{"record":{"id":"63ad0f080bed4daf","repo":"microsoft/semantic-kernel","slug":"failed-to-create-the-amazon-bedrock-agent-e","errorCode":null,"errorMessage":"Failed to create the Amazon Bedrock Agent: {e}","messagePattern":"Failed to create the Amazon Bedrock Agent: (.+?)","errorType":"exception","errorClass":"AgentInitializationException","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/agents/bedrock/bedrock_agent.py","lineNumber":240,"sourceCode":"        from botocore.exceptions import ClientError\n\n        bedrock_runtime_client = bedrock_runtime_client or boto3.client(\"bedrock-agent-runtime\")\n        bedrock_client = bedrock_client or boto3.client(\"bedrock-agent\")\n\n        try:\n            response = await run_in_executor(\n                None,\n                partial(\n                    bedrock_client.create_agent,\n                    agentName=name,\n                    foundationModel=bedrock_agent_settings.foundation_model,\n                    agentResourceRoleArn=bedrock_agent_settings.agent_resource_role_arn,\n                    instruction=instructions,\n                ),\n            )\n        except ClientError as e:\n            logger.error(f\"Failed to create agent {name}.\")\n            raise AgentInitializationException(f\"Failed to create the Amazon Bedrock Agent: {e}\") from e\n\n        bedrock_agent = cls(\n            response[\"agent\"],\n            function_choice_behavior=function_choice_behavior,\n            kernel=kernel,\n            plugins=plugins,\n            arguments=arguments,\n            bedrock_runtime_client=bedrock_runtime_client,\n            bedrock_client=bedrock_client,\n        )\n\n        # The agent will first enter the CREATING status.\n        # When the operation finishes, it will enter the NOT_PREPARED status.\n        # We need to wait for the agent to reach the NOT_PREPARED status before we can prepare it.\n        await bedrock_agent._wait_for_agent_status(BedrockAgentStatus.NOT_PREPARED)\n        await bedrock_agent.prepare_agent_and_wait_until_prepared()\n\n        return bedrock_agent","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/agents/bedrock/bedrock_agent.py#L222-L258","documentation":"Raised by create_and_prepare_agent when the boto3 bedrock-agent client's create_agent call raises a ClientError. The underlying AWS error is included in the message. Common AWS causes: insufficient IAM permissions, invalid foundation model ID, invalid role ARN, duplicate agent name, service quotas, or throttling.","triggerScenarios":"Triggered when run_in_executor(bedrock_client.create_agent, ...) throws botocore.exceptions.ClientError during agent provisioning in create_and_prepare_agent.","commonSituations":"The IAM principal lacks bedrock:CreateAgent permission; the agentResourceRoleArn does not exist or lacks the bedrock-assume-role trust policy; the foundationModel is not enabled in the AWS region; duplicate agentName already exists; AWS service quota exceeded; region does not support the requested model.","solutions":["Read the embedded AWS error code/message (e.g. AccessDeniedException, ValidationException) in the exception string to identify the root cause.","Ensure the calling principal has an IAM policy granting bedrock:CreateAgent and iam:PassRole for the agent resource role.","Verify the foundation model ID is valid and enabled in the target region (check Amazon Bedrock model access page).","Confirm the agentResourceRoleArn exists and has the correct trust relationship with the Bedrock service principal."],"exampleFix":"// before\n# IAM principal only has bedrock:InvokeAgent -> AccessDeniedException\n\n// after\n# Add to the IAM policy:\n# {\"Effect\": \"Allow\", \"Action\": [\"bedrock:CreateAgent\"], \"Resource\": \"*\"}\n# {\"Effect\": \"Allow\", \"Action\": \"iam:PassRole\", \"Resource\": \"arn:aws:iam::...:role/BedrockAgentRole\"}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"from semantic_kernel.exceptions.agent_exceptions import AgentInitializationException\nfrom botocore.exceptions import ClientError\n\ntry:\n    agent = await BedrockAgent.create_and_prepare_agent(\n        name=\"x\", instructions=\"...\",\n        agent_resource_role_arn=role_arn, foundation_model=model_id,\n    )\nexcept AgentInitializationException as e:\n    cause = e.__cause__\n    if isinstance(cause, ClientError):\n        code = cause.response[\"Error\"][\"Code\"]\n        if code == \"AccessDeniedException\":\n            # fix IAM permissions for bedrock:CreateAgent / iam:PassRole\n            ...\n        elif code == \"ValidationException\":\n            # check foundation_model ID and role ARN format\n            ...\n    raise","preventionTips":["Grant bedrock:CreateAgent and iam:PassRole in the calling principal's IAM policy.","Enable model access for the foundation_model in the target AWS region before creation.","Use a unique agentName per create call to avoid name collisions.","Inspect the embedded ClientError code to drive remediation."],"tags":["bedrock","aws","iam","boto3","client-error","agent-creation"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}