alibaba/open-code-review · error

bedrock: no AWS region resolved set AWS_REGION, or give th

Error message

bedrock: no AWS region resolved
  set AWS_REGION, or give the active profile a region — the region decides which bedrock-runtime host is used

What it means

After LoadDefaultConfig succeeds, NewAnthropicBedrockClient (internal/llm/client.go:1015) checks awsCfg.Region. Bedrock requests are signed for a regional bedrock-runtime endpoint, so with no region the client cannot build a host; it returns a client with initErr explaining that the region decides which bedrock-runtime host is used. Unlike credential failure this is purely a region-resolution gap — credentials were fine.

Source

Thrown at internal/llm/client.go:1015

	}
	loadCtx, cancel := context.WithTimeout(context.Background(), bedrockConfigLoadTimeout)
	defer cancel()
	awsCfg, err := awsconfig.LoadDefaultConfig(loadCtx, loadOpts...)
	if err != nil {
		return &AnthropicClient{
			cfg:        cfg,
			bedrock:    true,
			awsProfile: cfg.AWSProfile,
			initErr: fmt.Errorf("bedrock: could not load AWS configuration: %w\n"+
				"  bedrock uses the standard AWS credential chain — set AWS_PROFILE, or run `aws sso login%s`", err, ssoLoginProfileArg(cfg.AWSProfile)),
		}
	}
	if awsCfg.Region == "" {
		return &AnthropicClient{
			cfg:        cfg,
			bedrock:    true,
			awsProfile: cfg.AWSProfile,
			initErr: fmt.Errorf("bedrock: no AWS region resolved\n" +
				"  set AWS_REGION, or give the active profile a region — the region decides which bedrock-runtime host is used"),
		}
	}

	// Drop the credential-chain bearer token, always.
	//
	// bedrock.WithConfig prefers bearer auth over SigV4 whenever
	// cfg.BearerAuthTokenProvider is non-nil, and LoadDefaultConfig populates
	// that provider from the SSO token cache — the OIDC access token, which is
	// for identity services, not Bedrock. So an SSO-authenticated caller
	// (i.e. most enterprise setups) silently sends `Authorization: Bearer
	// <sso-token>` and Bedrock answers 403 "Invalid API Key format: Must start
	// with pre-defined prefix".
	//
	// Clearing it unconditionally is what gives AWS_BEARER_TOKEN_BEDROCK the
	// precedence its documentation describes. WithConfig's doc comment says the
	// variable wins, but the code only consults it when the provider is nil
	// (bedrock.go: `if cfg.BearerAuthTokenProvider == nil`), so leaving an

View on GitHub (pinned to 5cf97d0d15)

Solutions

1. Export AWS_REGION=us-east-1 (or your Bedrock region) in the environment
2. Add `region = us-east-1` under the active profile in ~/.aws/config (not the credentials file)
3. Pass the region explicitly in the tool's config (cfg.AWSRegion) so it feeds LoadDefaultConfig opts
4. Fix CI/container env so AWS_REGION is forwarded into the job/image

Example fix

// before
[profile work]
sso_start_url = https://d-xxx.awsapps.com/start
# no region key
// after
[profile work]
sso_start_url = https://d-xxx.awsapps.com/start
region = us-east-1

region := os.Getenv("AWS_REGION")
if region == "" {
    if v := os.Getenv("AWS_DEFAULT_REGION"); v != "" {
        region = v
    } else {
        return errors.New("set AWS_REGION before using the bedrock provider")
    }
}

_, err := cl.Call(ctx, messages)
if err != nil && strings.Contains(err.Error(), "no AWS region resolved") {
    return fmt.Errorf("export AWS_REGION (e.g. us-east-1) and retry: %w", err)
}

When it happens

Trigger: Creating the Bedrock client when neither AWS_REGION/AWS_DEFAULT_REGION, the active profile's region key, nor any other chain source yields a region — e.g. a credentials-only profile or a bare environment with static keys.

Common situations: Profile in ~/.aws/credentials (which cannot hold a region) with no AWS_REGION exported; CI job exporting only access keys; Docker image where AWS_REGION was not passed through; user set a region only in a different profile than the active one.

Related errors

• bedrock: could not load AWS configuration: %w bedrock uses
• bedrock rejected model %q (%s): %w run `aws bedrock list-i
• %s cannot be %q: bedrock derives its host from aws_region an
• llm.protocol cannot be %q: bedrock derives its host from aws
• %s does not apply to provider %q: aws_region and aws_profile

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/ab7d7093dc47a424. Report an issue: GitHub.