Bedrock Agents don't support Nova inference profiles - access denied error

The issue you're experiencing with Bedrock Agents and Nova inference profiles is related to permissions and how the agent is configured to use the model.

When creating a Bedrock Agent that uses Amazon's Nova model, you need to ensure that:

1. The agent's resource role has the proper permissions to use inference profiles. Specifically, your agent role needs permissions for:

• bedrock:GetInferenceProfile
• bedrock:ListInferenceProfiles
• bedrock:UseInferenceProfile
• bedrock:InvokeModel
• bedrock:InvokeModelWithResponseStream

2. The resource ARN in your permissions should include the inference profile: arn:aws:bedrock:us-west-2:ACCOUNT_ID:inference-profile/*

3. When specifying the foundation model for your agent, make sure you're using the inference profile ARN rather than just the model ID.

The error "Access denied when calling Bedrock" typically occurs when the agent's role doesn't have the necessary permissions to invoke the model through the inference profile. The fact that the agent trace shows "amazon.nova-lite-v1:0" (without the "us." prefix) suggests that the agent might be trying to invoke the model directly rather than through the inference profile.

For Nova models, you must use an inference profile as they don't support direct on-demand throughput invocations. Your workaround of using Claude models works because some models can be invoked directly without requiring an inference profile.
Sources
CDK - Resource handler returned message: "Access denied for operation 'AWS::Bedrock::Agent'." when creating an agent with foundationModel set as inference-profile. | AWS re:Post
Flow Bedrock: Error Knowledge Bases | AWS re:Post
Error en Lab 1 del curso AWS Generative AI | AWS re:Post