Configure an IAM for Agent discovery

  • Rversion finale: Australia
  • Mis à jour 12 mars 2026
  • 1 minute de lecture

    • Configuring IAM policy action permissions necessary for Agent discovery and integration user access on AWS to read bedrock agentic data.

    Avant de commencer

    Role required: Admin

    AWS provides the minimum given policies by default:

    • AmazonBedrockReadOnly
    • CloudWatchReadOnlyAccess

    The minimum policy action permissions needed for the integration user on AWS to read bedrock agentic data:

    • ListAgents
    • GetAgent
    • ListAgentActionsGroups
    • ListAgentVersions
    • GetInferenceProfile
    • GetFoundationModel
    • ListAgentCollaborators
    • GetAgentAlias
    Remarque :

    To exclude specific resources from AI Control Tower, you can restrict them from the resources region. Select 'all' to include all AWS bedrock agentic resources data into AI Control Tower.

    { 

    "Version": "2012-10-17", 

    "Statement": [ 

        { 

            "Sid": "VisualEditor0", 

            "Effect": "Allow", 

            "Action": [ 

                "bedrock:ListAgents", 

                "bedrock:ListAgentVersions", 

                "bedrock:ListAgentCollaborators", 

                "bedrock:ListAgentActionGroups", 

                "bedrock:GetInferenceProfile", 

                "bedrock:GetFoundationModel", 

                "bedrock:GetAgent" 

            ], 

            "Resource": "*" 

        } 

    ] 

}

    Que faire ensuite

    Configure an IAM policy for Execution monitoring.