Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Permissions to perform bedrock:StartIngestionJob

0

Hello,

I am trying to perform a StartIngestionJob operation on my bedrock knowledge base from a lambda function (within a Step functions State Machine)

I keep getting "An error occurred (AccessDeniedException) when calling the StartIngestionJob operation: {lambda role} is not authorized to perform: bedrock:StartIngestionJob"

I have made sure that my lambda role has the permissions:

Statement:
  - Effect : Allow  
    Action:   
      - bedrock:*  
   Resource : "*"

I have also tried like so:

Statement:  
  - Effect: Allow  
     Action:  
        - bedrock:StartIngestionJob  
     Resource: !Sub arn:aws:bedrock:us-east-1:${AWS::AccountId}:knowledge-base/*

(My use-case requires that the lambda is able to sync knowledge bases that aren't necessarily known in advance, I plan on refining this later, but this set of permissions should work..?) So far unable to make it work

Topics
Machine Learning & AIGenerative AI on AWS
Tags
Knowledge Bases for Amazon BedrockAmazon Bedrock
Language
English

asked 2 years ago1.4K views

2 Answers
0
Accepted Answer

Hello.

Will a similar error occur if the user directly invokes Lambda instead of running Lambda with Step Functions?
Also, what kind of code are you using in Lambda?
Looking at the IAM policy, I can't find any problems, so I suspect that the region is incorrectly specified in the Lambda code, causing the error.
You may also be able to see more details by checking "StartIngestionJob" in the CloudTrail event history.
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-console.html

EXPERT

answered 2 years ago

  • Alexis
    2 years ago

    Hello, thank you for the quick answer,

    I have just rechecked, all of:

    • The lambda
    • The state machine
    • The data source S3 bucket
    • The knowledge base
    • The RDS cluster to use as vector store

    are in the same region (us-east-1). My lambda should have permissions access to all of these resources.

    In the lambda code (called within Step functions), I am using the python3.11 runtime, and the boto3 python SDK to perform the StartIngestionJob operatgion.

    I do see the AccessDenied event on CloudTrail but it doesn't seem to offer that much more insights.

  • Alexis
    2 years ago

    I have also checked, and yes, the error still occurs when invoking the lambda directly.

    Also rechecked my function code, I do specify the region_name to us-east-1 when instantiating my boto3 clients. Also, the lambda itself runs in us-east-1, so it should not be an issue even if I don't

  • Riku_Kobayashi EXPERT
    2 years ago

    Can you confirm that the "knowledgeBaseId" and "dataSourceId" specified in the "start_ingestion_job" API are correct? https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/bedrock-agent/client/start_ingestion_job.html

  • Alexis
    2 years ago

    Turns out this was the issue, thank you for the help.

    I tracked it down by trying a minimal lambda with the same role and hardcoded knowledge base and data source IDs (it worked), my dynamically resolved IDs were wrong in the other lambda. It seems the error message was off as well. (AccessDenied when it should have been about wrong IDs)

0

Hi,

I would suggest that you call https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sts/client/get_caller_identity.html and log the result just before you try to start the ingestion job.

It will allow you to make sure that you run the Lamdba under the identity that you believe it does. (I have seen cases where the Lambda is running under a role that it has assumed explicitly or not before the faulty API call. In that case, it is different from exec role and may cause the problem)

Best

Didier

EXPERT

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content