Cloud Engineer Enablement Tasks

Role: Cloud Engineer Location: AI Governance → AI Tasks

The AI Tasks queue is where Cloud Engineers pick up the work generated by FinOps Lead model approvals. Each task represents one (model × account × region) combination that has been approved and needs IAM configuration before Product Owners can use it.

You do not need AWS console access beyond what you already have to complete these tasks — FinOps Center generates all CLI commands and deep links for each step.

The AI Tasks Queue

The queue shows one row per pending task. Each row displays:

• Model name and ARN

• Target account and region

• Rationale entered by the FinOps Lead at approval time

• Current task status

• Date approved

Task status values:

Status	Meaning
Pending	Task created; no action taken yet
In Progress	You have opened the task and started work
Implemented	You have marked the task complete; model is live for Product Owners
Cancelled	The FinOps Lead blocked the model after task creation

Filter by status using the tabs at the top of the queue. The default view shows Pending tasks.

Completing a Task

Click any task row to open the task detail panel. The panel contains four steps. Complete them in order.

Step 1 — Verify Model Access

Confirm that the model is accessible in the target account. The task panel includes a deep link to AWS Bedrock Model Access for the specific account and region. Open it and verify the model's access status is enabled. If it is not enabled, follow the AWS console steps to request access before proceeding.

Step 2 — Create the IAM Role

Create a dedicated IAM role for AI workloads using this model. The task panel generates the exact CLI command for this account, region, and model. Copy and run it in the target account.

The generated role name follows the convention:

finops-{sanitizedWorkloadName}-{4charId}

The trust policy scope is configurable — the task panel offers pre-generated trust policies for Lambda, EC2, and ECS use cases. Select the one that matches how workloads in this account invoke Bedrock.

Step 3 — Apply Deny Policy

Apply the deny-by-default policy to the role. This policy denies all Bedrock InvokeModel calls by default. The CLI command is pre-generated in the task panel. Run it in the target account.

Step 4 — Apply Model Allow Policy

Apply the model-specific allow policy. This policy uses the bedrock:InvokedModelId condition key to permit invocations only for the approved model ARN. The CLI command is pre-generated and scoped to the exact model ARN from the approval.

Run the command in the target account.

Developer Handoff Block

After completing Step 4, the task panel generates a Developer Handoff block containing:

• IAM Role ARN

• Approved Model ID

• Example SDK invocation snippet

This block is what the Product Owner needs to claim the role in Spaces and what the application team needs to configure their SDK calls. Copy it and share it with the Product Owner for this workload.

Marking the Task Implemented

Once all four steps are complete, click Mark Implemented at the bottom of the task panel.

This action:

• Changes the task status to Implemented

• Flips the ModelApprovalScope state to Implemented for this (account × region)

• Makes the model available in the Product Owner's Spaces wizard for this account and region

Important: Do not mark a task Implemented until the IAM role is confirmed created and the allow policy is applied. Product Owners will attempt to claim the role immediately after Implemented status appears.

Cross-Region Inference Profiles (MAP and High-Availability Workloads)

If the Business Request for a workload includes an Availability Requirement of Production / High Availability, the task panel will include an additional step to create an Application Inference Profile.

The inference profile is tagged:

map-migrated=mig{MPEID}

where {MPEID} is the MAP engagement ID shown in the task. This tagging is required for MAP credit eligibility. Create the profile before marking the task Implemented.

The inference profile ID is included in the Developer Handoff block when present.

Claude Platform Tasks (Claude for Enterprise)

For Claude Platform workloads (CCU billing), the task steps differ from Bedrock:

1. Create the Claude Platform workspace via the Workspace creation flow.

2. Apply the aws-external-anthropic:CreateInference IAM policy to the role.

3. Mark the task Implemented.

The task panel identifies Claude Platform tasks with a Platform: Claude Platform badge and shows the workspace-specific steps in place of the standard Bedrock steps.