The denial is the part that costs a working day. A caller holding InvokeAgentRuntime and nothing else reaches the runtime, signs cleanly, and is still refused on the card, and the dev.to write-up is explicit that the refusal surfaces nowhere near auth: at the client it reads as a transport or protocol fault [4][6]. Rewriting the resource block will not save you, because the missing piece is the action; once `bedrock-agentcore:GetAgentCard` is present, the runtime ARN plus its children is sufficient and no wildcard resource is needed [5]. One layer down in the signing sits the same species of trap. The runtime session header is required on the card fetch as well as on calls, at least 33 characters, and it has to fall inside the SigV4 signature, so it must be set before signing [11]. Both problems argue for the same shape: credentials and headers belong on the HTTP client, not on the single request you thought needed them [6].
Now the address. AgentCore has no per-agent hostname; the card hangs off the URL-escaped runtime ARN, under the same `/invocations/` path the calls use [8], while Cloud Run and Container Apps serve it from the well-known path on their own host [9]. Any tracer that identifies discovery by path prefix therefore files every AWS card fetch as an invocation. The author's own tracer did precisely that until the rule was changed to match on suffix [10]. Whatever you have keyed to that classification, spend attribution or per-call audit, inherits the mistake.
The byte counts are where the story stops being about IAM. The same logical agent published 528 bytes on Cloud Run, 1,924 on Container Apps and 2,109 on AgentCore [12], which the author calls four times the Cloud Run card and which works out to 3.99 times [15][2]. The skills entry accounts for most of the difference: the description is the agent's entire system prompt, 1,258 characters, and the tags name the model behind it as `us.amazon.nova-micro-v1:0` [17]. That is 59.6 per cent of the AWS card [1]. Strip the prompt out and the remaining 851 bytes are still 1.6 times the whole Cloud Run document [3], so this is not one bloated field on an otherwise identical card.
The author is careful about blame: the prompt-as-description behaviour is what the a2a-sdk card builder does with a Strands agent's system prompt, not something AgentCore invented [18]. The leak travels with the SDK, so it is portable to any host that builds cards the same way.
One caveat on the evidence. This is a single run of three agents on 2026-08-25, 3 of 3 cards in 17,660 milliseconds, an average of 5.9 seconds a fetch [3][12][4]. The tool logged one error against the smallest card, the Cloud Run one it labelled protocol 1.0, and none against the two it labelled hybrid, with two warnings each [13]. Nothing in the measurement path invoked a model or spent a token [2].
