From 5041c0b85d16886f76bf8313fadc8a8a3f42a7b2 Mon Sep 17 00:00:00 2001
From: Local E2E <ci@local>
Date: Fri, 8 May 2026 03:58:22 +0000
Subject: [PATCH] docs: add bedrock:CountTokens to IAM policy examples

Strands SDK uses bedrock:CountTokens to estimate token usage before
model calls, enabling proactive context window management. Users running
Strands-based agents need this permission in their IAM policies.
---
 docs/policies/iam-policy-boundary.json | 2 +-
 docs/policies/iam-policy-user.json     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/policies/iam-policy-boundary.json b/docs/policies/iam-policy-boundary.json
index 751278c00..1a0cb6f8c 100644
--- a/docs/policies/iam-policy-boundary.json
+++ b/docs/policies/iam-policy-boundary.json
@@ -4,7 +4,7 @@
     {
       "Sid": "BedrockModelAccess",
       "Effect": "Allow",
-      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
+      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:CountTokens"],
       "Resource": ["arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:ACCOUNT_ID:*"]
     },
     {
diff --git a/docs/policies/iam-policy-user.json b/docs/policies/iam-policy-user.json
index b7fa29118..38c728542 100644
--- a/docs/policies/iam-policy-user.json
+++ b/docs/policies/iam-policy-user.json
@@ -116,7 +116,7 @@
     {
       "Sid": "BedrockModelInvocation",
       "Effect": "Allow",
-      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
+      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:CountTokens"],
       "Resource": "*"
     },
     {