AWS bedrock-agentcore documentation change

Service: bedrock-agentcore · 2025-11-07 · Documentation low

File: bedrock-agentcore/latest/devguide/runtime-permissions.md

Summary

Added documentation for user console permissions and expanded execution role configuration details with specific IAM policies

Security assessment

The changes add documentation about required IAM permissions for console access and runtime execution roles, including specific policy examples. While this relates to security configuration, there is no evidence of addressing a specific vulnerability or security incident. The changes appear to be standard documentation improvements for access control best practices.

Diff

diff --git a/bedrock-agentcore/latest/devguide/runtime-permissions.md b/bedrock-agentcore/latest/devguide/runtime-permissions.md
index d23c8dc16..ada99e5bc 100644
--- a//bedrock-agentcore/latest/devguide/runtime-permissions.md
+++ b//bedrock-agentcore/latest/devguide/runtime-permissions.md
@@ -5 +5 @@
-Use Amazon Bedrock AgentCoreUse the starter toolkitExecution role for running an agent in AgentCore Runtime
+Use Amazon Bedrock AgentCoreUse the starter toolkitUser permissions for Amazon Bedrock AgentCore ConsoleExecution role for running an agent in AgentCore Runtime
@@ -16,0 +17,2 @@ The following are IAM permissions you need to create an agent in an AgentCore Ru
+  * User permissions for Amazon Bedrock AgentCore Console
+
@@ -155,0 +158,30 @@ JSON
+## User permissions for Amazon Bedrock AgentCore Console
+
+Attach the [BedrockAgentCoreFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/BedrockAgentCoreFullAccess.html) policy to the console role. Additionally, add the following permissions for IAM if you want service console to auto-create the execution role.
+    
+    
+    {
+      "Version": "2012-10-17",		 	 	 
+      "Statement": [{
+        "Sid": "IAMRoleAccess",
+        "Effect": "Allow",
+        "Action": ["iam:CreateRole"],
+        "Resource": ["arn:aws:iam::*:role/service-role/AmazonBedrockAgentCoreRuntimeDefaultServiceRole-*"]
+      }, {
+        "Sid": "IAMPolicyAccess",
+        "Effect": "Allow",
+        "Action": ["iam:CreatePolicy"],
+        "Resource": ["arn:aws:iam::*:policy/service-role/AmazonBedrockAgentCoreRuntimeExecutionPolicy_*"]
+      }, {
+        "Sid": "IAMRolePolicyAccess",
+        "Effect": "Allow",
+        "Action": ["iam:AttachRolePolicy"],
+        "Resource": ["arn:aws:iam::*:role/service-role/AmazonBedrockAgentCoreRuntimeDefaultServiceRole-*"],
+        "Condition": {
+          "ArnLike": {
+            "iam:PolicyARN": "arn:aws:iam::*:policy/service-role/AmazonBedrockAgentCoreRuntimeExecutionPolicy_*"
+          }
+        }
+      }]
+    }
+
@@ -160 +192,65 @@ To run agent or tool in AgentCore Runtime you need an AWS Identity and Access Ma
-### AgentCore Runtime execution role
+The Amazon Bedrock AgentCore direct deploy execution role is an IAM role that Amazon Bedrock AgentCore assumes to run an agent. Replace the following:
+
+  * `us-east-1` with the AWS Region that you are using
+
+  * `123456789012` with your AWS account ID
+
+
+
+    
+    
+    {
+      "Version": "2012-10-17",		 	 	 
+      "Statement": [{
+        "Effect": "Allow",
+        "Action": [
+          "logs:DescribeLogStreams",
+          "logs:CreateLogGroup"
+        ],
+        "Resource": [
+          "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock-agentcore/runtimes/*"
+        ]
+      }, {
+        "Effect": "Allow",
+        "Action": ["logs:DescribeLogGroups"],
+        "Resource": ["arn:aws:logs:us-east-1:123456789012:log-group:*"]
+      }, {
+        "Effect": "Allow",
+        "Action": [
+          "logs:CreateLogStream",
+          "logs:PutLogEvents"
+        ],
+        "Resource": [
+          "arn:aws:logs:us-east-1:123456789012:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*"
+        ]
+      }, {
+        "Effect": "Allow",
+        "Action": [
+          "xray:PutTraceSegments",
+          "xray:PutTelemetryRecords",
+          "xray:GetSamplingRules",
+          "xray:GetSamplingTargets"
+        ],
+        "Resource": ["*"]
+      }, {
+        "Effect": "Allow",
+        "Resource": "*",
+        "Action": "cloudwatch:PutMetricData",
+        "Condition": {
+          "StringEquals": {
+            "cloudwatch:namespace": "bedrock-agentcore"
+          }
+        }
+      }, {
+        "Sid": "BedrockModelInvocation",
+        "Effect": "Allow",
+        "Action": [
+          "bedrock:InvokeModel",
+          "bedrock:InvokeModelWithResponseStream"
+        ],
+        "Resource": [
+          "arn:aws:bedrock:*::foundation-model/*",
+          "arn:aws:bedrock:us-east-1:123456789012:*"
+        ]
+      }]
+    }