docs: add bedrock:CountTokens to IAM policy examples (#1181)

jariy17 · Local E2E · web-flow · commit 804e04195970 · 2026-05-08T16:33:56.000-04:00
Strands SDK uses bedrock:CountTokens to estimate token usage before
model calls, enabling proactive context window management. Users running
Strands-based agents need this permission in their IAM policies.

Co-authored-by: Local E2E &lt;ci@local&gt;
diff --git a/docs/policies/iam-policy-boundary.json b/docs/policies/iam-policy-boundary.json
@@ -4,7 +4,7 @@
     {
       "Sid": "BedrockModelAccess",
       "Effect": "Allow",
-      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
+      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:CountTokens"],
       "Resource": ["arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:ACCOUNT_ID:*"]
     },
     {
diff --git a/docs/policies/iam-policy-user.json b/docs/policies/iam-policy-user.json
@@ -116,7 +116,7 @@
     {
       "Sid": "BedrockModelInvocation",
       "Effect": "Allow",
-      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
+      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:CountTokens"],
       "Resource": "*"
     },
     {

Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,7 @@`
`4`	`4`	`{`
`5`	`5`	`"Sid": "BedrockModelAccess",`
`6`	`6`	`"Effect": "Allow",`
`7`		`- "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],`
	`7`	`+ "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:CountTokens"],`
`8`	`8`	`"Resource": ["arn:aws:bedrock:::foundation-model/", "arn:aws:bedrock::ACCOUNT_ID:"]`
`9`	`9`	`},`
`10`	`10`	`{`
Original file line number	Diff line number	Diff line change
`@@ -116,7 +116,7 @@`
`116`	`116`	`{`
`117`	`117`	`"Sid": "BedrockModelInvocation",`
`118`	`118`	`"Effect": "Allow",`
`119`		`- "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],`
	`119`	`+ "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:CountTokens"],`
`120`	`120`	`"Resource": "*"`
`121`	`121`	`},`
`122`	`122`	`{`