View a markdown version of this page

Prerequisites - Amazon Bedrock AgentCore
RequirementsIAM permissionsExecution role
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Prerequisites

Before you begin using AgentCore insights, ensure you have the following:

Requirements

  • Amazon Account with appropriate IAM permissions

  • Amazon CloudWatch access for reading agent session traces and viewing insight results

  • Transaction Search enabled in CloudWatch — see AgentCore Observability for setup instructions

  • Amazon Distro for OpenTelemetry (ADOT) SDK instrumenting your agent — your agent must emit traces to CloudWatch Logs

  • An active agent with at least one completed session producing traces in CloudWatch Logs

IAM permissions

Your IAM user or role needs the following permissions to configure and run insights:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:CreateOnlineEvaluationConfig",
                "bedrock-agentcore:GetOnlineEvaluationConfig",
                "bedrock-agentcore:ListOnlineEvaluationConfigs",
                "bedrock-agentcore:UpdateOnlineEvaluationConfig",
                "bedrock-agentcore:DeleteOnlineEvaluationConfig",
                "bedrock-agentcore:StartBatchEvaluation",
                "bedrock-agentcore:GetBatchEvaluation",
                "bedrock-agentcore:ListBatchEvaluations"
            ],
            "Resource": "*"
        }
    ]
}

Execution role

The online evaluation configuration requires an execution role (evaluationExecutionRoleArn) that allows the service to:

  • Read traces from CloudWatch Logs

  • Invoke Amazon Bedrock models for insight analysis

  • Store and retrieve insight results

If you have already configured an execution role for AgentCore Evaluations, the same role works for insights. See Evaluations Prerequisites for details on creating this role.

Note

If you plan to use insights findings to generate optimized configurations through AgentCore optimization recommendations, you also need bedrock-agentcore:StartRecommendation, bedrock-agentcore:GetRecommendation, bedrock-agentcore:ListRecommendations, and bedrock-agentcore:DeleteRecommendation permissions. See Optimization Prerequisites for details.