Skip to content

IAM Permissions

stdapi.ai requires specific AWS IAM permissions to access Amazon Bedrock models and other AWS services. The exact permissions needed depend on which features you enable.

Building Your Policy

Combine the permission statements below based on the features you need. At minimum, you need the Bedrock permissions. Add statements for S3, TTS, STT, and other features as required by your deployment. Only include the statements you need — start with the Bedrock permissions and add others as required (least privilege).

Terraform Module

The official stdapi-ai Terraform module provisions the ECS task role with the required permissions automatically. This reference is for custom deployments and policy auditing.

Bedrock (Required)

Environment Variables: Always required

These permissions are mandatory for stdapi.ai to discover and invoke Amazon Bedrock models:

Bedrock IAM Policy Statements 
{
  "Sid": "BedrockModelInvoke",
  "Effect": "Allow",
  "Action": [
    "bedrock:CountTokens",
    "bedrock:GetAsyncInvoke",
    "bedrock:InvokeModel",
    "bedrock:InvokeModelWithResponseStream",
    "bedrock:InvokeTool",
    "bedrock:Rerank"
  ],
  "Resource": "*"
},
{
  "Sid": "BedrockAsyncInvokeTagging",
  "Effect": "Allow",
  "Action": [
    "bedrock:TagResource"
  ],
  "Resource": "arn:aws:bedrock:*:*:async-invoke/*"
},
{
  "Sid": "BedrockModelDiscovery",
  "Effect": "Allow",
  "Action": [
    "bedrock:ListFoundationModels",
    "bedrock:GetFoundationModelAvailability",
    "bedrock:ListProvisionedModelThroughputs",
    "bedrock:ListInferenceProfiles"
  ],
  "Resource": "*"
}

Asynchronous Invocations

bedrock:GetAsyncInvoke and bedrock:TagResource (on arn:aws:bedrock:*:*:async-invoke/*) serve Bedrock asynchronous invocations, used by video generation models and asynchronous embedding models such as TwelveLabs Marengo (twelvelabs.marengo-embed-*). They can be dropped if your deployment uses none of these models. bedrock:ListAsyncInvokes and bedrock:ListTagsForResource are not part of this core set — they are only needed for video job listing (see Video Generation).

Bedrock Marketplace Auto-Subscribe (Optional)

Environment Variables: AWS_BEDROCK_MARKETPLACE_AUTO_SUBSCRIBE

Required only if you want to enable automatic subscription to new models in the AWS Marketplace (AWS_BEDROCK_MARKETPLACE_AUTO_SUBSCRIBE=true, which is the default). When enabled, the server can automatically subscribe to marketplace offerings for newly discovered models.

Bedrock Marketplace Auto-Subscribe IAM Policy Statement 
{
  "Sid": "BedrockMarketplaceAutoSubscribe",
  "Effect": "Allow",
  "Action": [
    "aws-marketplace:Subscribe",
    "aws-marketplace:ViewSubscriptions"
  ],
  "Resource": "*"
}

Cost Consideration

Automatic marketplace subscriptions may incur costs. Review AWS Marketplace pricing for individual models before enabling this feature, or set AWS_BEDROCK_MARKETPLACE_AUTO_SUBSCRIBE=false to require manual marketplace subscription.

Bedrock Inference Profiles and Prompt Routers (Optional)

Environment Variables: AWS_BEDROCK_ALLOW_CROSS_REGION_INFERENCE_PROFILE_ARN, AWS_BEDROCK_ALLOW_APPLICATION_INFERENCE_PROFILE_ARN, AWS_BEDROCK_ALLOW_PROMPT_ROUTER_ARN, AWS_BEDROCK_MODEL_ARN_MAPPING

Required only if you enable ARN-based routing features that allow users to pass inference profile or prompt router ARNs directly as model IDs, or if you configure server-side ARN mappings.

