AWS DevOps Agent - Topology Shows 0 Resources Found

Hi all, I’m testing AWS DevOps Agent and ran into a weird issue with topology / resource discovery.

Basically, I created a new DevOps Agent Space in us-east-1, associated my AWS account and attached a service role for the agent (through auto-create), gave it access to my EKS Cluster through an IAM Access Entry, and gave the service role the following policies: "AIOpsAssistantPolicy" (per official documentation) and "AWSResourceExplorerReadOnlyAccess", as well as some extra inline policies.

The topology page just says “Analyzing your topology” and shows 0 resources found, even after a few hours have passed. I'm not using a CloudFormation stack, but rather AWS Tags from the Capabilities section, where I basically put 2 of the tags that my resources are provisioned with from my Terraform code, so the agent can find the resources I created through Terraform and create the topology with them. I double-checked (and probably more than quadruple-checked) that the tags are correct, and they are. I even went into resource explorer, searched for resources with those tags, and it found them.

Agent diagnostics show an error like: AccessDeniedException ... not authorized to perform: resource-explorer-2:Search ... because no session policy allows the resource-explorer-2:Search action

What I’ve checked:

Resource Explorer:

• Aggregator index is configured in us-east-1.
• A view that includes the whole account is configured and active.
• If I run resource-explorer-2 list-views and get-view from the CLI, they work.
• If I run resource-explorer-2 search with a tag query (for example, tag.Owner:...), it returns my VPCs, EKS cluster, etc.

IAM role for DevOps Agent:

The role assumed by DevOps Agent has:

• An inline policy that explicitly allows: resource-explorer-2:Search resource-explorer-2:GetView resource-explorer-2:ListViews
• AWS managed policies including "AIOpsAssistantPolicy" and "AWSResourceExplorerReadOnlyAccess".

IAM simulate-principal-policy on this role shows: Search → allowed GetView → allowed ListViews → allowed

If I manually sts:AssumeRole into the same role and then run resource-explorer-2 search from the CLI, it works and returns resources.

What DevOps Agent reports (yeah I know, using DevOps agent to diagnose DevOps agent problems, insert spiderman pointing at another spiderman meme):

DevOps Agent’s own analysis says that when it assumes the role, the session policy attached to the STS session does not include resource-explorer-2:Search. So even though the role policy allows Search, the session policy effectively filters it out and the call is denied. As a result, the topology UI shows 0 resources.

Is this a known issue or misconfiguration with AWS DevOps Agent’s use of STS session policies? It looks like the service is assuming the role with a restrictive session policy that omits resource-explorer-2:Search.

What is the recommended way to fix this from the DevOps Agent side, given that:

The role policies and Resource Explorer configuration are already correct. Manual AssumeRole + Resource Explorer search works, but DevOps Agent’s own session still gets AccessDenied for Search?

P.S - I created a DevOps Agent Space yesterday, literally only added tags to capabilities, and added IAM access entry to my EKS Cluster with the "AIOpsAssistantPolicy" managed policy, and everything worked fine, resources were detected and topology was created. Today I decided to delete that agent space, create a new one (because it wasn't seeing my load balancer before), and now it's not finding any resources at all.

Perhaps this is a known bug that the team is working to fix? Would really help in my investigation to know the situation of this problem.

Thank you so much!