AWS Bedrock Agents Setup - Elementum Documentation

Overview

This guide walks you through the complete process of integrating AWS Bedrock Agents into your Elementum Apps. By connecting Bedrock Agents, you enable AI-powered automation that leverages Amazon’s foundation models, knowledge bases, and action groups while integrating seamlessly with your AWS infrastructure. Bedrock Agents are configured at the App level through the Intelligence settings, allowing each App to connect to external agents available through its Bedrock AI Provider. What You’ll Accomplish:

Configure an AWS Bedrock AI Provider in Elementum
Create and configure a Bedrock Agent in AWS
Connect external Bedrock Agents to your Elementum App
Integrate external agents into App automations
Understand the technical architecture and APIs

Time Required: 20-30 minutes, depending on your existing AWS configuration

Prerequisites

Before beginning this setup, ensure you have the following in place:

Elementum Requirements

App Access

Access to the App where you want to integrate Bedrock Agents

Admin Permissions

Permission to configure AI Providers in Organization Settings

AWS Requirements

Your AWS environment must have:

AWS Account: Active AWS account with Bedrock access
Region: Bedrock available in your target region (e.g., us-east-1, us-east-2, us-west-2)
Bedrock Access: Amazon Bedrock service enabled for your account
Foundation Model Access: Access granted to at least one foundation model (Claude, Titan, etc.)
IAM Permissions: Ability to create IAM users and policies

Model Access Required: Before creating Bedrock Agents, you must request and receive access to foundation models in the Amazon Bedrock console. This may take a few minutes to process.

IAM Credentials

You’ll need AWS credentials that can invoke Bedrock Agents:

Access Key ID: AWS access key for programmatic access
Secret Access Key: Corresponding secret key
IAM Policy: Permission to invoke Bedrock agents (bedrock:InvokeAgent)

Step 1: Configure AWS Bedrock Agent

Before connecting to Elementum, you need a Bedrock Agent configured in AWS.

Create a Bedrock Agent in AWS

Access Amazon Bedrock

Sign in to the AWS Management Console
Navigate to Amazon Bedrock service
Select Agents from the left navigation

Create New Agent

Click Create agent and configure:

Agent name: Provide a descriptive name (e.g., “Customer Support Agent”)
Description: Describe the agent’s purpose
Agent resource role: Create a new role or select an existing one with Bedrock permissions

Configure Agent Instructions

Provide clear instructions that define the agent’s behavior:

You are a helpful customer support assistant. You help users with 
their questions about orders, returns, and product information.
Always be polite and professional.

Clear, specific instructions lead to better agent performance. Include examples of expected behavior and any constraints.

Select Foundation Model

Choose the foundation model to power your agent

Model availability depends on your region and account access. Request model access in the Bedrock console if needed.

Configure Optional Features

Optionally enhance your agent with:Knowledge Bases:

Connect to S3 buckets containing documents
Agent can retrieve and reference this information

Action Groups:

Define custom actions via Lambda functions
Enable the agent to perform specific tasks

Guardrails:

Implement content filtering
Define topic restrictions

Save and Prepare

Click Create to save the agent configuration.The agent will be created in Draft status.

Create an Agent Alias

Required Step: Elementum requires an Agent Alias ARN to invoke your agent. You cannot use the base agent ARN.

Open Agent Configuration

In the Bedrock console, open your newly created agent

Navigate to Aliases

Select the Aliases tab in the agent configuration

Create Alias

Click Create alias and configure:

Alias name: Provide a name (e.g., “production”, “v1”)
Description: Describe this version
Select Create a new version and associate it to this alias

Copy the Agent Alias ARN

After creation, copy the Agent Alias ARN. It will look like:

arn:aws:bedrock:us-east-2:123456789012:agent-alias/ABCD1234EF/GHIJ5678KL

The Agent Alias ARN format is: arn:aws:bedrock:{region}:{account-id}:agent-alias/{agent-id}/{alias-id}

Test Agent in AWS Console

Before connecting to Elementum, verify your agent works correctly:

In the Bedrock console, open your agent
Use the Test panel on the right side
Send test messages to verify behavior
Confirm responses match your expectations

Step 2: Create IAM Credentials

Create IAM credentials that Elementum will use to invoke your Bedrock Agent.

Create IAM User

Navigate to IAM

In the AWS Console, go to IAM → Users → Create user

Configure User

User name: Choose a descriptive name (e.g., “elementum-bedrock-invoker”)
Do not enable console access (programmatic access only)

Attach Permissions

Create and attach a policy with minimal required permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "bedrock:InvokeAgent",
      "Resource": "*"
    }
  ]
}

Least Privilege: For production, restrict the Resource to specific agent ARNs:

"Resource": "arn:aws:bedrock:us-east-2:123456789012:agent-alias/*"

Create Access Keys

After creating the user:

Open the user details
Go to Security credentials tab
Click Create access key
Select Third-party service as the use case
Copy and securely store the Access Key ID and Secret Access Key

Store Credentials Securely: The secret access key is only shown once. Store it in a secure password manager until you configure it in Elementum.