Bedrock Inference Profiles and Prompt Routers IAM Policy Statement 
{
  "Sid": "BedrockInferenceProfilesAndPromptRouters",
  "Effect": "Allow",
  "Action": [
    "bedrock:GetInferenceProfile",
    "bedrock:GetPromptRouter"
  ],
  "Resource": "*"
}

When to Include

Add these permissions when:

  • AWS_BEDROCK_ALLOW_CROSS_REGION_INFERENCE_PROFILE_ARN=true
  • AWS_BEDROCK_ALLOW_APPLICATION_INFERENCE_PROFILE_ARN=true
  • AWS_BEDROCK_ALLOW_PROMPT_ROUTER_ARN=true
  • AWS_BEDROCK_MODEL_ARN_MAPPING is configured with any mappings

Bedrock Guardrails (Optional)

Environment Variables: AWS_BEDROCK_GUARDRAIL_IDENTIFIER, AWS_BEDROCK_GUARDRAIL_VERSION

Required if you configure Bedrock Guardrails for content filtering, use the moderation request parameter, or select a guardrail on the Moderations API (without a guardrail, that API falls back to Comprehend toxicity moderation). See the Bedrock Guardrails configuration section.

Bedrock Guardrails IAM Policy Statement 
{
  "Sid": "BedrockGuardrails",
  "Effect": "Allow",
  "Action": [
    "bedrock:ApplyGuardrail"
  ],
  "Resource": "arn:aws:bedrock:*:*:guardrail/*"
}

Bedrock Session Storage (Optional)

Environment Variables: none (enabled by the store=true request parameter; see Bedrock Session Storage configuration)

Required only if clients use store=true on the Responses or Chat Completions APIs, which persist generations in Amazon Bedrock sessions.

Bedrock Session Storage IAM Policy Statement 
{
  "Sid": "BedrockSessionStorage",
  "Effect": "Allow",
  "Action": [
    "bedrock:CreateSession",
    "bedrock:CreateInvocation",
    "bedrock:PutInvocationStep",
    "bedrock:ListInvocations",
    "bedrock:ListInvocationSteps",
    "bedrock:GetInvocationStep",
    "bedrock:EndSession",
    "bedrock:DeleteSession",
    "bedrock:TagResource",
    "bedrock:ListTagsForResource"
  ],
  "Resource": "arn:aws:bedrock:*:*:session/*"
},
{
  "Sid": "BedrockSessionListing",
  "Effect": "Allow",
  "Action": "bedrock:ListSessions",
  "Resource": "*"
}

bedrock:ListSessions and bedrock:ListTagsForResource serve the stored chat completions listing endpoint (GET /v1/chat/completions); the account-level ListSessions action does not support resource scoping.

Add kms:Decrypt and kms:GenerateDataKey on the key when AWS_BEDROCK_SESSION_ENCRYPTION_KEY_ARN is configured.

Bedrock Mantle (Optional)

Environment Variables: AWS_BEDROCK_MANTLE_ENABLED

Required for AWS_BEDROCK_MANTLE_ENABLED (enabled by default), which exposes models served by the Amazon Bedrock Mantle endpoint (OpenAI GPT, xAI Grok, Google Gemma, and more). Without these permissions the server still starts normally: Mantle models are not listed and a warning is logged.

Bedrock Mantle IAM Policy Statements 
{
  "Sid": "BedrockMantleInference",
  "Effect": "Allow",
  "Action": [
    "bedrock-mantle:CreateInference",
    "bedrock-mantle:GetInference",
    "bedrock-mantle:DeleteInference",
    "bedrock-mantle:ListModels",
    "bedrock-mantle:GetModel",
    "bedrock-mantle:CountTokens",
    "bedrock-mantle:CancelInference"
  ],
  "Resource": "arn:aws:bedrock-mantle:*:*:project/*"
},
{
  "Sid": "BedrockMantleBearerToken",
  "Effect": "Allow",
  "Action": "bedrock-mantle:CallWithBearerToken",
  "Resource": "*"
}

bedrock-mantle:CallWithBearerToken authorizes the short-term bearer tokens the server derives from its AWS credential chain; it does not support resource scoping.

S3 File Storage (Optional)

Environment Variables: AWS_S3_BUCKET, AWS_S3_REGIONAL_BUCKETS

Required for storing generated images, audio files, documents, and videos. See Storage Configuration for bucket setup details.

