fix(bedrock-005): remove memory permissions not required when memory is disabled

[MrCloudSec]

What type of PR is this? (check all applicable)

• New Path
• Add / Update / Fix info within an existing path
• New Feature / Major Change / Refactor / Optimization
• Non path based documentation Update (Readme, etc)

Description

bedrock-005 lists bedrock-agentcore:CreateMemory and bedrock-agentcore:GetMemory as required, on the basis that AWS requires them on every CreateHarness call regardless of the memory configuration. That does not hold when memory is disabled, which is what the path's own step 2 does.

Change	Detail
permissions.required	Removed bedrock-agentcore:CreateMemory and bedrock-agentcore:GetMemory
name	Dropped the same two permissions from the path name
Step 2 description	Removed the claim that AWS requires the memory permissions on every call
attackVisualization	Added the missing --memory '{"disabled":{}}' to the create-harness command so it matches step 2

How to reproduce and testing

Validated in a sandbox account with a role holding only the permissions this path lists, and no CreateMemory or GetMemory:

• create-harness with --memory '{"disabled":{}}' reaches READY, and GetHarness reports memory: {"disabled":{}} on the created resource
• the rest of the chain works unchanged with that same role: InvokeAgentRuntimeCommand returns the MMDS payload and the credentials resolve to the harness execution role
• omitting the flag fails asynchronously with CREATE_FAILED and Memory operation failed: ... not authorized to perform: bedrock-agentcore:CreateMemory

So the memory permissions belong to the managed memory default rather than to CreateHarness itself. The same permission set is applied to the matching scenario in DataDog/pathfinding-labs#98, where the full attack was run end to end against it.

python scripts/validate-schema.py data/paths/bedrock/bedrock-005.yaml passes.