Unable to create AI Agent in Bedrock as part of AWS Clould Quest Lab Create an AI Smart Assistant

Hi,

Both errors point to the same root cause, and unfortunately it's not something you can fix from your side — it's a restriction baked into the lab environment itself, not a misconfiguration in your account.

Why this happens

• The role you're using is AWSLabsUser-... — this is the temporary, sandboxed IAM role that AWS Skill Builder / Cloud Quest provisions for each lab session. These sandbox accounts are deliberately locked down with a Service Control Policy (SCP) at the AWS Organizations level, on top of whatever IAM permissions the lab role has.
• The first error explicitly says it: "no service control policy allows the bedrock:CreateAgent action" — that's an SCP-level deny, enforced above the account, which you cannot see or modify (you correctly noted you can't access the SCP — that's expected, lab users never can).
• The second error (iam:CreateRole on the AgentCore harness service role) is the same story from IAM's side: the lab role itself doesn't have permission to create service-linked roles, which Bedrock Agent Core needs to auto-provision its harness role.

Why restarting the session didn't help

Each new lab session provisions a fresh sandbox with the same SCP/IAM template, so you'll hit the identical restriction every time. This isn't a transient permission propagation issue.

What this most likely means

The bedrock:CreateAgent / AgentCore harness action either wasn't in scope for this specific lab's permission template when it was built, or Bedrock Agents/AgentCore support was added to the service after the lab's IAM policy was last updated, and the course content is ahead of the lab's permission set. This kind of drift between course content and the lab account template does happen.

What to actually do

1. Report it through AWS Skill Builder's official support channel, not here — re:Post can't fix lab-account permissions, since these are managed by the Skill Builder/Cloud Quest team, not by AWS Support in the general sense.
   • In Skill Builder, look for "Report an issue" / "Provide feedback" on the lab page itself (usually a link/icon near the lab instructions or in the lab session panel). This routes directly to the team that owns the lab's IAM/SCP template.
   • If you have a support case option under your Skill Builder account, mention: course name, module ("Create an AI Smart Assistant"), and paste the exact two errors — that's enough for them to fix the lab role's policy.
2. Do not try to work around it via your own AWS account. The lab's DIY section is graded against the sandboxed lab account (that 734842018332 account ID and the AWSLabsUser role), so completing the step in a personal/separate AWS account won't satisfy the lab checker even if it technically works.
3. While waiting on a fix, it's worth checking the Skill Builder course discussion/comments section for that specific lab — this kind of "lab environment is missing a permission for a newly added feature" issue is common right after a course is updated, and often others have already flagged it with a known ETA or workaround from the course team.

Sorry this is blocking your progress — but the fix has to come from the lab template owner, since the deny is coming from outside your control (SCP + a locked-down sandbox role), not from anything configurable within the session.