AWS Bedrock Agent Permissions: What You Need to Lock Down Before Go-Live

This Sonrai blog recommends locking down AWS Bedrock agent IAM roles before production by scoping permissions to specific ARNs (model, knowledge base, Lambda functions, S3 schemas, guardrails, KMS), replacing broad managed policies, auditing related service roles, and applying organizational controls (SCPs, just-in-time elevation) to prevent role drift and prompt-driven privilege escalation.