How can I allow Amazon Lex to invoke an Amazon Bedrock Agent with the AMAZON.BedrockAgentIntent?

To allow Amazon Lex to invoke an Amazon Bedrock Agent with the AMAZON.BedrockAgentIntent, you need to ensure that the IAM role associated with your Lex bot has the necessary permissions. Here's how you can set this up:

1. Create a custom IAM role for your Lex bot if you haven't already done so. This role should have a trust relationship with the Lex service.

2. Attach a policy to this role that includes the following permissions:

   • bedrock:InvokeAgent: This action is required to invoke the Bedrock Agent.
   • bedrock:ListFoundationModels: This permission is needed for accessing the feature on the Amazon Lex V2 console.

3. In the policy, specify the ARN of your Bedrock Agent as the resource. The ARN format for a Bedrock Agent alias is: arn:aws:bedrock:region:account-id:agent-alias/agent-id/agent-alias-id

Here's an example of what the policy might look like:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeAgent",
        "bedrock:ListFoundationModels"
      ],
      "Resource": "arn:aws:bedrock:region:account-id:agent-alias/agent-id/agent-alias-id"
    }
  ]
}

4. Attach this policy to the IAM role associated with your Lex bot.

5. If you're using a service-linked role for your Lex bot, you may need to create a separate IAM role with these permissions and configure your bot to use this role instead.

6. Ensure that the Bedrock Agent itself has the necessary permissions to perform its functions. This includes having a trust policy that allows the Bedrock service to assume the role.

7. If you've applied any resource-based policies to your Bedrock models, make sure they allow access from the Lex bot's role.

By following these steps, you should be able to grant Amazon Lex the necessary permissions to invoke your Amazon Bedrock Agent using the AMAZON.BedrockAgentIntent. If you continue to encounter issues, double-check all the ARNs and make sure they match your specific resources exactly.
Sources
Invoking Amazon Bedrock Agents from chat channels using Amazon Q Developer - Amazon Q Developer in chat applications
Permissions for the AMAZON.QnAIntent - Amazon Lex
Create a service role for Amazon Bedrock Agents - Amazon Bedrock