Create a Bedrock Service role in AWS IAM console?

Question

When trying to a directly create a service role to delegate to a Bedrock service (e.g. Knowledge Base, or Agent), Bedrock is not selectable in the use case listing.
* Console can automatically create service roles when creating the bedrock service instance, but the user creating the roles and the user creating the bedrock instance are different users, so this functionality cannot be used as-is.

Is the inability to select bedrock as a service an oversight in the console interface, or an oversight on my side in being a different name?

Currently, we are working around the console interface by creating the role for a different service, and then editing the JSON role definition to delegate it to bedrock... but this is incovenient for the IAM administrator user to create the role.

re:Post Agent · Answer

When creating a custom service role for Amazon Bedrock features like Knowledge Base or Agents, you won't find "Bedrock" directly listed in the service selection dropdown in the IAM console. This isn't an oversight on your part.

The recommended approach for creating a custom service role for Amazon Bedrock is to:

1. Create a role by following the steps for delegating permissions to an AWS service
2. Attach a trust policy that specifically allows the Bedrock service to assume the role
3. Attach the relevant identity-based permissions needed for your specific Bedrock feature

Your current workaround of creating a role for a different service and then editing the JSON trust policy to delegate to Bedrock is actually the correct approach. The trust policy should include the Bedrock service principal (bedrock.amazonaws.com).

For example, when creating a service role for Bedrock Agents, you would need to attach a trust policy that allows Amazon Bedrock to assume the role and create/manage agents. Similarly, for Bedrock Flows, the trust policy would allow Amazon Bedrock to assume the role and manage flows.

After creating the role with the proper trust relationship, you would then attach the appropriate permissions policies based on the specific Bedrock feature you're using (Agents, Knowledge Bases, Flows, etc.) and your particular use case.  
**Sources**  
[Service roles - Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-sr.html)  
[Create a service role for Amazon Bedrock Agents - Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html)  
[Create a service role for Amazon Bedrock Flows in Amazon Bedrock - Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/flows-permissions.html)  
[Create a custom service role for batch inference - Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/batch-iam-sr.html)

Create a Bedrock Service role in AWS IAM console?

Add your answer

Relevant content