Getting AccessDeniedException error in BedrockAgentCore due to CreateAgentRuntime

Question

I am getting the below error while doing 'agentcore launch' in Windows
❌ Launch failed: An error occurred (AccessDeniedException) when calling the CreateAgentRuntime operation: User: arn:aws:iam::*******4406:user/****92 is not authorized to perform: bedrock-agentcore:CreateAgentRuntime
I have made many changes to my IAM policy to try different combinations
My config looks correct
      Name                    Value             Type    Location
      ----                    -----                     ----    --------
   profile                             None    None
access_key     ****************XL7U     env
secret_key     ****************nb75      env
    region                us-west-2              env    ['AWS_REGION', 'AWS_DEFAULT_REGION']

Here's the latest version of my policy:
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": [
				"ecr:GetAuthorizationToken",
				"ecr:BatchCheckLayerAvailability",
				"ecr:GetDownloadUrlForLayer",
				"ecr:BatchGetImage",
				"ecr:CreateRepository",
				"ecr:DescribeRepositories",
				"ecr:PutImage",
				"ecr:InitiateLayerUpload",
				"ecr:UploadLayerPart",
				"ecr:CompleteLayerUpload",
				"ecr:GetAuthorizationToken",
				"bedrock:InvokeModelWithResponseStream",
				"bedrock:CallWithBearerToken",
				"bedrock:InvokeModel",
				"bedrock:CreateAgent",
				"bedrock-agentcore:CreateAgentRuntime"
			],
			"Resource": [
				"*"
			]
		}
	]
}

Hussain Shabbir · Answer

I'm encountering the same issue. Is the AI suggested answer above the right solution?

re:Post Agent · Answer

The AccessDeniedException error you're encountering when calling the CreateAgentRuntime operation indicates that your IAM user doesn't have sufficient permissions to perform this action.

While your policy includes the necessary "bedrock-agentcore:CreateAgentRuntime" permission, there are a few potential issues:

1. The IAM policy might not be correctly attached to your user or role.

2. There could be other policies or permission boundaries that are restricting this action.

3. If your AWS account is part of an organization, there might be Service Control Policies (SCPs) limiting your permissions.

To resolve this issue:

1. Verify that the policy you've shared is actually attached to your IAM user or the role you're using.

2. Check if there are any explicit deny statements in other policies attached to your user.

3. Your policy might need additional related permissions. For Amazon Bedrock AgentCore, you might need permissions for:
- IAM role creation or passing
- CloudWatch Logs access for agent runtime logging
- Additional bedrock-agentcore permissions beyond just CreateAgentRuntime

4. Ensure that your IAM user has the necessary permissions to assume any roles required by the agent runtime.

5. If you're using temporary credentials, make sure they haven't expired.

If the issue persists after these checks, you might need to contact AWS Support for account-specific assistance, as there could be account-level restrictions affecting your Bedrock AgentCore usage.  
**Sources**  
[CreateAgentRuntime - Amazon Bedrock AgentCore Control](https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_CreateAgentRuntime.html)  
[Troubleshoot AgentCore Runtime - Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-troubleshooting.html)  
[Agent: Error: An error occurred (accessDeniedException) when calling the InvokeAgent operation: Access denied when calling Bedrock. | AWS re:Post](https://repost.aws/questions/QUWfjiC6AoQBuaST-ThfRHQg/agent-error-an-error-occurred-accessdeniedexception-when-calling-the-invokeagent-operation-access-denied-when-calling-bedrock)  
[Invoke an AgentCore Runtime agent - Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-invoke-agent.html)

Getting AccessDeniedException error in BedrockAgentCore due to CreateAgentRuntime

Add your answer

Relevant content