JuliusBrussee/caveman · error

bedrock region is not on the allowlist

Error message

bedrock region %q is not on the allowlist

What it means

Bedrock Runtime requests are validated against a region allowlist (built-in list of AWS Bedrock regions, overridable via CAVE_BEDROCK_REGION_ALLOWLIST). The resolved region — from the endpoint host, x-cave-aws-region header, or environment — is not on the list, so the request is refused before signing.

Solutions

1. Target an allowlisted Bedrock region (e.g. us-east-1, us-west-2, eu-west-1).
2. If the region is genuinely available, add it via CAVE_BEDROCK_REGION_ALLOWLIST (comma-separated).
3. Set x-cave-aws-region or CAVE_BEDROCK_REGION explicitly to the intended region so an ambient AWS_REGION is not picked up.
4. Verify the configured endpoint host encodes the region you expect.

Example fix

// before
export AWS_REGION=us-iso-east-1
// after
export CAVE_BEDROCK_REGION=us-east-1

region := os.Getenv("CAVE_BEDROCK_REGION")
if region == "" {
	region = os.Getenv("AWS_REGION")
}
allowed := []string{"us-east-1", "us-west-2", "eu-west-1" /* ... */}
if !slices.Contains(allowed, region) {
	return fmt.Errorf("region %q not on bedrock allowlist", region)
}

// Go
if _, err := adapter.ResolveUpstreamURL(ctx, req, route); err != nil {
	if strings.Contains(err.Error(), "is not on the allowlist") {
		// configuration/allowlist problem: surface to operator, no retry
		return fmt.Errorf("bedrock routing rejected: %w", err)
	}
	return err
}

When it happens

Trigger: A /bedrock/model/... request whose resolved region (bedrock-runtime.<region>.amazonaws.com host, x-cave-aws-region header, or CAVE_BEDROCK_REGION/AWS_REGION/AWS_DEFAULT_REGION fallback) is not in the effective allowlist — e.g. a newly launched region or us-iso-*, or a region removed by a custom CAVE_BEDROCK_REGION_ALLOWLIST.

Common situations: AWS launching a new region not yet in the default list; an operator narrowing the allowlist but clients still targeting old regions; ambient AWS_REGION set to a region Bedrock does not serve; GovCloud/China partition regions outside the list.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• bedrock action is not allowed
• bedrock base url invalid
• bedrock configured endpoint kind
• bedrock Mantle region
• bedrock model is not on the allowlist

AI-assisted analysis of JuliusBrussee/caveman@3ee70a1026 (2026-09-20). Data as JSON: /api/errors/76c0e87c64bf7955. Report an issue: GitHub.

Appendix: source

Thrown at proxy/providers/bedrock/routing.go:168

		baseURL = route.BaseURL
	}
	base, err := url.Parse(baseURL)
	if err != nil {
		return nil, fmt.Errorf("bedrock base url invalid: %w", err)
	}
	region, err := resolveRegion(req, base)
	if err != nil {
		return nil, err
	}

	kind := endpointKindForPath(req.URL.Path)
	if configuredKind := strings.ToLower(strings.TrimSpace(route.EndpointKind)); configuredKind != "" && configuredKind != kind {
		return nil, fmt.Errorf("bedrock configured endpoint kind %q does not allow request kind %q", configuredKind, kind)
	}
	switch kind {
	case endpointRuntime:
		if !RegionAllowed(region) {
			return nil, fmt.Errorf("bedrock region %q is not on the allowlist", region)
		}
		modelID, action := parseModelPath(req.URL.Path)
		if modelID == "" || action == "" {
			return nil, fmt.Errorf("bedrock request path %q does not name a model and action", req.URL.Path)
		}
		if !actionAllowed(action) {
			return nil, fmt.Errorf("bedrock action %q is not allowed", action)
		}
		if !modelAllowed(modelID) {
			return nil, fmt.Errorf("bedrock model %q is not on the allowlist", modelID)
		}
		base.Path = strings.TrimRight(base.Path, "/") + strings.TrimPrefix(req.URL.Path, "/bedrock")
	case endpointMantle:
		if !env.Bool("CAVE_BEDROCK_MANTLE_ENABLED", false) {
			return nil, fmt.Errorf("bedrock Mantle endpoint is not enabled")
		}
		if !MantleRegionAllowed(region) {
			return nil, fmt.Errorf("bedrock Mantle region %q is not on the allowlist", region)

View on GitHub (pinned to 3ee70a1026)