Knowledge Article View - Now Support Portal

Configure an IAM for Agent discovery

Configuring IAM policy action permissions necessary for Agent discovery and integration user access on AWS to read bedrock agentic data.

Role required: Admin

AWS provides the minimum given policies by default:

AmazonBedrockReadOnly CloudWatchReadOnlyAccess

The minimum policy action permissions needed for the integration user on AWS to read bedrock agentic data:

ListAgents GetAgent ListAgentActionsGroups ListAgentVersions GetInferenceProfile GetFoundationModel ListAgentCollaborators GetAgentAlias

Note: To exclude specific resources from AI Control Tower , you can restrict them from the resources region. Select 'all' to include all AWS bedrock agentic resources data into AI Control Tower .

{

"Version": "2012-10-17",

"Statement": [

{

"Sid": "VisualEditor0",

"Effect": "Allow",

"Action": [

"bedrock:ListAgents",

"bedrock:ListAgentVersions",

"bedrock:ListAgentCollaborators",

"bedrock:ListAgentActionGroups",

"bedrock:GetInferenceProfile",

"bedrock:GetFoundationModel",

"bedrock:GetAgent"

],

"Resource": "*"

}

]

}

Configure an IAM policy for Execution monitoring.