bedrock-irsa.yaml

# Step 1: AgentgatewayBackend — omit policies.auth to use IRSA
apiVersion: agentgateway.dev/v1alpha1
kind: AgentgatewayBackend
metadata:
  name: bedrock
  namespace: enterprise-agentgateway
spec:
  ai:
    provider:
      bedrock:
        model: "amazon.nova-micro-v1:0"
        region: "us-east-1"
  # NOTE: No policies.auth section — this tells agentgateway to use IRSA/pod identity
---
# Step 2: EnterpriseAgentgatewayParameters — annotate the DATA PLANE service account with IRSA role
# Update your existing agentgateway-params
apiVersion: enterpriseagentgateway.solo.io/v1alpha1
kind: EnterpriseAgentgatewayParameters
metadata:
  name: agentgateway-params
  namespace: enterprise-agentgateway
spec:
  serviceAccount:
    metadata:
      annotations:
        eks.amazonaws.com/role-arn: "arn:aws:iam::<ACCOUNT_ID>:role/<BEDROCK_ROLE_NAME>"