fix(bedrock-alpha): grant IAM permissions for all regions in geoRegion for CrossRegionInferenceProfile

[pahud]

Issue # (if applicable)

Closes #36774.

Reason for this change

The grantProfileUsage() method in CrossRegionInferenceProfile only grants IAM permissions for the current region (Aws.REGION), but cross-region inference profiles dynamically route requests across multiple regions within a geoRegion. This causes Lambda functions to fail with "Your account is not authorized to invoke this API operation with a prompt resource" when the profile routes requests to regions other than the source region.

Description of changes

┌─────────────────────────────────────────────────────────────────────────────┐
│                     CROSS-REGION INFERENCE PROFILE                          │
│                                                                             │
│   User configures: geoRegion = "US"                                         │
│                                                                             │
│   ┌─────────────────────────────────────────────────────────────────────┐   │
│   │                    AWS Bedrock Service                              │   │
│   │                                                                     │   │
│   │   Cross-Region Inference Profile dynamically routes requests to:   │   │
│   │                                                                     │   │
│   │      ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐        │   │
│   │      │us-east-1 │  │us-east-2 │  │us-west-1 │  │us-west-2 │        │   │
│   │      │ (N.VA)   │  │ (Ohio)   │  │(N.Calif) │  │ (Oregon) │        │   │
│   │      └────┬─────┘  └────┬─────┘  └────┬─────┘  └────┬─────┘        │   │
│   │           │             │             │             │              │   │
│   │           └─────────────┴──────┬──────┴─────────────┘              │   │
│   │                                │                                   │   │
│   │                    Routes based on availability                    │   │
│   │                         and demand                                 │   │
│   └────────────────────────────────┼───────────────────────────────────┘   │
│                                    │                                        │
│                                    ▼                                        │
│   ┌─────────────────────────────────────────────────────────────────────┐   │
│   │                         Lambda Function                             │   │
│   │                                                                     │   │
│   │   Invokes inference profile → Request may go to ANY US region      │   │
│   └─────────────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────────────┐
│                           THE PROBLEM (Before)                              │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│   grantProfileUsage() generated IAM policy with SINGLE region:              │
│                                                                             │
│   {                                                                         │
│     "Effect": "Allow",                                                      │
│     "Action": ["bedrock:GetInferenceProfile", "bedrock:InvokeModel*"],      │
│     "Resource": "arn:aws:bedrock:us-east-1:123456789:inference-profile/..." │
│   }                            ─────────                                    │
│                                    │                                        │
│                                    └── Only current region!                 │
│                                                                             │
│   ❌ Request routed to us-west-2 → ACCESS DENIED                            │
│   ❌ Request routed to us-east-2 → ACCESS DENIED                            │
│   ✅ Request routed to us-east-1 → Works (by luck)                          │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────────────┐
│                           THE FIX (After)                                   │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│   grantProfileUsage() now generates IAM policy with ALL regions in geo:     │
│                                                                             │
│   {                                                                         │
│     "Effect": "Allow",                                                      │
│     "Action": ["bedrock:GetInferenceProfile", "bedrock:InvokeModel*"],      │
│     "Resource": [                                                           │
│       "arn:aws:bedrock:us-east-1:123456789:inference-profile/...",          │
│       "arn:aws:bedrock:us-east-2:123456789:inference-profile/...",          │
│       "arn:aws:bedrock:us-west-1:123456789:inference-profile/...",          │
│       "arn:aws:bedrock:us-west-2:123456789:inference-profile/..."           │
│     ]                ─────────────────────────────────────────              │
│   }                              │                                          │
│                                  └── All US regions from RegionInfo!        │
│                                                                             │
│   ✅ Request routed to us-west-2 → Works                                    │
│   ✅ Request routed to us-east-2 → Works                                    │
│   ✅ Request routed to us-east-1 → Works                                    │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────────────┐
│                        IMPLEMENTATION APPROACH                              │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│   Uses RegionInfo from aws-cdk-lib/region-info to dynamically determine     │
│   regions for each geoRegion:                                               │
│                                                                             │
│   ┌─────────────┬───────────────────────────────────────────────────────┐   │
│   │  geoRegion  │  Regions Granted                                      │   │
│   ├─────────────┼───────────────────────────────────────────────────────┤   │
│   │  US         │  All regions starting with "us-" (aws partition)      │   │
│   │  EU         │  All regions starting with "eu-" (aws partition)      │   │
│   │  APAC       │  All regions starting with "ap-" or "me-"             │   │
│   │  GLOBAL     │  Wildcard "*" (all commercial regions)                │   │
│   │  US_GOV     │  All regions in aws-us-gov partition                  │   │
│   │  JP         │  ap-northeast-1, ap-northeast-3 (Tokyo, Osaka)        │   │
│   │  AU         │  ap-southeast-2, ap-southeast-4 (Sydney, Melbourne)   │   │
│   └─────────────┴───────────────────────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

Implemented the RegionInfo approach to grant IAM permissions for all regions within a geoRegion:

• Added RegionInfo import from aws-cdk-lib/region-info
• Added private geoRegion property to store the configured geographic area
• Added getRegionsForGeoArea() helper method that returns the list of AWS regions for each geoRegion
• Modified grantProfileUsage() to generate multiple ARNs (one per region in the geoRegion)

Describe any new or updated permissions being added

• IAM permissions: No new IAM actions added. The same bedrock:GetInferenceProfile and bedrock:InvokeModel* actions are granted.
• Resource access: The IAM policy now grants access to the inference profile ARN in all regions within the configured geoRegion, rather than just the current region. This is an additive change that expands permissions to match the actual runtime behavior of cross-region inference profiles.

Description of how you validated changes

• Unit tests: Added 6 comprehensive tests for multi-region ARN generation (US, EU, APAC, GLOBAL, JP, AU geoRegions)
• Unit test: Added test to verify all enum values are supported (prevents future regressions)
• Integration test: Added IAM role with grantProfileUsage() call to verify multi-region ARN generation in CloudFormation template
• All tests pass: 21/21 tests passing in cross-region-inference-profile.test.ts
• TypeScript compilation: Passes without errors
• Linting: Passes without errors

Security considerations

• Least-privilege enforcement: Unknown geoRegions now throw an error instead of falling back to wildcard * permissions. This prevents silent over-permissioning if new geoRegions are added in the future without updating the region mappings.

• Region mapping approach: According to AWS documentation, the exact destination regions for a cross-region inference profile depend on both the specific model and the source region. For example, us.anthropic.claude-3-haiku from us-east-2 routes to us-east-1, us-east-2, us-west-2, but from us-west-2 only routes to us-east-1, us-west-2.

  Our implementation grants permissions to all regions in the geographic area (e.g., all us-* regions for US geoRegion) rather than trying to predict exact routing. This is intentionally more permissive because:

  1. It covers all possible destination regions regardless of model or source region
  2. It won't break if AWS adds new destination regions for a model
  3. The AWS docs state: "if an inference profile is tied to a geography (such as US, EU, or APAC), its destination Region list will never change" - so granting all regions in the geography is a safe superset

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	24 ran	24 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	24 ran	24 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates