Access Denied: Bedrock Agent fails to use cross-region Guardrail

Question

I am having trouble using a Bedrock Guardrail with a Bedrock Agent when they are in different regions. My goal is to use a Guardrail with the "Standard" tier, which requires a cross-region setup for my agent.

**My Setup:**

* **Bedrock Agent Region:** `ap-northeast-1`
  * **Guardrail Region:** `ap-northeast-1` (The Guardrail itself is here, but I need to invoke it from an agent that may be in a different region, or use Guardrail profiles from other regions).
  * **IAM Role:** The IAM policy below is attached to the execution role for the Bedrock Agent.

**The Problem:**
When I try to run the agent from the console, I receive the following error:
`Access denied when calling Bedrock. Check your request permissions and retry the request.`

If I disable or detach the Guardrail from the agent, the agent works correctly and returns a response. This makes me believe the issue is specifically with the permissions for the Guardrail.

**IAM Policy:**
I created the following IAM policy based on the AWS documentation, but it doesn't seem to be working. I have included multiple regions because I am trying to authorize cross-region usage.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "bedrock:ApplyGuardrail",
            "Resource": [
                "arn:aws:bedrock:ap-northeast-1:ACCOUNT_ID:guardrail/GUARDRAIL_ID",
                "arn:aws:bedrock:ap-south-1:ACCOUNT_ID:guardrail-profile/apac.guardrail.v1:0",
                "arn:aws:bedrock:ap-northeast-3:ACCOUNT_ID:guardrail-profile/apac.guardrail.v1:0",
                "arn:aws:bedrock:ap-northeast-2:ACCOUNT_ID:guardrail-profile/apac.guardrail.v1:0",
　　　　 "arn:aws:bedrock:ap-northeast-1:ACCOUNT_ID:guardrail-profile/apac.guardrail.v1:0",
                "arn:aws:bedrock:ap-southeast-1:ACCOUNT_ID:guardrail-profile/apac.guardrail.v1:0",
                "arn:aws:bedrock:ap-southeast-2:ACCOUNT_ID:guardrail-profile/apac.guardrail.v1:0"
            ]
        }
    ]
}
```

*(Note: `ACCOUNT_ID` and `GUARDRAIL_ID` have been replaced for security.)*

**My Question:**
What could be causing this "Access Denied" error when using a Guardrail with a Bedrock Agent? Is there something wrong with my IAM policy, or is there another permission or limitation I am missing for using cross-region Guardrails with an Agent?

Thank you for your help.

re:Post Agent · Answer

There are a few potential issues causing the "Access Denied" error when using your Bedrock Guardrail with a Bedrock Agent across regions:

1. **IAM Policy-based Guardrail Enforcement Limitation**:
There's a known limitation when using IAM policy-based guardrail enforcement with Bedrock Agents. When a role is configured with a specific guardrail requirement, it shouldn't be used to access services like Bedrock Agents' `InvokeAgent`. This is because Agents make multiple `InvokeModel` calls behind the scenes, and not all of these calls include the required guardrail, resulting in `AccessDenied` errors.

2. **Missing Permissions**:
Your IAM policy includes `bedrock:ApplyGuardrail`, but you might also need additional permissions for the agent to function properly, such as `bedrock:InvokeAgent` or `bedrock:InvokeModel`.

3. **Resource-based Policy for Lambda Functions**:
If your Bedrock Agent uses Lambda functions, you need to add a resource-based policy statement on those Lambda functions. This involves:
- Going to the Lambda function's Configuration tab
- Selecting Permissions
- Adding a new permission under Resource-based Policy Statements
- Setting the Principal to "bedrock.amazonaws.com"
- Specifying your Bedrock Agent's ARN as the Source ARN
- Allowing the "lambda:InvokeFunction" action

4. **Separate Roles Recommendation**:
Consider using separate IAM roles - one for direct model access with guardrails and another for accessing composite Bedrock services like Agents.

5. **Cross-Region VPC Endpoint Limitations**:
If you're using VPC endpoints, be aware that accessing Bedrock in another region via a VPC endpoint in a different region may not be directly supported. You might need to connect to a VPC in the same region as Bedrock using VPC peering or similar methods.

To resolve this issue, I recommend:
1. Create a separate IAM role specifically for your Bedrock Agent without guardrail enforcement requirements
2. Ensure all necessary permissions are included in your policies
3. Add resource-based policies to any Lambda functions used by your agent
4. Review your cross-region setup to ensure it aligns with supported configurations  
**Sources**  
[Agent: Error: An error occurred (accessDeniedException) when calling the InvokeAgent operation: Access denied when calling Bedrock. | AWS re:Post](https://repost.aws/questions/QUWfjiC6AoQBuaST-ThfRHQg/agent-error-an-error-occurred-accessdeniedexception-when-calling-the-invokeagent-operation-access-denied-when-calling-bedrock)  
[Amazon Bedrock Guardrails announces IAM Policy-based enforcement to deliver safe AI interactions | AWS Machine Learning Blog](https://aws.amazon.com/blogs/machine-learning/amazon-bedrock-guardrails-announces-iam-policy-based-enforcement-to-deliver-safe-ai-interactions/)  
[Error when Bedrock agent invoke lambda | AWS re:Post](https://repost.aws/questions/QUXk7QWdzGTh-c5MIWch9NNQ/error-when-bedrock-agent-invoke-lambda)  
[Cross-Region Bedrock Access via VPC Endpoint and Guardrails | AWS re:Post](https://repost.aws/questions/QUwbD6SL5RSsKEHicAUMt1Zg/cross-region-bedrock-access-via-vpc-endpoint-and-guardrails)

Access Denied: Bedrock Agent fails to use cross-region Guardrail

Add your answer

Relevant content