S3 File Storage IAM Policy Statements 
{
  "Sid": "S3FileStorage",
  "Effect": "Allow",
  "Action": [
    "s3:PutObject",
    "s3:PutObjectTagging",
    "s3:GetObject",
    "s3:DeleteObject",
    "s3:CreateMultipartUpload",
    "s3:UploadPart",
    "s3:CompleteMultipartUpload",
    "s3:AbortMultipartUpload",
    "s3:ListMultipartUploadParts"
  ],
  "Resource": "arn:aws:s3:::AWS_S3_BUCKET_VALUE/*"
},
{
  "Sid": "S3FileStorageList",
  "Effect": "Allow",
  "Action": [
    "s3:ListBucket",
    "s3:ListBucketMultipartUploads"
  ],
  "Resource": "arn:aws:s3:::AWS_S3_BUCKET_VALUE"
}

Replace Bucket Name

Replace AWS_S3_BUCKET_VALUE with the value of your AWS_S3_BUCKET environment variable. Repeat both statements for each AWS_S3_REGIONAL_BUCKETS bucket (used for async operations such as video generation).

If your S3 bucket uses KMS encryption, also add:

{
  "Sid": "KMSEncryptedBucket",
  "Effect": "Allow",
  "Action": [
    "kms:Decrypt",
    "kms:GenerateDataKey"
  ],
  "Resource": "arn:aws:kms:REGION:ACCOUNT_ID:key/YOUR_KMS_KEY_ID",
  "Condition": {
    "StringEquals": {
      "kms:ViaService": "s3.REGION.amazonaws.com"
    }
  }
}

KMS Security

The kms:ViaService condition restricts KMS key usage to S3 service calls only, following AWS security best practices.

Video Generation (Optional)

Environment Variables: AWS_S3_REGIONAL_BUCKETS

Video generation itself runs on the core Bedrock asynchronous invocation permissions (bedrock:InvokeModel, bedrock:GetAsyncInvoke, bedrock:TagResource) plus S3 File Storage permissions on each regional bucket. The video job listing endpoint (GET /v1/videos) additionally requires:

Video Job Listing IAM Policy Statements 
{
  "Sid": "BedrockVideoJobListing",
  "Effect": "Allow",
  "Action": [
    "bedrock:ListAsyncInvokes"
  ],
  "Resource": "*"
},
{
  "Sid": "BedrockVideoJobTags",
  "Effect": "Allow",
  "Action": [
    "bedrock:ListTagsForResource"
  ],
  "Resource": "arn:aws:bedrock:*:*:async-invoke/*"
}

The account-level ListAsyncInvokes action does not support resource scoping; ListTagsForResource reads the job metadata tags used to attribute listed jobs.

Text-to-Speech (Optional)

Environment Variables: AWS_POLLY_REGION, DEFAULT_TTS_MODEL, DEFAULT_TTS_LANGUAGE

Required for generating speech from text using Amazon Polly. See the Audio and Text-to-Speech configuration section.

Optimize Performance

Set DEFAULT_TTS_LANGUAGE to skip language detection and avoid Amazon Comprehend API calls, improving response times and reducing costs.

Polly Text-to-Speech IAM Policy Statement 
{
  "Sid": "PollyTextToSpeech",
  "Effect": "Allow",
  "Action": [
    "polly:SynthesizeSpeech",
    "polly:DescribeVoices"
  ],
  "Resource": "*"
}

Speech-to-Text (Optional)

Environment Variables: AWS_TRANSCRIBE_REGION, AWS_TRANSCRIBE_S3_BUCKET

Required for transcribing audio files using Amazon Transcribe.

