[AWS::Bedrock::KnowledgeBase] MANAGED type cannot be deployed: EmbeddingModelArn is both required by schema and rejected by the service

---
▼ Name of the resource

Other

---
▼ Resource Name

AWS::Bedrock::KnowledgeBase

---
▼ Issue Description

`AWS::Bedrock::KnowledgeBase` with `KnowledgeBaseConfiguration.Type: MANAGED` (Amazon Bedrock managed knowledge base, launched June 2026) cannot be deployed through CloudFormation. The `EmbeddingModelArn` property is simultaneously:

- **required** by the CloudFormation resource schema (early validation fails without it), and
- **rejected** by the Bedrock service API when `EmbeddingModelType` is `MANAGED`.

There is no value of `EmbeddingModelArn` (present or absent) that lets the resource deploy, so the MANAGED embedding mode is unreachable via CloudFormation / CDK. Only the AWS CLI / SDK (or an `AwsCustomResource` Lambda workaround) can create a MANAGED knowledge base today.

**Schema self-conflict (CloudFormation docs):**
On the `ManagedKnowledgeBaseConfiguration` property page:
- `EmbeddingModelArn` — *Required: Yes* (unconditional)
- `EmbeddingModelConfiguration` — *Required: No*, noted "Not required when choosing the MANAGED embeddingModelType"

The two embedding properties should follow the same conditional logic, but only `EmbeddingModelConfiguration` is treated as conditional.

**Authoritative API docs** (https://docs.aws.amazon.com/bedrock/latest/userguide/kb-managed-create.html):
> "When `embeddingModelType` is omitted, it defaults to `MANAGED`. When using `MANAGED`, you must not specify `embeddingModelArn` or `embeddingModelConfiguration`. When using `CUSTOM`, both fields are required."

So per the service contract, `EmbeddingModelArn` must be **conditional** (required only when `EmbeddingModelType: CUSTOM`), not unconditionally required.

Region tested: `ap-northeast-1` (Tokyo).

---
▼ Expected Behavior

`EmbeddingModelArn` (and `EmbeddingModelConfiguration`) in `ManagedKnowledgeBaseConfiguration` should be **conditionally required**:

- `EmbeddingModelType: CUSTOM` → `EmbeddingModelArn` required
- `EmbeddingModelType: MANAGED` (or omitted) → `EmbeddingModelArn` must be absent, and the resource should deploy successfully using the service-managed embedding model.

The following template should deploy successfully:

```yaml
ManagedKB:
Type: AWS::Bedrock::KnowledgeBase
Properties:
Name: my-managed-kb
RoleArn: arn:aws:iam::123456789012:role/MyKbRole
KnowledgeBaseConfiguration:
Type: MANAGED
ManagedKnowledgeBaseConfiguration:
EmbeddingModelType: MANAGED
```

---
▼ Observed Behavior

**Case 1 — `EmbeddingModelArn` omitted** (per API docs for MANAGED):

```yaml
KnowledgeBaseConfiguration:
Type: MANAGED
ManagedKnowledgeBaseConfiguration:
EmbeddingModelType: MANAGED
```

CloudFormation early validation fails before any API call:

> Required property [EmbeddingModelArn] not found (at /Resources/ManagedKB/Properties/KnowledgeBaseConfiguration/ManagedKnowledgeBaseConfiguration)

**Case 2 — `EmbeddingModelArn` supplied** (to satisfy the schema):

```yaml
KnowledgeBaseConfiguration:
Type: MANAGED
ManagedKnowledgeBaseConfiguration:
EmbeddingModelType: MANAGED
EmbeddingModelArn: arn:aws:bedrock:ap-northeast-1::foundation-model/amazon.titan-embed-text-v2:0
```

The service rejects the request during CREATE:

> Resource handler returned message: "embeddingModelArn must not be specified when embeddingModelType is MANAGED. (Service: BedrockAgent, Status Code: 400)" (HandlerErrorCode: InvalidRequest)

Both paths fail → MANAGED knowledge bases cannot be created via CloudFormation.

---
▼ Test Cases

1. **MANAGED, no ARN** → should CREATE successfully (currently fails early validation with "Required property [EmbeddingModelArn] not found").
2. **MANAGED, with ARN** → should be rejected at validation with a clear message (currently passes schema validation, then fails at the service with "embeddingModelArn must not be specified when embeddingModelType is MANAGED").
3. **CUSTOM, with ARN + dimensions:1024** → should CREATE successfully (works today; regression guard).
4. **CUSTOM, no ARN** → should fail validation ("required when CUSTOM").
5. Verify the same matrix for UPDATE and via `cdk deploy` (CfnKnowledgeBase L1).

---
▼ Other Details

- The legacy provider repo (aws-cloudformation-resource-providers-bedrock-original) was archived on 2025-08-27, so filing here per its redirect.
- Reproduced with AWS CDK (aws-cdk-lib, CfnKnowledgeBase L1 escape hatch) and with raw CloudFormation; both hit the same wall.
- Current workaround: create the knowledge base via AWS CLI/SDK (`bedrock-agent create-knowledge-base`) or a Custom Resource Lambda, then reference its ID from the rest of the stack.
- API reference confirming the conditional contract: https://docs.aws.amazon.com/bedrock/latest/userguide/kb-managed-create.html
- CFN property reference showing the schema conflict: https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrock-knowledgebase-managedknowledgebaseconfiguration.html

---

Start with the AWS::Bedrock::KnowledgeBase CfnKnowledgeBase L1 entry point and the ManagedKnowledgeBaseConfiguration property reference linked in the issue. Reproduce the five MANAGED and CUSTOM cases with raw CloudFormation or cdk deploy, then verify the same matrix for updates. Done means MANAGED works without an ARN, CUSTOM still requires one, and invalid combinations fail validation clearly.

Written by the indexing model from the issue text.