Error: creating Bedrock Agent Knowledge Base

[athewsey]

Oops, looks like merging #16 has caused an issue with Bedrock KB permissions that I didn't spot during the review. Trying to deploy from scratch now raises:

│ Error: creating Bedrock Agent Knowledge Base
│ 
│   with module.kb_stack.module.knowledge_base.aws_bedrockagent_knowledge_base.sample_kb,
│   on modules/knowledge-base/main.tf line 45, in resource "aws_bedrockagent_knowledge_base" "sample_kb":
│   45: resource "aws_bedrockagent_knowledge_base" "sample_kb" {
│ 
│ operation error Bedrock Agent: CreateKnowledgeBase, https response error StatusCode: 400

From an initial check, restoring aoss:APIAccessAll permission on the bedrock_kb_sample_kb_model IAM role policy fixes the deployment. Just trying to figure out if there's something more granular that still works.

[athewsey]

Per the above-linked commit I've restored the old aoss:APIAccessAll permission for now because other combinations don't seem to be working and might end up broadening the permissions further anyway (since they lack the Resource constraint). @najmia I'll try to sync up with you on this when you have time!