Preface
Introduction to Create Amazon Bedrock Knowledge Base and Data Source using Guide recipe
- Prerequisites
Create Amazon Bedrock Knowledge Base and Data Source using Guide recipe contents
- Create Amazon Bedrock Knowledge Base and Data Source using Guide recipe assets
Using the Create Amazon Bedrock Knowledge Base and Data Source using Guide recipe

Create Amazon Bedrock Knowledge Base and Data Source using Guide

Back Next

Configure Role and Policy

Configure role and policy in AWS Identity and Access Management (IAM).

Go to

Amazon Identity and Access Management (IAM)

Policies

Create policy

and create a new policy as shown in the following image:

Specify the secret ARN, policy name, and model ID. The recipe is preconfigure to use amazon.titan-embed-text-v1. For the list of available models, see https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html.

The following image shows the secret ARN, policy name, and model ID in the Specify permissions
page:

The image shows the secret ARN, policy name, and model ID in the Policy
editor on the Specify permissions page.

Here is the sample of the secret ARN, policy name, and model ID to enter in the Policy editor :

{
  "Version": "2012-10-17",
  "Statement": [
     {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": "s3:ListBucket",
        "Resource": "arn:aws:s3:::*"
     },
     {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::*/*"
     },
     {
        "Sid": "BedrockInvokeModelStatement",
        "Effect": "Allow",
        "Action": [
               "bedrock:InvokeModel"
         ],
         "Resource": [
                      "arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v1"
         ]
      },
      {
         "Sid": "SecretsManagerGetStatement",
         "Effect": "Allow",
         "Action": [
                   "secretsmanager:GetSecretValue"
          ],
          "Resource": [
                       "{Secret ARN}"
          ]
       }
   ]
}

Go to

Amazon Identity and Access Management (IAM)

Roles

Create role

and create a new role as shown in the following image:

In the Select trusted entity
page, select Custom trust policy
in the Trusted entity type
section, and configure the policy as shown in th efollowing example:

The image shows the trusted entity type and snippet to configure the
custom trust policy on the Select trusted entity page.

Here is the sample to configure trust policy:

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Sid": "AmazonBedrockKnowledgeBaseTrustPolicy",

            "Effect": "Allow",

            "Principal": {

                "Service": "bedrock.amazonaws.com"

            },

            "Action": "sts:AssumeRole"

        }

    ]

}

In the Add permissions
page, add the created policy and set the role name, and then click Next
as shown in the following image: