adam/seahaven-slack-bot
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: grant bedrock:GetGuardrail to agent execution role #39

Merged
amoussa1229 merged 1 commit from fix/guardrail-get-permission into main 2026-06-04 20:50:20 +00:00
Conversation 0 Commits 1 Files changed 1 +3 -1
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/constructs/bedrock-agent.ts
View file

@ -249,7 +249,9 @@ Keep responses concise, professional, and actionable.`;
guardrailVersion.addDependency(guardrail); guardrailVersion.addDependency(guardrail);
agentRole.addToPolicy(new iam.PolicyStatement({ agentRole.addToPolicy(new iam.PolicyStatement({
actions: ['bedrock:ApplyGuardrail'], // GetGuardrail: the Agents service fetches the guardrail config before applying it —
// without it every InvokeAgent logs an AccessDenied (trips CIS 4.1 alarm)
actions: ['bedrock:ApplyGuardrail', 'bedrock:GetGuardrail'],
// Base ARN plus version-suffixed children — runtime applies the versioned guardrail // Base ARN plus version-suffixed children — runtime applies the versioned guardrail
resources: [guardrail.attrGuardrailArn, `${guardrail.attrGuardrailArn}/*`], resources: [guardrail.attrGuardrailArn, `${guardrail.attrGuardrailArn}/*`],
})); }));