I can create Bedrock Agent using console, but can't using CLI.

Question

# TLDR;
I can create Bedrock Agent using console, but can't using CLI.

# Details
I tried to execute the following command:
```
aws bedrock-agent create-agent \
  --agent-name test-agent \
  --agent-resource-role-arn arn:aws:iam:::role/ \
  --foundation-model anthropic.claude-3-5-sonnet-20240620-v1:0 \
  --instruction "Say something about chemistry or movie industry"
```
Got the following error:
```
An error occurred (AccessDeniedException) when calling the CreateAgent operation: 
User: arn:aws:iam:::user/ is not authorized to perform: bedrock:CreateAgent
```
So I've tried to check:
```
aws iam simulate-principal-policy \
    --policy-source-arn arn:aws:iam:::user/ \
    --action-names bedrock:CreateAgent
```
And got this:
```
{
  "EvaluationResults": [
    {
      "EvalActionName": "bedrock:CreateAgent",
      "EvalResourceName": "*",
      "EvalDecision": "allowed",
      "MatchedStatements": [
        {
          "SourcePolicyId": "AdministratorAccess",
          "SourcePolicyType": "IAM Policy",
          "StartPosition": {
            "Line": 3,
            "Column": 17
          },
          "EndPosition": {
            "Line": 8,
            "Column": 6
          }
        }
      ],
      "MissingContextValues": []
    }
  ]
}
```
Using the same user I can create Bedrock Agent using AWS Management Console

# Request
Could you help identify the potential root causes of this situation and suggest possible solutions?

Pawel Szczerba · Accepted Answer

Well, finally I managed to create Bedrock Agent using API (and Terraform).

1. Service role for Amazon Bedrock Agent
- The prefix `AmazonBedrockExecutionRoleForAgents_` **must** be used for the role name.
- The path **must** be `/service-role/`.
2. Policy attached to this role
- The prefix `AmazonBedrockAgentBedrockFoundationModelPolicy_` **must** be used for the policy name.

See also [this information](https://blog.avangards.io/how-to-manage-an-amazon-bedrock-agent-using-terraform#heading-defining-resources-for-the-iam-and-lambda-dependencies).

I can't find such requirement in AWS documentation.

Didier_Durand · Answer

Hi,

This is very probably due to the fact that the credentials with which you make the CLI request from your machine are not those that you believe you use.

So, check them with CLI `aws sts get-caller-identity` on your laptop the same way that you issue the Bedrock command. It will return you the IAM identity that is used and finally the auths of this identity to see which Bedrock commands it is allowed to issue.

Best,

Didier

re:Post Agent · Answer

The situation you're experiencing, where you can create a Bedrock Agent using the AWS Management Console but not through the CLI, despite having the necessary permissions, could be due to a few potential reasons:

1. IAM Permission Discrepancy: While your IAM user appears to have the necessary permissions based on the simulate-principal-policy output, there might be a discrepancy between the permissions applied to console actions versus API/CLI actions. Sometimes, certain permissions are implicitly granted for console use but need to be explicitly defined for API/CLI use.

2. Service Control Policies (SCPs): If your AWS account is part of an organization, there might be SCPs in place that restrict API/CLI actions but not console actions for Bedrock Agents.

3. Temporary Permission Issues: There could be a temporary issue with permission propagation or caching on AWS's side.

4. Region-specific Permissions: Ensure that you're using the same region in both the console and CLI, as permissions can sometimes be region-specific.

5. CLI Configuration: Your AWS CLI might not be correctly configured with the right credentials or region.

To resolve this issue, you can try the following solutions:

1. Double-check your IAM permissions: Ensure that your IAM user or role has explicit permissions for Bedrock Agent API actions, including "bedrock:CreateAgent".

2. Use AWS CloudTrail: Check CloudTrail logs to see if there are any permission-related issues when making the API call.

3. Try using AWS STS: Use the AWS Security Token Service (STS) to obtain temporary credentials and try the operation with those.

4. Verify CLI configuration: Ensure your AWS CLI is configured correctly with the right credentials and region.

5. Contact AWS Support: If the issue persists, it might be worth contacting AWS Support for further assistance, as there could be an account-specific issue.

6. Use the new simplified configuration: Amazon Bedrock has recently introduced a simplified agent creation and configuration experience. You might want to check if this new approach works better with the CLI.

Remember to always follow the principle of least privilege when assigning permissions, granting only the necessary access required for the task at hand.  
**Sources**  
[Amazon Bedrock Agents simplifies agent creation and launches Return of Control capability](https://aws.amazon.com/about-aws/whats-new/2024/04/amazon-bedrock-agents-agent-creation-return-control-capability/)  
[Agents for Amazon Bedrock: Introducing a simplified creation and configuration experience | AWS News Blog](https://aws.amazon.com/blogs/aws/agents-for-amazon-bedrock-introducing-a-simplified-creation-and-configuration-experience/)

Didier_Durand · Answer

Hi again,

It may be due to model, can you try with claude-3-5-sonnet-20241022 ?

Not all models are optimized for agents: see https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html

Best,

Didier

I can create Bedrock Agent using console, but can't using CLI.

TLDR;

Details

Request

Relevant content