Access Denied on bedrock:CreateAgent via CloudFormation, but IAM Simulator shows allowed.

Based on your description, there appears to be a discrepancy between what the IAM Policy Simulator shows and the actual permissions when executing CloudFormation operations to create a Bedrock Agent. Here are several potential causes and solutions:

1. Service Role Requirements for Bedrock Agents: Amazon Bedrock Agents may have specific naming requirements for service roles. For example, the role name might need to use the prefix AmazonBedrockExecutionRoleForAgents_ and have a specific path like /service-role/. Even though your minimal template doesn't explicitly create a role, CloudFormation might be attempting to use or create a default role with incorrect naming conventions.

2. Missing Permissions in the Policy: While your policy includes bedrock:CreateAgent, creating an agent through CloudFormation might require additional permissions that aren't explicitly listed in your policy. The IAM Policy Simulator might not accurately reflect all the permissions needed for the complete operation. Consider adding more comprehensive Bedrock permissions such as:

• bedrock:ListFoundationModels
• bedrock:GetFoundationModel
• bedrock:TagResource
• And other Bedrock-related permissions

3. Inference Profile vs Foundation Model: If you're using an inference profile rather than a foundation model, you might need additional permissions like:

• bedrock:GetInferenceProfile
• bedrock:ListInferenceProfiles
• bedrock:UseInferenceProfile

4. Hidden Service Control Policies (SCPs): Even though you can't see SCPs in the Organizations console, there might still be SCPs applied to your account. The unusual behavior in the Organizations console could indicate an issue with your organization's configuration. SCPs can override identity-based policies even when the simulator shows permissions as allowed.

5. Region-specific Permissions: Ensure that the model you're trying to use is available in the region where you're deploying the CloudFormation stack. Some models are only available in specific regions.

6. CloudFormation Service Role: The CloudFormation service itself might be using a role that doesn't have the necessary permissions to create Bedrock resources.

To troubleshoot:

1. Try creating the Bedrock Agent directly through the AWS CLI instead of CloudFormation to isolate whether the issue is with CloudFormation or with Bedrock permissions.

2. Check CloudTrail logs for the specific denied action to see more details about why the permission is being denied.

3. Temporarily grant broader permissions (like AdministratorAccess) to test if it's a permission issue.

4. Contact AWS Support about the anomaly in your Organizations console, as this might indicate a deeper issue with your account configuration.
   Sources
   I can create Bedrock Agent using console, but can't using CLI. | AWS re:Post
   CDK - Resource handler returned message: "Access denied for operation 'AWS::Bedrock::Agent'." when creating an agent with foundationModel set as inference-profile. | AWS re:Post
   How do I troubleshoot when User: arn is no authorized to perform Create * or Delete * or Update * on resource(s) because no identity- policy allows the actions | AWS re:Post
   Identity-based policy examples for Amazon Bedrock Agents - Amazon Bedrock

Hello.

An IAM user with the IAM policy described in the following document was able to deploy the CloudFormation template you created.
https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "test",
            "Effect": "Allow",
            "Action": [  
                "bedrock:ListFoundationModels",
                "bedrock:GetFoundationModel",
                "bedrock:TagResource", 
                "bedrock:UntagResource", 
                "bedrock:ListTagsForResource", 
                "bedrock:CreateAgent", 
                "bedrock:UpdateAgent", 
                "bedrock:GetAgent", 
                "bedrock:ListAgents", 
                "bedrock:DeleteAgent",
                "bedrock:CreateAgentActionGroup", 
                "bedrock:UpdateAgentActionGroup", 
                "bedrock:GetAgentActionGroup", 
                "bedrock:ListAgentActionGroups", 
                "bedrock:DeleteAgentActionGroup",
                "bedrock:GetAgentVersion",
                "bedrock:ListAgentVersions", 
                "bedrock:DeleteAgentVersion",
                "bedrock:CreateAgentAlias", 
                "bedrock:UpdateAgentAlias",               
                "bedrock:GetAgentAlias",
                "bedrock:ListAgentAliases",
                "bedrock:DeleteAgentAlias",
                "bedrock:AssociateAgentKnowledgeBase",
                "bedrock:DisassociateAgentKnowledgeBase",
                "bedrock:ListAgentKnowledgeBases",
                "bedrock:GetKnowledgeBase",
                "bedrock:ListKnowledgeBases",
                "bedrock:PrepareAgent",
                "bedrock:InvokeAgent",
                "bedrock:AssociateAgentCollaborator",
                "bedrock:DisassociateAgentCollaborator",
                "bedrock:GetAgentCollaborator",
                "bedrock:ListAgentCollaborators",
                "bedrock:UpdateAgentCollaborator"
            ],
            "Resource": "*"
        }
    ]   
}