+ * on the profile when the policy must name each one.
  *
  * @param scope - Resolves partition, Region and account from its stack. Omit
  *   for the `AWS::` pseudo-parameters.
@@ -122,4 +114,58 @@ export function invocationArns(target, scope) {
 export function scopeOf(principal) {
     return Construct.isConstruct(principal) ? principal : undefined;
 }
+const PROVISIONED_MODEL_ARN = ":provisioned-model/";
+/**
+ * Resolves an id that arrives as a string, such as from configuration, to the
+ * target it names:
+ *
+ * - `anthropic.claude-…` → a `FoundationModelIdentifier`;
+ * - `eu.anthropic.claude-…` or `global.anthropic.claude-…` → a system-defined
+ *   profile, via {@link inferenceProfile.parse};
+ * - a provisioned-model ARN → `{ modelArn }`.
+ *
+ * A two-segment id with an unknown first segment throws rather than being
+ * taken for a model named after a geography. A system-defined or application
+ * profile ARN throws too: the model it routes to cannot be read from it, and
+ * a grant on the ARN alone would be incomplete. Pass the profile value instead.
+ */
+function fromId(id, options = {}) {
+    assertLiteralId(id, "Inference target id");
+    if (id.startsWith("arn:")) {
+        if (id.includes(PROVISIONED_MODEL_ARN))
+            return { modelArn: id };
+        throw new Error(`"${id}" is an ARN. inferenceTarget.fromId resolves foundation-model and system-defined ` +
+            `profile ids, and provisioned-model ARNs. For an inference profile pass its id, or an ` +
+            `ApplicationInferenceProfile value, so the model it routes to is granted as well.`);
+    }
+    const parsed = idPrefix(id);
+    if (!parsed) {
+        throw new Error(`"${id}" is not a foundation model or inference profile id.`);
+    }
+    const { prefix, isProfile } = parsed;
+    if (isProfile)
+        return inferenceProfile.parse(id, options.routingRegions);
+    if (id.includes(".", prefix.length + 1)) {
+        throw new Error(`"${id}" looks like an inference profile id, but "${prefix}" is neither global nor one ` +
+            `of INFERENCE_PROFILE_GEOGRAPHIES (${INFERENCE_PROFILE_GEOGRAPHIES.join(", ")}). ` +
+            `For a new geography use inferenceProfile.geographic().`);
+    }
+    if (options.routingRegions !== undefined) {
+        throw new Error(`"${id}" is a foundation model id; routingRegions apply to a geographic profile.`);
+    }
+    return new FoundationModelIdentifier(id);
+}
+/**
+ * Factories for {@link InferenceTarget} values.
+ *
+ * @example
+ * ```ts
+ * const ids = ["anthropic.claude-sonnet-5-5", "us.anthropic.claude-haiku-4-5-20251001-v1:0"];
+ * createFunctionBuilder().grant(...ids.map((id) => modelGrants.invoke(inferenceTarget.fromId(id))));
+ * ```
+ */
+export const inferenceTarget = {
+    /** Resolves a model id, system-defined profile id or provisioned-model ARN. */
+    fromId,
+};
 //# sourceMappingURL=inference-target.js.map