How to Authenticate Entra ID Users to Amazon Bedrock Privately with Per-Department Model Access?

Why the Answer Is Correct

Option A covers every stated requirement with a purpose-built control. Microsoft Entra ID federates to AWS through a SAML identity provider in IAM, so users assume department-specific roles instead of holding long-lived keys. Those roles restrict access by resource, allowing only the required ModelId ARNs, which enforces model-family limits per department at the IAM policy layer. Amazon Bedrock runtime traffic is kept private through AWS PrivateLink interface VPC endpoints (com.amazonaws.<region>.bedrock-runtime), eliminating internet egress. Auditing is layered: AWS CloudTrail records the Bedrock API activity (who called what, when), while Bedrock model invocation logging captures the request and response payloads needed for a comprehensive trail of model interactions.

Why the Other Options Are Wrong

Option B places Lambda in private subnets but routes to Amazon Bedrock through a NAT gateway, which traverses the public endpoint — the private-path requirement fails — and CloudWatch Logs captured from the function is not a substitute for CloudTrail plus invocation logging. Option C claims private connectivity while explicitly using public Bedrock API endpoints, and permission boundaries only cap the maximum permissions of a role; they do not grant or define department-level model-family access. Option D uses SCPs, which apply at the account/organization level rather than to individual departments, and relies on Microsoft Entra ID's own sign-in logs, which cannot record Bedrock model invocations. In both C and D the audit requirement is effectively unaddressed at the model-interaction level.

Community Comment Notes

Nowax argues the same reasoning, noting that "SAML 2.0 is the standard Entra ID->IAM enterprise SSO pattern" and that department IAM roles scoped to model ARNs enforce family-level access. The comment also correctly separates the two logging layers — CloudTrail for API activity and model invocation logging for prompt/response bodies — which is the distinction most candidates miss. It dismisses option B on the grounds that NAT gateway egress reaches the public Bedrock endpoint, so traffic is not private. That consensus matches the independent analysis here.