03-self-managed-strategy sample has multiple bugs preventing execution

Description

The self-managed strategy sample at 01-features/04-manage-context-of-your-agent/memory/02-long-term-memory/03-self-managed-strategy/self-managed-strategy.py fails to create a memory and the
referenced Lambda pattern has incorrect API parameters.

Bugs found

1. namespaces field in customMemoryStrategy causes ValidationException

The sample passes namespaces inside customMemoryStrategy:

"customMemoryStrategy": {
"name": "MyOwnExtractor",
"namespaces": [NAMESPACE_TEMPLATE], # ← THIS FAILS
...
}

Error: Validation failed during CreateMemory: Namespaces are not allowed for self-managed memory strategies

Fix: Remove the namespaces field from the strategy definition.

2. IAM role permissions incomplete

The README states the role needs s3:PutObject and sns:Publish. The actual API validation also requires:

- s3:GetBucketLocation on the bucket ARN (not just /*)
- sns:GetTopicAttributes on the topic ARN

Additionally, the trust policy Condition should use ArnLike with arn:aws:bedrock-agentcore:::memory/* (per official docs), not StringEquals on aws:SourceAccount.

3. SNS notification message format differs from what's documented in sample

The sample Lambda code (referenced at ../examples/single-agent/with-strands-agent/02-custom-hook/culinary-assistant-self-managed-strategy/lambda_function.py) expects fields like
payloadBucketName and payloadKey. The actual SNS message contains:

{
"jobId": "...",
"s3PayloadLocation": "s3://bucket/key.json",
"memoryId": "...",
"strategyId": "..."
}

The S3 location is a full URI that must be parsed, not separate bucket/key fields.

4. BatchCreateMemoryRecords parameter format

Each record requires:

- requestIdentifier (string, required)
- namespaces (array, not singular namespace)
- timestamp (integer, required)
- content (dict)
- memoryStrategyId (string)

Environment

- Region: us-east-1
- boto3 with Python 3.12/3.14
- Tested Jul 30, 2026

Steps to reproduce

1. Set up S3 bucket, SNS topic, and IAM role per README
2. Run python self-managed-strategy.py boto3
3. Observe ValidationException on namespaces
4. After fixing namespaces, observe IAM role validation failure until s3:GetBucketLocation + sns:GetTopicAttributes are added

Start with 01-features/04-manage-context-of-your-agent/memory/02-long-term-memory/03-self-managed-strategy/self-managed-strategy.py and compare its memory strategy, IAM permissions, and batch record parameters with the issue details. Then inspect the referenced lambda_function.py and README for the SNS message and role configuration. Done means the sample runs without the reported validation errors and correctly parses the documented SNS payload.

Written by the indexing model from the issue text.