How do I resolve "Access denied" errors when I create, test, or invoke Amazon Bedrock agents?

Resolution

If your AWS Identity and Access Management (IAM) identity doesn't have the required permissions or access to the model, then you receive the following error:

"Access denied when calling Bedrock. Check your request permissions and retry the request."

Add the required permissions

Check the permissions for your IAM role

To use Amazon Bedrock agents, your IAM identity must have the required permissions. To grant permissions, attach the AmazonBedrockFullAccess policy to your IAM role. You can use the default service role that Amazon Bedrock automatically creates, or you can create your own custom service role.

Check the permissions for integrated services

If you receive the "Access denied" error when your agent interacts with other AWS services, then make sure that Amazon Bedrock can access the services.

For more information, see the following documentation:

• Configure access to Amazon Simple Storage Service (Amazon S3) buckets
• Resource-based policy to allow Amazon Bedrock to invoke an action group AWS Lambda function
• IAM tutorial: Delegate access across AWS accounts using IAM roles

Confirm that you can access the model

Amazon Bedrock automatically provides access to serverless models.

To manually confirm model access, complete the following steps:

1. Open the Amazon Bedrock console.
2. In the navigation pane, under Test, choose Chat / Text playground.
3. Choose Select model, and then select your model to confirm that you can access it.

Related information

Working with models not yet optimized for Amazon Bedrock Agents