bedrock rejected model %q (%s): %w run `aws bedrock list-i

Error message

bedrock rejected model %q (%s): %w
  run `aws bedrock list-inference-profiles%s` to see what this account offers — IDs are account- and region-scoped, and a version suffix such as -v1:0 is invalid for the newer families

What it means

explainError (internal/llm/client.go:1116) matches 'model identifier is invalid' and inference-profile-not-found rejections. These are misleading service wordings: usually the model ID does not exist in the selected region/account, an inference profile is region-scoped and not found, or a version suffix like -v1:0 was appended to a model family that forbids it. The rewrite points at `aws bedrock list-inference-profiles` to see valid IDs.

Source

Thrown at internal/llm/client.go:1116

	// answers both "your IAM policy forbids this" and "this account has not
	// enabled the model" with AccessDeniedException, and the fixes have nothing
	// in common. The specific wording is matched before the generic code.
	switch {
	// First: the bearer-token path produces this even when credentials are
	// otherwise valid, so a later "denied" branch would mislabel it.
	case strings.Contains(msg, "Invalid API Key format"):
		if os.Getenv("AWS_BEARER_TOKEN_BEDROCK") != "" {
			return fmt.Errorf("bedrock rejected the token in AWS_BEARER_TOKEN_BEDROCK (%s): %w\n"+
				"  unset that variable to sign requests with SigV4 instead", where, err)
		}
		return fmt.Errorf("bedrock rejected an API-key header rather than a signature (%s): %w\n"+
			"  no api_key applies to bedrock; this means a bearer token reached the request, not that a key is missing", where, err)
	case strings.Contains(msg, "don't have access to the model"):
		return fmt.Errorf("bedrock has no access enabled for model %q (%s): %w\n"+
			"  model access is granted per account and per region in the Bedrock console; an IAM policy alone does not enable it", model, where, err)
	case strings.Contains(msg, "model identifier is invalid"),
		strings.Contains(msg, "inference profile") && strings.Contains(msg, "not found"):
		return fmt.Errorf("bedrock rejected model %q (%s): %w\n"+
			"  run `aws bedrock list-inference-profiles%s` to see what this account offers — IDs are account- and region-scoped, and a version suffix such as -v1:0 is invalid for the newer families",
			model, where, err, listProfilesRegionArg(c.awsRegion))
	// Specific credential codes only. A bare "expired" would also claim an
	// expired TLS certificate is an SSO problem.
	case strings.Contains(msg, "ExpiredToken"), strings.Contains(msg, "ExpiredTokenException"),
		strings.Contains(msg, "SSOProviderInvalidToken"), strings.Contains(msg, "InvalidGrantException"),
		strings.Contains(msg, "NoCredentialProviders"), strings.Contains(msg, "failed to refresh cached credentials"):
		return fmt.Errorf("bedrock could not authenticate: AWS credentials are expired or unavailable (%s): %w\n"+
			"  run `aws sso login%s`, or refresh whichever credential source this profile uses", where, err, ssoLoginProfileArg(c.awsProfile))
	// "not authorized to invoke this API operation" is IAM's own wording, so it
	// belongs here rather than in the model-access branch above: the fix is a
	// policy change, not a console toggle.
	case strings.Contains(msg, "AccessDenied"),
		strings.Contains(msg, "not authorized to invoke this API operation"):
		return fmt.Errorf("bedrock denied access to model %q (%s): %w\n"+
			"  credentials resolved, so this is an authorization gap: the identity needs bedrock:InvokeModel on this model in this region, and the account needs model access enabled for it", model, where, err)
	}
	// Everything else — ValidationException on max_tokens, a network reset, a

View on GitHub (pinned to 5cf97d0d15)

Solutions

Run `aws bedrock list-inference-profiles` (add the region arg this message suggests) and copy an exact ID from the output
Remove version suffixes like -v1:0 from newer model family IDs
Check the model is offered in your region — IDs are account- and region-scoped; try a standard region like us-east-1
Correct the model string in your tool config against AWS's Bedrock model ID documentation

Example fix

// before
"model": "anthropic.claude-sonnet-4-20250514-v1:0"
// after
"model": "us.anthropic.claude-sonnet-4-20250514"  # from list-inference-profiles output

Defensive patterns

Strategy: validation

Validate before calling

out, err := exec.Command("aws", "bedrock", "list-inference-profiles",
    "--region", region).Output()
if err != nil || !strings.Contains(string(out), modelID) {
    return fmt.Errorf("model %q not among this account's inference profiles in %s", modelID, region)
}

Try / catch

_, err := cl.Call(ctx, messages)
if err != nil && strings.Contains(err.Error(), "rejected model") {
    return fmt.Errorf("verify the exact ID via `aws bedrock list-inference-profiles`: %w", err)
}

Prevention

Copy model IDs directly from list-inference-profiles output, not from provider docs
Never append -v1:0 suffixes to newer model family IDs
Use region-prefixed inference profile IDs (us.anthropic.*) for cross-region inference
Keep the model ID in config reviewed when upgrading model versions

When it happens

Trigger: Passing a model ID with an invalid form (e.g. anthropic.claude-3-5-sonnet-v1:0), using a global/cross-region inference profile ID unavailable in the current region, or a model name typo'd or from a newer release than the deployed Bedrock API knows.

Common situations: Copy-pasting a model ID from Anthropic docs that differs from the Bedrock ID scheme; hard-coding a -v1:0 suffix; using a US inference profile from a non-US region; region string wrong so the profile lookup fails.

Related errors

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/f4a3eb8afaed09a5. Report an issue: GitHub.