Amazon Bedrock Knowledge Base Creation Failed - "knowledge-base-quick-start-b60pt was failed to create"

Based on the error you're encountering when creating a Knowledge Base in Amazon Bedrock, there are several potential causes and troubleshooting steps you can take:

1. Check CloudTrail logs: The generic error message doesn't provide enough details to diagnose the specific issue. Search for the "CreateCollection" event in CloudTrail event history to identify if there's a problem with the OpenSearch Serverless collection creation, which is often the underlying cause of Knowledge Base creation failures.

2. IAM permissions issues: Ensure your IAM user or role has all necessary permissions. Common missing permissions include:

• IAM permissions like iam:CreatePolicyVersion, iam:PassRole
• OpenSearch Serverless permissions like aoss:CreateAccessPolicy, aoss:CreateSecurityPolicy, aoss:CreateCollection
• Bedrock model access permissions

3. Model access: Verify you have subscribed to the embedding model being used. If you're using Amazon Titan embedding models, you need to explicitly subscribe to them in the Bedrock Marketplace. Data sync failures often occur when the Knowledge Base role doesn't have access to the specified embedding model.

4. Root user restriction: Ensure you're not trying to create the Knowledge Base using the root user account, as this is not supported. You must use an IAM user or role.

5. Service role configuration: Check that the service role (AmazonBedrockExecutionRoleForKnowledgeBase_b60pt) has the correct trust relationship with the Bedrock service and appropriate permissions.

6. IAM policy resource paths: If you've created custom policies, ensure the resource ARNs are correctly formatted. For example, policies might need to follow the pattern: arn:aws:iam::<Account ID>:policy/service-role/AmazonBedrockS3PolicyForKnowledgeBase_*

This doesn't appear to be related to development account limitations specifically, but rather to configuration or permission issues that can occur in any environment.
Sources
Bedrock Knowledge Base Failed to Fetch Error | AWS re:Post
Error creating knowledge bases amazon bedrock "Failed to create the Amazon Opensearch Serverless collection." | AWS re:Post
Knowledge Base creation error | AWS re:Post
Data sync failed error in Amazon Bedrock Knowledgebase | AWS re:Post
Permission issues while creating knowledge base in bedrock | AWS re:Post

Hey there ,I’ve seen this exact issue while working with Amazon Bedrock Knowledge Bases, and I’ll walk you through what actually causes this and how to fix it. Let’s break it down.

Root Cause: This failure typically occurs after OpenSearch is created successfully but Bedrock can't finalize the Knowledge Base due to one of the following:

1. Missing or Misconfigured IAM Role Even though you created AmazonBedrockExecutionRoleForKnowledgeBase_b60pt, verify that it has the exact trust relationship and managed policies required.

Go to the IAM Console → Roles → your role. Confirm the trust policy includes: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "bedrock.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } Ensure it has this AWS managed policy attached: AmazonBedrockFullAccess (or equivalent granular permissions like bedrock:, opensearch:, s3:GetObject, iam:PassRole, etc.)

2. KMS Encryption Key Permissions (if applicable) If your S3 bucket or OpenSearch domain is using a customer-managed KMS key, then Bedrock must have permission to use that key. Otherwise, it will silently fail at the final step. Add this to your KMS key policy:

{ "Sid": "AllowBedrockUseOfTheKey", "Effect": "Allow", "Principal": { "Service": "bedrock.amazonaws.com" }, "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*" }

3. CloudWatch Logs – Where to Look You won’t see logs under “Bedrock.” Instead, check these locations: CloudTrail → Look for CreateKnowledgeBase events. CloudWatch Log Groups → Look for log groups under /aws/bedrock/knowledge-base/... (if logging was enabled). OpenSearch logs may also show permission-related or ingestion errors.

4. Dev Account Limitations Some AWS development accounts (e.g., sandbox/partner orgs, AWS Free Tier) have limited service quotas or restricted service-linked roles. Go to Service Quotas → Amazon Bedrock → Check limits like: Knowledge bases per account Data sources per knowledge base If you’re using a Control Tower org, check if Service Control Policies (SCPs) are restricting IAM, Bedrock, or OpenSearch actions.

5. Try Minimal Working Example

To rule out misconfigurations, test a simple S3-only data source: Upload a small .txt file to an S3 bucket Ensure that bucket policy allows Bedrock to read (public read is not enough, it must be via IAM) Attach the correct IAM role to Bedrock with full S3 access Create the Knowledge Base using: S3 as source Default embedding model (Titan or Claude) Your verified OpenSearch