JuliusBrussee/caveman · error

bedrock Mantle region

Error message

bedrock Mantle region %q is not on the allowlist

What it means

Mantle is available only in a narrower set of AWS regions than Bedrock Runtime (defaultMantleRegions follows AWS's endpoint-specific availability list). When a Mantle request's resolved region is not on the Mantle allowlist (built-in list or CAVE_BEDROCK_MANTLE_REGION_ALLOWLIST override, which itself must still pass the base Runtime region allowlist), ResolveUpstreamURL rejects the request.

Solutions

1. Check AWS's Mantle region availability and set x-cave-aws-region (or CAVE_BEDROCK_REGION) to a supported Mantle region such as us-east-1, eu-west-1, or ap-northeast-1
2. If the region genuinely supports Mantle but was excluded by an override, add it to CAVE_BEDROCK_MANTLE_REGION_ALLOWLIST (comma-separated)
3. Verify CAVE_BEDROCK_REGION_ALLOWLIST has not excluded the region — MantleRegionAllowed also requires the base Runtime allowlist to pass
4. Alternatively route the request through Bedrock Runtime (/bedrock/model/...) which supports more regions

Example fix

// before
POST /bedrock/anthropic/v1/messages
x-cave-aws-region: ca-central-1  // not in Mantle inventory -> rejected
// after
x-cave-aws-region: us-east-1

mantleRegions := map[string]bool{"ap-northeast-1":true,"ap-south-1":true,"ap-southeast-2":true,"ap-southeast-3":true,"eu-central-1":true,"eu-north-1":true,"eu-south-1":true,"eu-west-1":true,"eu-west-2":true,"sa-east-1":true,"us-east-1":true,"us-east-2":true,"us-gov-west-1":true,"us-west-2":true}
if strings.HasPrefix(path, "/bedrock/anthropic/") && !mantleRegions[region] {
	// pick a Mantle-supported region or use Runtime before sending
}

When it happens

Trigger: A POST to /bedrock/anthropic/v1/messages with CAVE_BEDROCK_MANTLE_ENABLED=true where the resolved region (x-cave-aws-region header, endpoint host, or CAVE_BEDROCK_REGION/AWS_REGION env) is not in the Mantle inventory — e.g. ap-east-2, ca-central-1, us-gov-east-1, or any region not in defaultMantleRegions.

Common situations: Sending x-cave-aws-region set to a Runtime-only region; CAVE_BEDROCK_REGION pointing at a region where AWS has not launched Mantle; an operator override of CAVE_BEDROCK_MANTLE_REGION_ALLOWLIST (or CAVE_BEDROCK_REGION_ALLOWLIST) accidentally excluding the region in use; assuming Mantle exists wherever Bedrock Runtime does.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• bedrock region is not on the allowlist
• bedrock action is not allowed
• bedrock Mantle endpoint is not enabled
• bedrock Mantle path is not allowed
• bedrock model is not on the allowlist

AI-assisted analysis of JuliusBrussee/caveman@3ee70a1026 (2026-09-20). Data as JSON: /api/errors/8a5c7b4b064f0879. Report an issue: GitHub.

Appendix: source

Thrown at proxy/providers/bedrock/routing.go:186

			return nil, fmt.Errorf("bedrock region %q is not on the allowlist", region)
		}
		modelID, action := parseModelPath(req.URL.Path)
		if modelID == "" || action == "" {
			return nil, fmt.Errorf("bedrock request path %q does not name a model and action", req.URL.Path)
		}
		if !actionAllowed(action) {
			return nil, fmt.Errorf("bedrock action %q is not allowed", action)
		}
		if !modelAllowed(modelID) {
			return nil, fmt.Errorf("bedrock model %q is not on the allowlist", modelID)
		}
		base.Path = strings.TrimRight(base.Path, "/") + strings.TrimPrefix(req.URL.Path, "/bedrock")
	case endpointMantle:
		if !env.Bool("CAVE_BEDROCK_MANTLE_ENABLED", false) {
			return nil, fmt.Errorf("bedrock Mantle endpoint is not enabled")
		}
		if !MantleRegionAllowed(region) {
			return nil, fmt.Errorf("bedrock Mantle region %q is not on the allowlist", region)
		}
		if !mantleActionAllowed(req.URL.Path) {
			return nil, fmt.Errorf("bedrock Mantle path %q is not allowed", req.URL.Path)
		}
		base, err = resolveMantleBase(base, region)
		if err != nil {
			return nil, err
		}
		base.Path = strings.TrimRight(base.Path, "/") + strings.TrimPrefix(req.URL.Path, "/bedrock")
	default:
		return nil, fmt.Errorf("bedrock request path %q is not allowed", req.URL.Path)
	}
	base.RawQuery = req.URL.RawQuery

	if env.IsProduction() {
		if err := providers.ValidateUpstreamEndpoint(ctx, base, ssrf.ManagedConfig()); err != nil {
			return nil, err
		}

View on GitHub (pinned to 3ee70a1026)