fix(iam): grant bedrock-agentcore:GetMemory to app-api + runtime roles

CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project are documented in this file. Format follows
 
 For narrative release notes written for operators and product owners, see [RELEASE_NOTES.md](RELEASE_NOTES.md).
 
+## [1.0.4] - 2026-07-01
+
+IAM hotfix restoring AgentCore Memory. Both the App API task role and the AgentCore Runtime execution role were missing `bedrock-agentcore:GetMemory`, which `get_memory_strategies()` needs to resolve strategy IDs — breaking the memory dashboard (empty results) and long-term recall (retrieval silently disabled). Ships via the platform (CDK) pipeline; no migration.
+
+### 🐛 Fixed
+
+- Memory dashboard (`GET /memory`, `/memory/preferences`, `/memory/facts`) returned empty lists with a 200: `get_memory_strategies()` → `bedrock-agentcore:GetMemory` was denied on the App API task role, so strategy discovery yielded no namespaces and retrieval was skipped (`app-api-iam-grants.ts`)
+- Agent stopped recalling long-term memories: the runtime's `_discover_strategy_ids()` makes the same `GetMemory` call to build retrieval namespaces; the runtime execution role also lacked the action, disabling long-term retrieval while `CreateEvent` writes still succeeded (`inference-api-iam-roles.ts`)
+
+### 🏗️ Infrastructure
+
+- Added `bedrock-agentcore:GetMemory` to the `AgentCoreMemoryAccess` statement on both the App API Fargate task role (scoped to the memory ARN) and the AgentCore Runtime execution role (scoped to `memory/*`); no other actions changed. Validated against the AWS Service Authorization Reference (`GetMemory` = Read on the `memory` resource type)
+
 ## [1.0.3] - 2026-06-30
 
 Maintenance patch: CI/CD pipeline cleanup, re-enabled path-scoped auto-deploys, and a dependency/CodeQL sweep. No application code or user-facing behavior changes; upgrade in place.

README.md

@@ -8,7 +8,7 @@
 **An open-source, production-ready Generative AI platform for institutions**
 *Built by Boise State University, designed for everyone.*
 
-[![Release](https://img.shields.io/badge/Release-v1.0.3-6366f1?style=flat&logo=github&logoColor=white)](RELEASE_NOTES.md)
+[![Release](https://img.shields.io/badge/Release-v1.0.4-6366f1?style=flat&logo=github&logoColor=white)](RELEASE_NOTES.md)
 [![Nightly](https://github.com/Boise-State-Development/agentcore-public-stack/actions/workflows/nightly.yml/badge.svg)](https://github.com/Boise-State-Development/agentcore-public-stack/actions/workflows/nightly.yml)
 
 ![Python](https://img.shields.io/badge/Python-3.13+-3776AB?style=flat&logo=python&logoColor=white)
@@ -296,7 +296,7 @@ agentcore-public-stack/
 
 See [RELEASE_NOTES.md](RELEASE_NOTES.md) for the full changelog, including new features, bug fixes, platform upgrades, and deployment notes for each release.
 
