Agent: Error: An error occurred (accessDeniedException) when calling the InvokeAgent operation: Access denied when calling Bedrock.

Based on the information provided, there are a few potential reasons for the AccessDeniedException error you're encountering when trying to invoke the Bedrock agent:

1. IAM Permissions: While you have the AmazonBedrockFullAccess policy attached, there might be a specific permission missing for the InvokeAgent operation. Ensure that your IAM role has the "bedrock:InvokeAgent" permission explicitly allowed.

2. Resource-based Policy: The Bedrock agent might require a resource-based policy statement on the associated Lambda function. You may need to add a permission that allows the Bedrock service to invoke the Lambda function.

3. Service Control Policies (SCPs): If your AWS account is part of an organization, there might be SCPs in place that restrict certain Bedrock actions.

4. Region Mismatch: Confirm that the region specified in your boto3 client matches the region where your Bedrock agent is deployed.

5. Account Spend Limit: The support agent's assumption about the $0 spend limit could be a factor, but it's not typically a common cause for AccessDenied errors. However, if your account has restrictions due to billing or usage limits, it might affect certain API calls.

To address these potential issues:

1. Review your IAM role permissions and ensure "bedrock:InvokeAgent" is explicitly allowed.

2. Add a resource-based policy to your Lambda function allowing Bedrock to invoke it. You can do this by:

   • Going to the Lambda function's Configuration tab
   • Selecting Permissions
   • Adding a new permission under Resource-based Policy Statements
   • Setting the Principal to "bedrock.amazonaws.com"
   • Specifying your Bedrock Agent's ARN as the Source ARN
   • Allowing the "lambda:InvokeFunction" action

3. Double-check that your boto3 client is using the correct region.

4. If possible, try invoking the agent using the AWS Management Console to see if the issue persists outside of programmatic access.

5. Contact AWS Support to confirm if there are any account-level restrictions affecting your Bedrock usage.

If these steps don't resolve the issue, you may need to work with AWS Support to investigate further, as there could be account-specific factors at play.
Sources
Error when Bedrock agent invoke lambda | AWS re:Post
Resolve InvokeModel API error in Amazon Bedrock | AWS re:Post
I can create Bedrock Agent using console, but can't using CLI. | AWS re:Post

Hello.

Could you please share all the IAM policies you have set for the IAM role?
It is possible that "InvokeAgent" is explicitly denied or that the policy settings are incorrect and it is not working.
Additionally, if you configure CloudTrail to record data events, you may be able to view details in CloudTrail.
https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html#service-name-data-events-cloudtrail

Has this issue been solved yet? I ran into a similar problem, updating the version of the aliases solved the problem for me. My issue was I didnt have the correct policy statements attached to the role at first, but adding them in CDK wasnt enough to fix the production version of the agent. Making changes in CDK only propegates to the draft version of the agent, not the production alias, we have to update that manually at this point in time, or replace it during deployment with a new alias with a different ID.