Required IAM Permissions Summary

Permission	Description
`bedrock:InvokeAgent`	Required to invoke the agent and receive responses

If your agent uses knowledge bases or action groups, the agent’s own IAM role (not the invoker role) needs additional permissions for those resources.

Step 3: Create Bedrock AI Provider in Elementum

Now configure Elementum to connect to AWS Bedrock.

Add AI Provider

Navigate to AI Providers

Go to Organization Settings → Integrations → AI Providers

Add New Provider

Click ”+ Add Provider” and select Amazon Bedrock

Configure Provider

Enter the following details:Provider Name: A descriptive name (e.g., “AWS Bedrock - Production”)Region: The AWS region where your agent is deployed (e.g., us-east-2)Access Key ID: The access key from Step 2Secret Access Key: The secret key from Step 2

Test Connection

Click Test Connection to verify credentials work correctlyIf successful, you’ll see a confirmation message

Save Provider

Click Save to create the providerThe provider will now be available for use in App Intelligence

Provider Configuration Tips

Region Matching

Ensure the provider region matches where your Bedrock Agent is deployed

Multiple Providers

Create separate providers for different regions or AWS accounts

Step 4: Connect Agent in App Intelligence

With the provider configured, connect your Bedrock Agent to an App.

Access Intelligence Settings

Navigate to Your App

Go to the App where you want to integrate Bedrock Agents

Open App Admin

Click on App Admin in the navigation

Select Intelligence

Click on Intelligence in the App Admin menu

Add External Agent

Add Agent

Click the ”+ Connect” button at the top of the Intelligence page

Select Bedrock

In the agent source selection, choose Bedrock

Select Provider

Choose your configured Bedrock AI Provider from the dropdownOnly providers with valid credentials will appear

Enter Agent Alias ARN

Paste the Agent Alias ARN from Step 1Example format:

arn:aws:bedrock:us-east-2:123456789012:agent-alias/ABCD1234EF/GHIJ5678KL

Use Alias ARN: You must use the Agent Alias ARN, not the base Agent ARN. The alias ARN includes both the agent ID and alias ID.

Configure Agent Settings

Agent Name: Optionally customize the display name in ElementumDescription: Add notes about how this agent will be used in your App

Save Configuration

Click Save to connect the external agentThe agent will now appear in your App’s Intelligence configuration

Step 5: Test the Integration

Verify the agent connection works correctly.

Test in Elementum

Open Agent

In App Intelligence, click on the connected Bedrock agent

Start Chat

Click Chat to open the interactive testing panel

Send Test Messages

Send messages to confirm:

The agent responds successfully
Responses are appropriate and match expectations
Latency is acceptable for your use case

Verify Behavior

Test various scenarios relevant to your use case:

Standard queries
Edge cases
Knowledge base retrieval (if configured)
Action group execution (if configured)

Expected Behavior

Test	Expected Result
Simple greeting	Agent responds appropriately
Domain-specific question	Agent uses knowledge base (if configured)
Action request	Agent executes action group (if configured)
Out-of-scope question	Agent handles gracefully per instructions

Step 6: Integrate with Automations

Use your Bedrock Agent in App automations for production workflows.

Using Agents in Automation Actions

Navigate to Automation

In your App, go to the automation where you want to use the agent

Add Agent Action

Add a new automation action or edit existingSelect Agent Action as the action type

Select Bedrock Agent

In the agent configuration:Agent: Choose the external Bedrock Agent you configuredThe agent will be labeled as “External” or “Managed”

Configure Parameters

Input Mapping: Map automation data to agent input

Use field values from the current record
Reference previous automation action outputs
Include static values or formulas

Output Handling: Configure how to handle responses

Map agent outputs to record fields
Store results for later actions
Set error handling behavior

Set Execution Options

Timeout: Set maximum execution time (default: 60 seconds)Retry Policy: Configure retry behavior for transient failuresError Handling: Define failure behavior

Continue with default values
Halt automation and alert
Escalate to human review

Example Automation

Workflow: Customer Inquiry Processing
Trigger: New inquiry record created
Automations:
  1. Gather Context:
     - Collect customer information
     - Retrieve previous interactions
  