-**Current release:** v1.0.3
+**Current release:** v1.0.4
 
 ---
 

RELEASE_NOTES.md

@@ -1,3 +1,33 @@
+# Release Notes — v1.0.4
+
+**Release Date:** July 1, 2026
+**Previous Release:** v1.0.3 (June 30, 2026)
+
+---
+
+> ⚠️ **Upgrading from a beta?** 1.0.4 is an in-place upgrade from any 1.0.x with no migration. Moving from a pre-1.0.0 beta is still the destructive backup → teardown → redeploy → restore migration described in the [1.0.0 notes](#upgrading-an-existing-deployment). Brand-new deployments need none of this.
+
+---
+
+## Highlights
+
+v1.0.4 is a one-line-per-role IAM hotfix that restores **AgentCore Memory** functionality. Both the App API task role and the AgentCore Runtime execution role granted every memory data-plane action *except* `bedrock-agentcore:GetMemory` — the action the SDK's `get_memory_strategies()` call requires to resolve a memory's strategy IDs. Without it, strategy discovery failed silently: the **Settings → memories/preferences page came back empty** (the App API returned empty lists with a 200), and the **agent stopped recalling long-term memories** (the runtime kept writing conversation events but ran with retrieval disabled). Granting `GetMemory` on both roles fixes both symptoms. This is an **infrastructure (IAM) change**, so it deploys via the platform (CDK) pipeline.
+
+## 🐛 Bug fixes
+
+- **Memory dashboard showed no memories/preferences.** `GET /memory` calls `get_memory_strategies()` → `bedrock-agentcore:GetMemory`, which the App API task role didn't allow. The call `AccessDenied`, strategy discovery returned no IDs, and the endpoint returned empty `facts`/`preferences` with a 200 — so the page rendered blank even though records existed. (`app-api-iam-grants.ts`)
+- **Agent didn't recall long-term memories.** At session creation the runtime's `_discover_strategy_ids()` makes the same `GetMemory` call to build its retrieval namespaces; the runtime execution role also lacked the action, so retrieval was silently disabled ("long-term memory retrieval disabled") while event writes (`CreateEvent`) continued to succeed. (`inference-api-iam-roles.ts`)
+
+## 🏗️ Infrastructure
+
+- Added `bedrock-agentcore:GetMemory` to the `AgentCoreMemoryAccess` policy statement on **both** roles — the App API Fargate task role (scoped to the memory ARN) and the AgentCore Runtime execution role (scoped to `memory/*`). No other action names changed. Verified against the AWS Service Authorization Reference (`GetMemory` is a Read action on the `memory` resource type).
+
+## 🚀 Deployment notes
+
+This is an IAM change on `PlatformStack`, so it ships through the **platform (CDK)** pipeline, not the API-only backend path. After deploy, no data migration is needed and existing memories become visible immediately. Note the App API caches strategy discovery per process (`functools.lru_cache`) — a normal deploy rolls the ECS tasks and AgentCore Runtime, so the cache starts fresh; no manual restart required.
+
+---
+
 # Release Notes — v1.0.3
 
 **Release Date:** June 30, 2026

VERSION

@@ -1 +1 @@
-1.0.3
+1.0.4

backend/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentcore-stack"
-version = "1.0.3"
+version = "1.0.4"
 requires-python = ">=3.10"
 description = "Multi-agent conversational AI system with AWS Bedrock AgentCore"
 readme = "README.md"

frontend/ai.client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai.client",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "scripts": {
     "ng": "ng",
     "start": "ng serve",

infrastructure/lib/constructs/app-api/app-api-iam-grants.ts

@@ -403,6 +403,14 @@ export function grantAppApiPermissions(props: AppApiIamGrantsProps): void {
       // do not exist as IAM actions, so the entire policy was a silent
       // no-op — the App API hit AccessDeniedException on ListEvents.
       actions: [
+        // GetMemory is required by the memory dashboard read path:
+        // memory_service._get_strategy_namespaces() calls
+        // MemoryClient.get_memory_strategies(), which invokes GetMemory to
+        // enumerate the memory's strategy IDs. Without it the call
+        // AccessDenies, strategy discovery returns (None, None, None), and
+        // GET /memory returns empty preferences/facts with a 200 — the
+        // memories/preferences page renders blank even though records exist.
+        'bedrock-agentcore:GetMemory',
         'bedrock-agentcore:CreateEvent',
         'bedrock-agentcore:GetEvent',
         'bedrock-agentcore:ListEvents',

infrastructure/lib/constructs/inference-api/inference-api-iam-roles.ts

@@ -301,6 +301,17 @@ export function createRuntimeExecutionRole(
     // speculative names (CreateMemoryEvent, ListMemoryEvents,
     // RetrieveMemory) that don't exist as IAM actions.
     actions: [
+      // GetMemory is required for long-term memory RETRIEVAL. At session
+      // creation the agent calls _discover_strategy_ids() ->
+      // MemoryClient.get_memory_strategies(), which invokes GetMemory to
+      // resolve the SEMANTIC / USER_PREFERENCE / SUMMARIZATION strategy IDs
+      // used to build the retrieval namespaces. Without it that call
+      // AccessDenies, the retrieval config is left empty, and the agent
+      // silently runs with "long-term memory retrieval disabled" — it keeps
+      // writing events (CreateEvent) but never recalls stored memories.
+      // Verified against the AWS Service Authorization Reference: GetMemory
+      // is a Read action on the `memory` resource type.
+      'bedrock-agentcore:GetMemory',
       'bedrock-agentcore:CreateEvent',
       'bedrock-agentcore:GetEvent',
       'bedrock-agentcore:ListEvents',

infrastructure/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrastructure",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "bin": {
     "infrastructure": "bin/infrastructure.js"
   },