alibaba/open-code-review · error

bedrock request failed (%s): %w

Error message

bedrock request failed (%s): %w

What it means

Bedrock request wrapper that preserves the service's own error wording. It only rewrites the message when diagnostics indicate a credentials or authorization gap (no credentials resolved, or an access-denied class of failure); in that case it explains that the identity needs bedrock:InvokeModel on the model in that region and that model access must be enabled for the account. Everything else (ValidationException, network reset, throttling) is wrapped verbatim so developers chase the real cause instead of a guess.

Source

Thrown at internal/llm/client.go:1138

	// expired TLS certificate is an SSO problem.
	case strings.Contains(msg, "ExpiredToken"), strings.Contains(msg, "ExpiredTokenException"),
		strings.Contains(msg, "SSOProviderInvalidToken"), strings.Contains(msg, "InvalidGrantException"),
		strings.Contains(msg, "NoCredentialProviders"), strings.Contains(msg, "failed to refresh cached credentials"):
		return fmt.Errorf("bedrock could not authenticate: AWS credentials are expired or unavailable (%s): %w\n"+
			"  run `aws sso login%s`, or refresh whichever credential source this profile uses", where, err, ssoLoginProfileArg(c.awsProfile))
	// "not authorized to invoke this API operation" is IAM's own wording, so it
	// belongs here rather than in the model-access branch above: the fix is a
	// policy change, not a console toggle.
	case strings.Contains(msg, "AccessDenied"),
		strings.Contains(msg, "not authorized to invoke this API operation"):
		return fmt.Errorf("bedrock denied access to model %q (%s): %w\n"+
			"  credentials resolved, so this is an authorization gap: the identity needs bedrock:InvokeModel on this model in this region, and the account needs model access enabled for it", model, where, err)
	}
	// Everything else — ValidationException on max_tokens, a network reset, a
	// throttle — keeps the service's own wording. Guessing at a cause here would
	// send people after the wrong problem, which is the failure this function
	// exists to prevent.
	return fmt.Errorf("bedrock request failed (%s): %w", where, err)
}

func listProfilesRegionArg(region string) string {
	if region == "" {
		return ""
	}
	return " --region " + region
}

// anthropicThinkingBudgetTokens extracts budget_tokens from an
// extra_body.thinking map. Returns ok=false for unrecognized shapes.
func anthropicThinkingBudgetTokens(v any) (int64, bool) {
	m, ok := v.(map[string]any)
	if !ok {
		return 0, false
	}
	switch n := m["budget_tokens"].(type) {
	case float64:

View on GitHub (pinned to 5cf97d0d15)

Solutions

1. Check the wrapped (%w) inner error to identify the underlying AWS failure class
2. If it is an authorization/access-denied error: grant the identity bedrock:InvokeModel on the model ARN in that region and enable model access for the account in the Bedrock console
3. Verify AWS credentials are valid (aws sts get-caller-identity) and the correct profile/env vars are set
4. Confirm the configured region matches where the model is available and model access is enabled
5. For ValidationException, fix the offending parameter (e.g. reduce max_tokens); for throttling, back off and retry

Example fix

// before
model: "anthropic.claude-3-sonnet-v1" // no model access in this account/region
// after
// enable model access in Bedrock console, then use the correct regional model ID
model: "anthropic.claude-3-5-sonnet-20240620-v1:0" // region: us-east-1

// pre-check credentials before invoking
if err := exec.Command("aws", "sts", "get-caller-identity").Run(); err != nil {
	// credentials broken; fix before calling Bedrock
}

func isAccessDenied(err error) bool {
	var ae smithy.APIError
	return errors.As(err, &ae) && ae.ErrorCode() == "AccessDeniedException"
}

if err != nil {
	var ae smithy.APIError
	if errors.As(err, &ae) && ae.ErrorCode() == "AccessDeniedException" {
		// fix IAM policy (bedrock:InvokeModel on this model ARN) and enable model access
	}
	return fmt.Errorf("bedrock invoke: %w", err)
}

When it happens

Trigger: Any call through the Bedrock LLM client whose InvokeModel/Converse request returns an error from the AWS SDK — auth failures, ValidationException (e.g. max_tokens too large), throttling, and network resets.

Common situations: Missing or expired AWS credentials; IAM role/policy lacking bedrock:InvokeModel; model access not enabled in the Bedrock console for that model/region; wrong region configured; max_tokens violating model limits; transient network failures.

Related errors

• bedrock rejected the token in AWS_BEARER_TOKEN_BEDROCK (%s):
• bedrock rejected an API-key header rather than a signature (
• bedrock could not authenticate: AWS credentials are expired
• llm.protocol cannot be %q: bedrock derives its host from aws
• %s does not apply to provider %q: aws_region and aws_profile

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/45037bcd4ce9c482. Report an issue: GitHub.