{"record":{"id":"032c038a320f4473","repo":"mem0ai/mem0","slug":"unauthorized-access-to-bedrock-please-ensure-your","errorCode":null,"errorMessage":"Unauthorized access to Bedrock. Please ensure your AWS credentials have permission to access Bedrock in region {self.config.aws_region}.","messagePattern":"Unauthorized access to Bedrock\\. Please ensure your AWS credentials have permission to access Bedrock in region (.+?)\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"critical","filePath":"mem0/llms/aws_bedrock.py","lineNumber":102,"sourceCode":"        \"\"\"Initialize AWS Bedrock client with proper credentials.\"\"\"\n        try:\n            aws_config = self.config.get_aws_config()\n\n            # Create Bedrock runtime client\n            self.client = boto3.client(\"bedrock-runtime\", **aws_config)\n\n            # Test connection\n            self._test_connection()\n\n        except NoCredentialsError:\n            raise ValueError(\n                \"AWS credentials not found. Please set AWS_ACCESS_KEY_ID, \"\n                \"AWS_SECRET_ACCESS_KEY, and AWS_REGION environment variables, \"\n                \"or provide them in the config.\"\n            )\n        except ClientError as e:\n            if e.response[\"Error\"][\"Code\"] == \"UnauthorizedOperation\":\n                raise ValueError(\n                    f\"Unauthorized access to Bedrock. Please ensure your AWS credentials \"\n                    f\"have permission to access Bedrock in region {self.config.aws_region}.\"\n                )\n            else:\n                raise ValueError(f\"AWS Bedrock error: {e}\")\n\n    def _test_connection(self):\n        \"\"\"Test connection to AWS Bedrock service.\"\"\"\n        try:\n            # List available models to test connection\n            bedrock_client = boto3.client(\"bedrock\", **self.config.get_aws_config())\n            response = bedrock_client.list_foundation_models()\n            self.available_models = [model[\"modelId\"] for model in response[\"modelSummaries\"]]\n\n            # Check if our model is available\n            if self.config.model not in self.available_models:\n                logger.warning(f\"Model {self.config.model} may not be available in region {self.config.aws_region}\")\n                logger.info(f\"Available models: {', '.join(self.available_models[:5])}...\")","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/mem0ai/mem0/blob/001c235229be8795e3834520467bd0d661ed8f34/mem0/llms/aws_bedrock.py#L84-L120","documentation":"Raised when the initial Bedrock handshake (list_foundation_models via the bedrock client) returns ClientError with code UnauthorizedOperation: credentials resolved fine, but the identity lacks IAM permission for bedrock:ListFoundationModels (and by extension Bedrock access). Mem0 converts it to ValueError at LLM init so the permission gap fails fast.","triggerScenarios":"IAM user/role with credentials but no Bedrock policy attached; SCP or permissions boundary denying bedrock:*; using a policy that grants only bedrock:InvokeModel — the connection test additionally calls ListFoundationModels, which must also be allowed","commonSituations":"Least-privilege policies granting InvokeModel only; corporate SCPs blocking Bedrock in the account/region; new team member with read-only AWS access trying mem0.","solutions":["Attach an IAM policy allowing bedrock:InvokeModel AND bedrock:ListFoundationModels on * (or at least the region's resources) to the user/role","If ListFoundationModels cannot be granted, contribute/use a config path that skips the connection test or use the standard OpenAI-compatible Bedrock proxy","Check region: the policy must cover the region in the error message; enable model access in Bedrock console for the account","For SCP-blocked accounts, ask the admin to allowlist bedrock in that region"],"exampleFix":"// before\n# IAM policy with only InvokeModel -> ValueError at init\n\n# after\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Effect\": \"Allow\",\n    \"Action\": [\"bedrock:InvokeModel\", \"bedrock:ListFoundationModels\"],\n    \"Resource\": \"*\"\n  }]\n}","handlingStrategy":"try-catch","validationCode":"# preflight: verify the identity can use Bedrock before mem0 init\nimport boto3\nclient = boto3.client(\"bedrock\", region_name=\"us-east-1\")\ntry:\n    client.list_foundation_models()\nexcept client.exceptions.AccessDeniedException:\n    raise SystemExit(\"IAM policy must allow bedrock:ListFoundationModels and bedrock:InvokeModel\")","typeGuard":null,"tryCatchPattern":"try:\n    llm = AWSBedrockLLM(config)\nexcept ValueError as e:\n    if \"Unauthorized access to Bedrock\" in str(e):\n        # permissions issue: do not retry, fix IAM first\n        raise PermissionsError(str(e)) from e\n    raise","preventionTips":["Grant both bedrock:InvokeModel and bedrock:ListFoundationModels in the IAM policy","Test policies with the IAM policy simulator before rollout","Verify region and SCP allowlists for Bedrock"],"tags":["python","aws","bedrock","iam","permissions","mem0"],"backgroundTag":null,"analyzedSha":"001c235229be8795e3834520467bd0d661ed8f34","analyzedAt":"2026-08-15T01:55:42.685Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}