fix: Add missing IAM permission for AgentCore service-linked role creation

[icoxfog417]

Problem

GenU deployment fails when creating AgentCore Runtime with error:
Failed creating service linked role. Please verify that the calling role has sufficient permissions to create a service linked role.

Root Cause

Starting October 13, 2025, AgentCore Runtime creation requires the AWSServiceRoleForBedrockAgentCoreRuntimeIdentity service-linked role. The Custom Resource Lambda lacks iam:CreateServiceLinkedRole permission.

Solution

Added missing IAM permission to Custom Resource role for Runtime Identity service-linked role creation.

Reference

https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/service-linked-roles.html

Testing

• Verified permission matches AWS managed policy BedrockAgentCoreFullAccess
• Confirmed only Runtime Identity role needed (PUBLIC network mode)
• Added proper IAM conditions for security

[icoxfog417]

After the deployment experiment 1) AgentCore deployment is succeeded without policy for service-linked role creation. 2) Both GenU and one click deployment are successful without this permission.

We have observed some customers faced this service linked role related issues. Therefore we close this pull request but will apply this if we could find out the conditions for this issue.

[kazuhitogo]

【memo】再現しなかったので、一旦クローズ
エラーが発生した場合は以下が出る

creating service linked role. 
Please verify that the calling role has sufficient permissions to create a service linked role. 
Logs: /aws/lambda/AgentCoreRuntime-AgentCoreStackdev-B8F5E892 
 at de_AccessDeniedExceptionRes (/var/task/node_modules/@aws-sdk/client-bedrock-agentcore-control/dist-cjs/protocols/Aws_restJson1.js:1793:23) 
 at de_CommandError (/var/task/node_modules/@aws-sdk/client-bedrock-agentcore-control/dist-cjs/protocols/Aws_restJson1.js:1736:25) 
 at process.processTicksAndRejections (node:internal/process/task_queues:105:5) 
 at async /var/task/node_modules/@smithy/middleware-serde/dist-cjs/index.js:36:20 
 at async /var/task/node_modules/@smithy/core/dist-cjs/index.js:193:18 
 at async /var/task/node_modules/@smithy/middleware-retry/dist-cjs/index.js:320:38 
 at async /var/task/node_modules/@aws-sdk/middleware-logger/dist-cjs/index.js:33:22 
 at async createAgentRuntime (/var/task/index.js:55:20) at async Runtime.handler (/var/task/index.js:148:53) 
(RequestId: 70f9412d-3908-45f9-93ef-e6e5120b4f8a)

[icoxfog417]

Reopen the PR because we have observed multiple issues.

[kazuhitogo]

LGTM