ToolJet/ToolJet · error · QueryError

Connection test failed

Error message

Connection test failed

What it means

Thrown by the AWS Bedrock plugin's testConnection() when the ListFoundationModelsCommand probe against the BedrockClient fails. The default message is 'Connection test failed'; it is refined to 'Invalid AWS credentials' (CredentialsProviderError), 'Insufficient permissions' (AccessDeniedException), or 'AWS Bedrock Connection Failed' (any other BedrockServiceException). The original AWS SDK message is forwarded as the QueryError message and AWS metadata (httpStatusCode, requestId) is attached.

Solutions

1. Inspect QueryError.details.aws_error.name: if 'CredentialsProviderError', re-enter access_key + secret_access_key (and session_token if STS) in the datasource config.
2. If name is 'AccessDeniedException', attach an IAM policy granting bedrock:ListFoundationModels (and bedrock:InvokeModel / bedrock:InvokeModelWithResponseStream for queries) to the principal.
3. Verify the region field matches a Bedrock-enabled region (e.g. us-east-1, us-west-2, eu-central-1) and that the account has subscribed to the desired model.
4. Use the forwarded aws_error.request_id and http_status_code when opening an AWS support case.
5. Check network egress / proxy settings if the error is a socket/timeout rather than an AWS service exception.

Example fix

// before: IAM policy missing Bedrock read
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["bedrock:InvokeModel"],
    "Resource": "*"
  }]
}
// after: add ListFoundationModels so the connection probe passes
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["bedrock:ListFoundationModels", "bedrock:InvokeModel"],
    "Resource": "*"
  }]
}

// Pre-flight the IAM principal and region before calling testConnection
import { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts';

async function assertBedrockReady(opts: { access_key: string; secret_access_key: string; session_token?: string; region: string }) {
  const sts = new STSClient({
    region: opts.region,
    credentials: {
      accessKeyId: opts.access_key,
      secretAccessKey: opts.secret_access_key,
      sessionToken: opts.session_token,
    },
  });
  const id = await sts.send(new GetCallerIdentityCommand({}));
  if (!id.Arn) throw new Error(`Credentials invalid in ${opts.region}`);
  return id;
}

import { BedrockServiceException } from '@aws-sdk/client-bedrock';

function isBedrockServiceException(e: unknown): e is BedrockServiceException {
  return e instanceof BedrockServiceException
    || (typeof e === 'object' && e !== null && '$metadata' in e && 'name' in e);
}

try {
  await datasource.testConnection(sourceOptions);
} catch (e) {
  if (e instanceof QueryError) {
    const aws = e.details?.aws_error;
    if (aws?.name === 'CredentialsProviderError') {/* re-enter creds */}
    else if (aws?.name === 'AccessDeniedException') {/* fix IAM */}
    else {/* region/network */}
  }
  throw e;
}

When it happens

Trigger: Calling the Bedrock datasource 'Test connection' action with credentials the SDK cannot resolve (CredentialsProviderError), an IAM principal lacking bedrock:ListFoundationModels (AccessDeniedException), an unsupported/typo region, no network path to bedrock.<region>.amazonaws.com, or an account that has not been granted Bedrock model access in that region.

Common situations: Wrong region selected (Bedrock is not available in all regions); access key pasted without the secret; STS temporary credentials expired; IAM policy missing the Bedrock read action; running in an environment without AWS_PROFILE/AWS_REGION where the user expected shared-config resolution.

Related errors

• Connection test failed
• Query could not be completed
• Failed to assume role
• Invalid credentials configuration
• Query could not be completed

AI-assisted analysis of ToolJet/ToolJet@20602a8e10 (2026-08-13). Data as JSON: /api/errors/2f711b916e5b102d. Report an issue: GitHub.

Appendix: source

Thrown at marketplace/plugins/aws-bedrock/lib/index.ts:149

      let errorMessage = "Connection test failed";
      const errorDetails: any = {};

      if (error instanceof BedrockServiceException) {
        errorMessage = "AWS Bedrock Connection Failed";
        errorDetails.aws_error = {
          name: error.name,
          code: error.$metadata?.httpStatusCode,
          request_id: error.$metadata?.requestId
        };

        if (error.name === "CredentialsProviderError") {
          errorMessage = "Invalid AWS credentials";
        } else if (error.name === "AccessDeniedException") {
          errorMessage = "Insufficient permissions";
        }
      }

      throw new QueryError(
        errorMessage,
        error.message,
        errorDetails
      );
    }
  }

  private validateCredentials(sourceOptions: SourceOptions): void {
    const hasAccessKey = sourceOptions.access_key && sourceOptions.secret_access_key;
    const hasSessionToken = sourceOptions.session_token;

    if (hasSessionToken && !hasAccessKey) {
      throw new QueryError(
        "Invalid credentials configuration",
        "Session tokens require temporary credentials (access key + secret + token)",
        {
          validation: {
            error: "session_token_requires_access_keys"

View on GitHub (pinned to 20602a8e10)