Transcribe Speech-to-Text IAM Policy Statements 
{
  "Sid": "TranscribeSpeechToText",
  "Effect": "Allow",
  "Action": [
    "transcribe:StartTranscriptionJob",
    "transcribe:GetTranscriptionJob",
    "transcribe:DeleteTranscriptionJob"
  ],
  "Resource": "*"
},
{
  "Sid": "TranscribeTagging",
  "Effect": "Allow",
  "Action": [
    "transcribe:TagResource"
  ],
  "Resource": "arn:aws:transcribe:*:*:transcription-job/*"
},
{
  "Sid": "TranscribeS3Storage",
  "Effect": "Allow",
  "Action": [
    "s3:PutObject",
    "s3:GetObject",
    "s3:DeleteObject"
  ],
  "Resource": "arn:aws:s3:::AWS_TRANSCRIBE_S3_BUCKET_VALUE/*"
}

Replace Bucket Name

Replace AWS_TRANSCRIBE_S3_BUCKET_VALUE with the value of your AWS_TRANSCRIBE_S3_BUCKET environment variable (or AWS_S3_BUCKET if using the same bucket).

If your transcribe S3 bucket uses KMS encryption, also add the KMS permissions with the appropriate bucket ARN.

Language Detection (Optional)

Environment Variables: AWS_COMPREHEND_REGION

Required for automatic language detection (used by TTS for voice selection).

Comprehend Language Detection IAM Policy Statement 
{
  "Sid": "ComprehendLanguageDetection",
  "Effect": "Allow",
  "Action": [
    "comprehend:DetectDominantLanguage"
  ],
  "Resource": "*"
}

Comprehend Moderation (Optional)

Environment Variables: AWS_COMPREHEND_REGION

Required for the Moderations API toxicity backend — the default backend when no Bedrock guardrail is configured, and always available as the amazon.comprehend-toxicity model.

Comprehend Moderation IAM Policy Statement 
{
  "Sid": "ComprehendModeration",
  "Effect": "Allow",
  "Action": [
    "comprehend:DetectToxicContent"
  ],
  "Resource": "*"
}

Text Translation (Optional)

Environment Variables: AWS_TRANSLATE_REGION

Required for text translation features.

Translate Text Translation IAM Policy Statement 
{
  "Sid": "TranslateTextTranslation",
  "Effect": "Allow",
  "Action": [
    "translate:TranslateText"
  ],
  "Resource": "*"
}

API Key Authentication (Optional)

Required if you configure API authentication. See the Authentication configuration section.

SSM Parameter Store

Environment Variables: API_KEY_SSM_PARAMETER

SSM Parameter Store IAM Policy Statements 
{
  "Sid": "SSMParameterAccess",
  "Effect": "Allow",
  "Action": [
    "ssm:GetParameter"
  ],
  "Resource": "arn:aws:ssm:REGION:ACCOUNT_ID:parameter/API_KEY_SSM_PARAMETER_VALUE"
}

Replace Parameter Path

Replace API_KEY_SSM_PARAMETER_VALUE with the value of your API_KEY_SSM_PARAMETER environment variable (e.g., /stdapi/prod/api-key).

If using encrypted SSM parameters, also add:

{
  "Sid": "KMSDecryptionForSSM",
  "Effect": "Allow",
  "Action": [
    "kms:Decrypt"
  ],
  "Resource": "arn:aws:kms:REGION:ACCOUNT_ID:key/YOUR_KMS_KEY_ID",
  "Condition": {
    "StringEquals": {
      "kms:ViaService": "ssm.REGION.amazonaws.com"
    }
  }
}

KMS Security

The kms:ViaService condition restricts KMS key usage to SSM service calls only.

Secrets Manager

Environment Variables: API_KEY_SECRETSMANAGER_SECRET

Secrets Manager IAM Policy Statement 
{
  "Sid": "SecretsManagerAccess",
  "Effect": "Allow",
  "Action": [
    "secretsmanager:GetSecretValue"
  ],
  "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT_ID:secret:API_KEY_SECRETSMANAGER_SECRET_VALUE"
}

Replace Secret Name

Replace API_KEY_SECRETSMANAGER_SECRET_VALUE with the value of your API_KEY_SECRETSMANAGER_SECRET environment variable (e.g., stdapi-api-key).

