A company has access to Amazon Bedrock and wants to limit which Bedrock models specific employees can use. Which approach satisfies this requirement?

AWS Identity and Access Management (IAM) policies are the correct and most granular way to control access to specific Amazon Bedrock models. IAM policies allow you to define permissions that specify which actions (e.g., bedrock:InvokeModel) can be performed on which resources (e.g., a specific Bedrock model ARN) by which users or roles. This directly addresses the requirement to limit model usage for specific employees. AWS Security Token Service (AWS STS) generates temporary credentials but doesn't define the permissions themselves; those are still governed by IAM policies attached to the role or user. IAM service roles are used for services to assume permissions, not typically for restricting individual user access to specific models within a service. Amazon Inspector is a security assessment service, not an access control mechanism.