Workaround for error during creation of simple Bedrock Knowledgebase instance "The knowledge base storage configuration provided is invalid..."

Question

Good morning!  Creating a Bedrock Knowledgebase unfortunately started to fail for us (via the AWS console) early January.  Wondering if anyone has encountered this and found a workaround.  I've opened tickets, but it is taking a long time to resolve and clients are nipping at our heels!

As note, there are no failures in CloudTrail ahead of this failure, here's the event that fails (also evidenced in the Network console during actual creation):

```
{
    "eventVersion": "1.09",
    "userIdentity": {},
    "eventTime": "2025-01-22T15:01:36Z",
    "eventSource": "bedrock.amazonaws.com",
    "eventName": "CreateKnowledgeBase",
    "awsRegion": "us-east-1",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
    "errorCode": "ValidationException",
    "requestParameters": {
        "name": "***",
        "knowledgeBaseConfiguration": {
            "type": "VECTOR",
            "vectorKnowledgeBaseConfiguration": {
                "embeddingModelArn": "arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2:0",
                "embeddingModelConfiguration": {
                    "bedrockEmbeddingModelConfiguration": {
                        "dimensions": 1024
                    }
                }
            }
        },
        "clientToken": "removed",
        "roleArn": "removed",
        "storageConfiguration": {
            "opensearchServerlessConfiguration": {
                "collectionArn": "removed",
                "fieldMapping": {
                    "metadataField": "***",
                    "textField": "***",
                    "vectorField": "***"
                },
                "vectorIndexName": "***"
            },
            "type": "OPENSEARCH_SERVERLESS"
        }
    },
    "responseElements": {
        "Access-Control-Expose-Headers": "x-amzn-Apigw-id,x-amzn-ErrorMessage,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-Trace-id,refreshtoken,Date",
        "message": "The knowledge base storage configuration provided is invalid... Dependency error document status code: 403, error message: Bad Authorization"
    },
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "removed",
    "eventCategory": "Management"
}
```

Anyone else encountered this?

Ankur_J · Answer

Hello,

I understand you are facing the below error while trying to create Bedrock Knowledgebase instance:

+++++++  
The knowledge base storage configuration provided is invalid... Dependency error document status code: 403, error message: Bad Authorization  
+++++++

The above error is generally caused due to one of the following scenarios

1. The service role doesn't have the necessary permissions for Amazon OpenSearch Serverless collections. 
2. The data access policy for the collection doesn't include the service role under the Principal section.

To verify if the permissions are in order, could you please verify the service role as well as the data access policy that is attached to the OpenSearch Collection. For detailed information you can check the article: https://repost.aws/knowledge-center/bedrock-knowledge-base-permission-errors

Also since I do not have access to your resources I would not be able to verify the same at my end and hence I would request you to follow up on the tickets opened with the AWS support.

re:Post Agent · Answer

It appears you're encountering a common permission-related error when trying to create a knowledge base in Amazon Bedrock. This error typically occurs due to insufficient permissions or incorrect configuration of the service role and OpenSearch Serverless collection.

To resolve this issue, you should check and ensure the following:

1. Verify that the service role you're using has the necessary permissions for Amazon OpenSearch Serverless collections. The role should have appropriate access to interact with the OpenSearch Serverless resources.

2. Check the data access policy for your OpenSearch Serverless collection. Make sure that the service role you're using for Bedrock is included in the "Principal" section of this policy.

3. Ensure that Amazon Bedrock is correctly authenticated with AWS Secrets Manager, if you're using it in your configuration.

4. If you're using a private OpenSearch Serverless collection, make sure that Amazon Bedrock (bedrock.amazonaws.com) is added to the network policy to allow access to the private collection and VPC endpoint.

5. Double-check that you're not using the root user account to create the knowledge base. Amazon Bedrock doesn't support knowledge base creation with a root user. Instead, use an IAM user or IAM role with the necessary Bedrock permissions.

6. If you're using custom S3 buckets in your configuration, ensure that the access keys for these buckets are valid and have the required permissions.

If you've verified all these points and are still encountering issues, it may be worth regenerating access keys or recreating the necessary IAM roles and policies to ensure they are correctly configured.

Remember that some of these changes may take some time to propagate across AWS systems due to eventual consistency, so you might need to wait a short while after making changes before retrying the knowledge base creation.  
**Sources**  
[Resolve Amazon Bedrock knowledge base permission errors | AWS re:Post](https://repost.aws/knowledge-center/bedrock-knowledge-base-permission-errors)  
[Create a knowledge base with an OpenSearch Serverless collection | AWS re:Post](https://repost.aws/knowledge-center/bedrock-knowledge-base-private-network-policy)  
[Bedrock Knowledge Base storage configuration invalid | AWS re:Post](https://repost.aws/questions/QUTJWrzlceQaqYMuxOIkZSSA/bedrock-knowledge-base-storage-configuration-invalid)  
[Knowledge Base creation error | AWS re:Post](https://repost.aws/questions/QUVp_SZZGCSl280ztOvOKv0g/knowledge-base-creation-error)

Workaround for error during creation of simple Bedrock Knowledgebase instance "The knowledge base storage configuration provided is invalid..."

Add your answer

Relevant content