The Bedrock Agents service fetches the guardrail config via GetGuardrail before applying it. The role only had ApplyGuardrail, so every agent invocation logged an AccessDenied and tripped the CIS 4.1 UnauthorizedAPICalls alarm. Scoped to the same guardrail ARNs already granted for ApplyGuardrail. Cross-reviewed (IAM change): APPROVE, no findings. |
||
|---|---|---|
| .. | ||
| bedrock-agent.ts | ||
| conversation-log.ts | ||
| knowledge-base.ts | ||
| notion-sync.ts | ||
| po-sync.ts | ||
| slack-handler.ts | ||
| socket-mode.ts | ||
| workorder-sync.ts | ||