Complete Policy Examples

Minimal Policy (Bedrock Only) 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockModelInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock:CountTokens",
        "bedrock:GetAsyncInvoke",
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:InvokeTool",
        "bedrock:Rerank"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BedrockAsyncInvokeTagging",
      "Effect": "Allow",
      "Action": [
        "bedrock:TagResource"
      ],
      "Resource": "arn:aws:bedrock:*:*:async-invoke/*"
    },
    {
      "Sid": "BedrockModelDiscovery",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels",
        "bedrock:GetFoundationModelAvailability",
        "bedrock:ListProvisionedModelThroughputs",
        "bedrock:ListInferenceProfiles"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BedrockMarketplaceAutoSubscribe",
      "Effect": "Allow",
      "Action": [
        "aws-marketplace:Subscribe",
        "aws-marketplace:ViewSubscriptions"
      ],
      "Resource": "*"
    }
  ]
}

Marketplace Auto-Subscribe (Default Enabled)

The marketplace permissions are included because AWS_BEDROCK_MARKETPLACE_AUTO_SUBSCRIBE defaults to true. If you set it to false, you can remove the BedrockMarketplaceAutoSubscribe statement.

Production Policy (Bedrock + S3 + Authentication) 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockModelInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock:CountTokens",
        "bedrock:GetAsyncInvoke",
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:InvokeTool",
        "bedrock:Rerank"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BedrockAsyncInvokeTagging",
      "Effect": "Allow",
      "Action": [
        "bedrock:TagResource"
      ],
      "Resource": "arn:aws:bedrock:*:*:async-invoke/*"
    },
    {
      "Sid": "BedrockModelDiscovery",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels",
        "bedrock:GetFoundationModelAvailability",
        "bedrock:ListProvisionedModelThroughputs",
        "bedrock:ListInferenceProfiles"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BedrockMarketplaceAutoSubscribe",
      "Effect": "Allow",
      "Action": [
        "aws-marketplace:Subscribe",
        "aws-marketplace:ViewSubscriptions"
      ],
      "Resource": "*"
    },
    {
      "Sid": "S3FileStorage",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:PutObjectTagging",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:CreateMultipartUpload",
        "s3:UploadPart",
        "s3:CompleteMultipartUpload",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": "arn:aws:s3:::my-stdapi-bucket/*"
    },
    {
      "Sid": "S3FileStorageList",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads"
      ],
      "Resource": "arn:aws:s3:::my-stdapi-bucket"
    },
    {
      "Sid": "SSMParameterAccess",
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter"
      ],
      "Resource": "arn:aws:ssm:us-east-1:123456789012:parameter/stdapi/prod/api-key"
    }
  ]
}

Marketplace Auto-Subscribe (Default Enabled)

The marketplace permissions are included because AWS_BEDROCK_MARKETPLACE_AUTO_SUBSCRIBE defaults to true. If you set it to false, you can remove the BedrockMarketplaceAutoSubscribe statement to follow the principle of least privilege.

