A financial services company is developing an AI-powered search assistant application to help investment advisors quickly retrieve investment data…

The scenario presents two distinct permission errors that must be resolved.
1. The 400 Bad Authorization error from the BedrockAgentRuntime API indicates that the caller, the AWS Lambda function, does not have the required permissions to invoke the Bedrock agent. Granting the bedrock:InvokeAgent permission to the Lambda function's execution role directly resolves this issue.
2. The 403 Forbidden error when accessing Amazon OpenSearch Serverless signifies that the entity attempting access (the Bedrock Knowledge Base service role) is not authorized. In OpenSearch Serverless, access to data is controlled by data access policies. Creating a data access policy that grants the Bedrock service role permissions to the relevant collections and indexes is the correct solution. Using pattern-based rules within this policy also satisfies the requirement to manage access at scale.

C. This option addresses network configuration (VPC endpoints), which is irrelevant to the 400 and 403 IAM permission errors described in the scenario.
D. Amazon OpenSearch Serverless uses IAM roles and policies for authentication and authorization, not username/password credentials that would be stored in AWS Secrets Manager.
E. This option is incorrect because it uses the es: IAM prefix, which applies to Amazon OpenSearch Service (provisioned clusters), not the aoss: prefix required for Amazon OpenSearch Serverless.

1. AWS Documentation: Identity and access management for Amazon Bedrock. Under "Actions defined by Amazon Bedrock," the InvokeAgent action is listed. The description confirms this permission is required to "send a prompt for the agent to process and respond to," which is what the Lambda function is attempting. This supports option A. (Source: AWS Bedrock User Guide, "Actions, resources, and condition keys for Amazon Bedrock").

2. AWS Documentation: Data access control for Amazon OpenSearch Serverless. This document states, "To provide access to collections and indexes, you configure data access policies... A policy can apply to multiple collections and indexes by using wildcards ()." This directly supports creating a pattern-based data access policy to resolve the 403 Forbidden error, as described in option B. (Source: Amazon OpenSearch Serverless Developer Guide, "Security", "Data access control").

3. AWS Documentation: Create a service role for Knowledge bases for Amazon Bedrock. This guide clarifies the permissions needed. It shows that the Bedrock service role requires aoss permissions in its IAM policy, and crucially states: "In addition to this IAM policy, you must configure a data access policy for your Amazon OpenSearch Serverless collection to grant the service role permissions to access the collection." This confirms that the data access policy (Option B) is the mechanism to resolve the 403 error on the collection itself. (Source: AWS Bedrock User Guide, "Knowledge bases for Amazon Bedrock").