bedrock agent permission error

Question

![Enter image description here](/media/postImages/original/IMFlNWRimFQq-cDC_KScROIw)

Didier Durand · Accepted Answer

Hi,

You should follow the guidance of https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html

It will give sample policies that you can reuse in your case.

In particular, pay attention to the trust policy (also on this page)  that you must have in your role to grant access to the Bedrock agent:

```
{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Principal": {
            "Service": "bedrock.amazonaws.com"
        },
        "Action": "sts:AssumeRole",
        "Condition": {
            "StringEquals": {
                "aws:SourceAccount": "${account-id}"
            },
            "ArnLike": {
                "AWS:SourceArn": "arn:aws:bedrock:${region}:${account-id}:agent/*"
            }
        }
    }]
}
```

Best

Didier

Kemp, Phillip · Answer

This error suggests the AmazonBedrockExecutionRoleForAgents role does not have permission to interact with the Amazon Bedrock service.

To troubleshoot:
* Review the policies attached to the role. You can use the AmazonBedrockFullAccess policy to grant the required permissions.
* If you have applied any resource-based policies to your Bedrock models, ensure they allow access from the AmazonBedrockExecutionRoleForAgents role.

bedrock agent permission error

Add your answer

Relevant content