To extract metadata and to configure other capabilities that a catalog source might include, you need account access and permissions on the source system. The permissions required might vary depending on the capability.
Permissions for metadata extraction
Ensure that you have the required permissions to perform metadata extraction.
To extract Amazon Bedrock metadata, grant the following permissions:
•kms:Decrypt
Note:
Required only if agents or flows use customer-managed AWS Key Management Service keys. Not required for knowledge bases.
•account:GetAccountInformation
•iam:ListAccountAliases
Note:
Required only if account:GetAccountInformation is missing.
•bedrock:ListKnowledgeBases
•bedrock:GetKnowledgeBase
•bedrock:ListDataSources
•bedrock:GetDataSource
•bedrock:ListAgents
•bedrock:GetAgent
•bedrock:ListAgentVersions
•bedrock:GetAgentVersion
•bedrock:ListAgentActionGroups
•bedrock:GetAgentActionGroup
•bedrock:ListAgentAliases
•bedrock:GetAgentAlias
•bedrock:ListAgentKnowledgeBases
•bedrock:ListFlows
•bedrock:GetFlow
•bedrock:ListFlowVersions
•bedrock:GetFlowVersion
•bedrock:ListFlowAliases
•bedrock:ListTagsForResource
Note:
Alternatively, if you don't want to specify individual permissions, you can grant the AmazonBedrockFullAccess AWS-managed policy to replace the individual bedrock:* permissions.