AWS bedrock-agentcore documentation change

Service: bedrock-agentcore · 2026-01-22 · Documentation medium

File: bedrock-agentcore/latest/devguide/built-in-tools-troubleshooting.md

Summary

Added troubleshooting section for browser extensions including S3 permissions and extension validation

Security assessment

The new documentation emphasizes proper IAM permissions (s3:GetObject, s3:GetObjectVersion) and secure extension validation practices. While not fixing a specific vulnerability, it adds security-adjacent guidance to prevent misconfigurations that could lead to access control issues.

Diff

diff --git a/bedrock-agentcore/latest/devguide/built-in-tools-troubleshooting.md b/bedrock-agentcore/latest/devguide/built-in-tools-troubleshooting.md
index be0a7ace1..95d446582 100644
--- a//bedrock-agentcore/latest/devguide/built-in-tools-troubleshooting.md
+++ b//bedrock-agentcore/latest/devguide/built-in-tools-troubleshooting.md
@@ -170,0 +171,36 @@ In production environments, replace `allow_origins=["*"]` with specific domain o
+### Browser extensions issues
+
+#### Extension download fails with access denied
+
+**Symptom:** Session fails to start with errors related to Amazon S3 access when using extensions.
+
+**Solution:**
+
+  * Verify your IAM user or role has `s3:GetObject` and `s3:GetObjectHead` permission on the extension bucket
+
+  * Confirm the Amazon S3 bucket is owned by the same AWS account making the API call
+
+  * Check that the bucket name and prefix (object key) are correct
+
+  * If using versioned buckets, ensure you have `s3:GetObjectVersion` permission
+
+
+
+
+#### Extension rejected due to invalid format
+
+**Symptom:** Session fails to start with validation errors about the extension file format.
+
+**Solution:**
+
+  * Ensure the extension file is in ZIP format
+
+  * Verify the ZIP file contains a valid Chrome extension structure with a valid `manifest.json` file
+
+  * Check that the extension follows Chrome extension guidelines
+
+  * Ensure the ZIP was created from the extension directory contents, not the parent folder
+
+
+
+
@@ -194 +230 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-Session replay programmatic examples
+Browser Extensions