Feature-Specific Permission Requirements

Feature Required Permissions Configuration
Bedrock Models (Invoke) bedrock:CountTokens
bedrock:InvokeModel
bedrock:InvokeModelWithResponseStream
bedrock:InvokeTool
bedrock:Rerank
bedrock:GetAsyncInvoke and bedrock:TagResource (on arn:aws:bedrock:*:*:async-invoke/*) for async-invoke models (video, TwelveLabs Marengo embeddings)		 Always required
Bedrock Models (Discovery) bedrock:ListFoundationModels
bedrock:GetFoundationModelAvailability
bedrock:ListProvisionedModelThroughputs
bedrock:ListInferenceProfiles		 Always required
Bedrock Marketplace Auto-Subscribe aws-marketplace:Subscribe
aws-marketplace:ViewSubscriptions		 AWS_BEDROCK_MARKETPLACE_AUTO_SUBSCRIBE=true (default)
Bedrock Inference Profiles & Prompt Routers bedrock:GetInferenceProfile
bedrock:GetPromptRouter		 AWS_BEDROCK_ALLOW_*_ARN=true or AWS_BEDROCK_MODEL_ARN_MAPPING configured
Bedrock Guardrails & Moderations bedrock:ApplyGuardrail AWS_BEDROCK_GUARDRAIL_IDENTIFIER
Stored Responses & Chat Completions Bedrock session permissions (bedrock:CreateSession, bedrock:*Invocation*, bedrock:ListSessions, bedrock:EndSession, bedrock:DeleteSession, bedrock:TagResource, bedrock:ListTagsForResource on sessions) store=true requests and stored-completion listings
Bedrock Mantle bedrock-mantle:CreateInference
bedrock-mantle:GetInference
bedrock-mantle:DeleteInference
bedrock-mantle:ListModels
bedrock-mantle:GetModel
bedrock-mantle:CountTokens
bedrock-mantle:CancelInference (on arn:aws:bedrock-mantle:*:*:project/*)
bedrock-mantle:CallWithBearerToken		 AWS_BEDROCK_MANTLE_ENABLED=true
File Storage s3:PutObject
s3:PutObjectTagging
s3:GetObject
s3:DeleteObject
s3:CreateMultipartUpload
s3:UploadPart
s3:CompleteMultipartUpload
s3:AbortMultipartUpload
s3:ListMultipartUploadParts
s3:ListBucket
s3:ListBucketMultipartUploads		 AWS_S3_BUCKET
Video Generation Core Bedrock invoke permissions (incl. bedrock:GetAsyncInvoke, bedrock:TagResource)
bedrock:ListAsyncInvokes and bedrock:ListTagsForResource (on arn:aws:bedrock:*:*:async-invoke/*) for job listing
File Storage S3 permissions on each regional bucket		 AWS_S3_REGIONAL_BUCKETS
KMS Encrypted S3 Buckets kms:Decrypt
kms:GenerateDataKey
with kms:ViaService condition		 If S3 buckets use KMS encryption
Text-to-Speech polly:SynthesizeSpeech
polly:DescribeVoices		 AWS_POLLY_REGION
Speech-to-Text transcribe:StartTranscriptionJob
transcribe:GetTranscriptionJob
transcribe:DeleteTranscriptionJob
transcribe:TagResource (on arn:aws:transcribe:*:*:transcription-job/*)
s3:PutObject (transcribe bucket)		 AWS_TRANSCRIBE_REGION
AWS_TRANSCRIBE_S3_BUCKET
Language Detection comprehend:DetectDominantLanguage AWS_COMPREHEND_REGION
Comprehend Moderations comprehend:DetectToxicContent Moderations API without a configured guardrail
Translation translate:TranslateText AWS_TRANSLATE_REGION
Cost Tracking pricing:GetProducts COST_TRACKING=true (opt-in; false by default)
SSM Parameter Store ssm:GetParameter
kms:Decrypt (if encrypted)		 API_KEY_SSM_PARAMETER
Secrets Manager secretsmanager:GetSecretValue API_KEY_SECRETSMANAGER_SECRET

IAM Role vs. IAM User

stdapi.ai supports both IAM roles and IAM users:

  • IAM Role (Recommended): Use when running on EC2, ECS, Lambda, or other AWS compute services. Attach the policy to the instance/task role.
  • IAM User: Use when running outside AWS or for development. Create an IAM user with the required permissions and configure AWS credentials via environment variables or AWS CLI configuration.

Best Practice: Use IAM Roles

When deploying on AWS infrastructure, always prefer IAM roles over IAM users with access keys. IAM roles provide automatic credential rotation and better security.

AWS Tag Policies

If your AWS organization enforces a tag policy, the following tag keys must be allowed on the relevant resource types.

Tag key Value Applied to
stdapi-ai.expires "true" S3 objects (Files API expiry)
stdapi-ai.request_id request UUID Bedrock async jobs, Transcribe jobs
stdapi-ai.server_id server instance name Bedrock async jobs, Transcribe jobs
stdapi-ai.user_id user identifier Bedrock async jobs, Transcribe jobs (when user identity is known)
aws-apn-id pc:<product-code> All AWS resources created at runtime and by the Terraform module. This is a standard AWS Marketplace attribution tag required by any AWS Marketplace product — allowing it benefits all such products deployed in your organization, not only stdapi.ai.

Next Steps