  2. External Agent - Analysis:
     Type: External Agent (Bedrock)
     Agent: Customer Support Agent
     Inputs:
       - customer_inquiry: {record.description}
       - customer_history: {customer.interaction_history}
     Outputs:
       - response: record.suggested_response
       - category: record.inquiry_category
       - sentiment: record.customer_sentiment
  
  3. Route Based on Category:
     - High priority → Immediate escalation
     - Standard → Queue for review
     - FAQ → Auto-respond with suggestion

Understanding the Architecture

How Bedrock Agent Invocation Works

When Elementum invokes a Bedrock Agent:

AWS Bedrock APIs Used

Elementum leverages the Amazon Bedrock Runtime API: InvokeAgent API Used to send messages to your agent and receive responses. Key Parameters:

agentAliasId: The alias ID of the agent
agentId: The unique identifier of the agent
sessionId: Session identifier for conversation continuity
inputText: The message to send to the agent

Documentation: Amazon Bedrock InvokeAgent API

Security Model

Aspect	Implementation
Authentication	IAM Access Key/Secret Key via Bedrock AI Provider
Authorization	IAM policies control which agents can be invoked
Data in Transit	TLS encryption for all API calls
Audit	AWS CloudTrail logs all Bedrock API calls
Isolation	App-level configuration with provider-based access

Monitoring and Maintenance

Monitoring Agent Performance

Elementum Logs

View agent execution in automation historyMonitor:

Invocation frequency
Response times
Success/failure rates
Error messages

AWS CloudWatch

Monitor Bedrock metrics in AWSTrack:

API call volumes
Latency percentiles
Error rates
Token usage

Maintenance Tasks

Regular Maintenance
Updating Agents
Scaling

Weekly:

Review automation logs for agent errors
Monitor response times and latency
Check for timeout patterns

Monthly:

Review agent usage and costs
Audit IAM permissions
Test agent behavior after any updates

Quarterly:

Rotate IAM access keys
Review and optimize agent instructions
Evaluate new foundation models

Troubleshooting

Common Issues

Access Denied Errors

Error: “Access Denied” or “Not authorized to perform bedrock:InvokeAgent”Possible Causes:

IAM user missing bedrock:InvokeAgent permission
Policy not attached to user
Resource restrictions in policy don’t match agent ARN

Solutions:

Verify IAM policy includes bedrock:InvokeAgent action
Check policy is attached to the correct IAM user
Ensure resource ARN in policy matches or uses wildcard
Verify access keys belong to the correct user

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "bedrock:InvokeAgent",
      "Resource": "*"
    }
  ]
}

ARN Format Errors

Error: “Invalid ARN format” or “Resource not found”Possible Causes:

Using agent ARN instead of agent alias ARN
Typo in the ARN
Wrong region in ARN

Solutions:

Ensure you’re using the Agent Alias ARN, not the base Agent ARN
Verify the format: arn:aws:bedrock:{region}:{account}:agent-alias/{agent-id}/{alias-id}
Copy the ARN directly from the AWS console
Check region matches your provider configuration

Correct Format:

arn:aws:bedrock:us-east-2:123456789012:agent-alias/ABCD1234EF/GHIJ5678KL

Incorrect (base agent ARN):

arn:aws:bedrock:us-east-2:123456789012:agent/ABCD1234EF

Region Mismatch

Error: “Could not connect to endpoint” or timeout errorsPossible Causes:

Provider configured for different region than agent
Agent not available in specified region

Solutions:

Verify the region in your Bedrock AI Provider matches where the agent is deployed
Check the region in the Agent Alias ARN
Confirm Bedrock is available in your target region
Update provider configuration if needed

Timeout Errors

Error: “Agent execution timed out”Possible Causes:

Timeout set too low for agent complexity
Agent accessing slow knowledge bases
Large response generation
Network latency

Solutions:

Increase timeout in automation configuration
Optimize agent instructions for faster responses
Review knowledge base configuration for performance
Consider breaking complex tasks into multiple calls

Alias Not Associated with Version

Error: “Alias has no associated version” or unexpected behaviorPossible Causes:

Alias created without linking to a version
Agent in draft state without prepared version

Solutions:

In Bedrock console, verify the alias has an associated version
Create a new alias and select “Create a new version and associate it”
Ensure the agent is not in draft state

Debugging Tips

Test in AWS First: Always verify agent works in the Bedrock console before troubleshooting Elementum integration
Check CloudTrail: Review AWS CloudTrail logs for detailed API call information
Verify Credentials: Test IAM credentials independently using AWS CLI
Review Provider Status: Check the Bedrock AI Provider status in Elementum

Best Practices

Security

IAM Best Practices

Use least privilege permissions
Restrict resource ARNs when possible
Rotate access keys regularly (every 90 days)
Use separate credentials per environment

