From 8ce0e4391e6fcfab1862e29ccd108959c308370b Mon Sep 17 00:00:00 2001
From: xnoto <steven@makeitwork.cloud>
Date: Tue, 25 Aug 2026 14:49:11 -0600
Subject: [PATCH] fix: allow bedrock marketplace auto-subscription for opencode
 user

First invocation of a model auto-subscribes the account now that the
Model access console page is retired; Bedrock performs the subscription
via AWS Marketplace on the caller's behalf. Without these actions,
invoking a not-yet-subscribed model fails with a marketplace denial.
Scoped with aws:CalledViaLast=bedrock.amazonaws.com per AWS docs.
---
 aws-bedrock.tf | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/aws-bedrock.tf b/aws-bedrock.tf
index 3887250..58fc06a 100644
--- a/aws-bedrock.tf
+++ b/aws-bedrock.tf
@@ -163,6 +163,23 @@ resource "aws_iam_user_policy" "bedrock_opencode" {
         Action   = ["bedrock:ListModelInvocationJobs"]
         Resource = "*"
       },
+      {
+        # Model access page is retired: first invoke auto-subscribes the
+        # account, which Bedrock performs via AWS Marketplace on the caller's
+        # behalf. Without this, new models fail with a marketplace denial.
+        Sid    = "MarketplaceModelSubscription"
+        Effect = "Allow"
+        Action = [
+          "aws-marketplace:ViewSubscriptions",
+          "aws-marketplace:Subscribe"
+        ]
+        Resource = "*"
+        Condition = {
+          StringEquals = {
+            "aws:CalledViaLast" = "bedrock.amazonaws.com"
+          }
+        }
+      },
       {
         Sid    = "BatchDataS3Access"
         Effect = "Allow"