Agent Security

Enable Bedrock Guardrails for content filtering
Define clear scope in agent instructions
Monitor for unexpected behavior patterns
Regular security reviews

Performance

Optimize Instructions: Clear, concise agent instructions lead to faster responses
Right-size Models: Use appropriate models for your use case (Haiku for speed, Opus for complexity)
Monitor Latency: Track response times and set appropriate timeouts
Cache When Possible: Cache repeated queries at the automation level

Cost Management

Monitor token usage in AWS Cost Explorer
Use smaller models for simpler tasks
Implement rate limiting for high-volume automations
Review and optimize knowledge base sizes

Example Use Cases

Use Case 1: IT Helpdesk Automation

Scenario: Automatically triage and respond to IT support tickets Implementation:

Create Bedrock Agent with IT knowledge base (documentation, FAQs)
Configure action groups for ticket operations
Connect agent in IT Support App Intelligence
Set up automation: New ticket → Agent analysis → Auto-categorize and suggest resolution

Benefits:

Faster first response times
Consistent ticket categorization
Reduced L1 support workload

Use Case 2: Customer Communication

Scenario: Generate personalized customer communications Implementation:

Create Bedrock Agent with communication templates and brand guidelines
Configure guardrails for appropriate content
Connect agent in CRM App
Automation: Communication request → Agent drafts message → Human review → Send

Benefits:

Consistent brand voice
Personalized content at scale
Faster communication turnaround

Next Steps

Agent Orchestration Center

View and manage all agents across your organization

Agent Architecture

Understand the technical architecture of Native and Managed agents

Automation System

Learn how to build sophisticated automations with agents

AWS Bedrock Docs

Reference AWS’s official Bedrock Agents documentation

By integrating AWS Bedrock Agents through your App’s Intelligence configuration, you extend your automation capabilities with powerful AI while leveraging your existing AWS infrastructure and security model. This integration enables sophisticated conversational AI, knowledge retrieval, and custom actions within your Elementum workflows.

Workflow & Automation

Agents

Connecting to Elementum

Working with Snowflake

Working with AWS

Integration & Configuration

Data Management

Platform Administration

​Overview

​Prerequisites

​Elementum Requirements

App Access

Admin Permissions

​AWS Requirements

​IAM Credentials

​Step 1: Configure AWS Bedrock Agent

​Create a Bedrock Agent in AWS

​Create an Agent Alias

​Test Agent in AWS Console

​Step 2: Create IAM Credentials

​Create IAM User

​Required IAM Permissions Summary

​Step 3: Create Bedrock AI Provider in Elementum

​Add AI Provider

​Provider Configuration Tips

Region Matching

Multiple Providers

​Step 4: Connect Agent in App Intelligence

​Access Intelligence Settings

​Add External Agent

​Step 5: Test the Integration

​Test in Elementum

​Expected Behavior

​Step 6: Integrate with Automations

​Using Agents in Automation Actions

​Example Automation

​Understanding the Architecture

​How Bedrock Agent Invocation Works

​AWS Bedrock APIs Used

​Security Model

​Monitoring and Maintenance

​Monitoring Agent Performance

Elementum Logs

AWS CloudWatch

​Maintenance Tasks

​Troubleshooting

​Common Issues

​Debugging Tips

​Best Practices

​Security

IAM Best Practices

Agent Security

​Performance

​Cost Management

​Example Use Cases

​Use Case 1: IT Helpdesk Automation

​Use Case 2: Customer Communication

​Next Steps

Agent Orchestration Center

Agent Architecture

Automation System

AWS Bedrock Docs

Overview

Prerequisites

Elementum Requirements

AWS Requirements

IAM Credentials

Step 1: Configure AWS Bedrock Agent

Create a Bedrock Agent in AWS

Create an Agent Alias

Test Agent in AWS Console

Step 2: Create IAM Credentials

Create IAM User

Required IAM Permissions Summary

Step 3: Create Bedrock AI Provider in Elementum

Add AI Provider

Provider Configuration Tips

Step 4: Connect Agent in App Intelligence

Access Intelligence Settings

Add External Agent

Step 5: Test the Integration

Test in Elementum

Expected Behavior

Step 6: Integrate with Automations

Using Agents in Automation Actions

Example Automation

Understanding the Architecture

How Bedrock Agent Invocation Works

AWS Bedrock APIs Used

Security Model

Monitoring and Maintenance

Monitoring Agent Performance

Maintenance Tasks

Troubleshooting

Common Issues

Debugging Tips

Best Practices

Security

Performance

Cost Management

Example Use Cases

Use Case 1: IT Helpdesk Automation

Use Case 2: Customer Communication

Next Steps