{"record":{"id":"2f711b916e5b102d","repo":"ToolJet/ToolJet","slug":"connection-test-failed-2f711b","errorCode":null,"errorMessage":"Connection test failed","messagePattern":"Connection test failed","errorType":"exception","errorClass":"QueryError","httpStatus":null,"severity":"error","filePath":"marketplace/plugins/aws-bedrock/lib/index.ts","lineNumber":149,"sourceCode":"      let errorMessage = \"Connection test failed\";\n      const errorDetails: any = {};\n\n      if (error instanceof BedrockServiceException) {\n        errorMessage = \"AWS Bedrock Connection Failed\";\n        errorDetails.aws_error = {\n          name: error.name,\n          code: error.$metadata?.httpStatusCode,\n          request_id: error.$metadata?.requestId\n        };\n\n        if (error.name === \"CredentialsProviderError\") {\n          errorMessage = \"Invalid AWS credentials\";\n        } else if (error.name === \"AccessDeniedException\") {\n          errorMessage = \"Insufficient permissions\";\n        }\n      }\n\n      throw new QueryError(\n        errorMessage,\n        error.message,\n        errorDetails\n      );\n    }\n  }\n\n  private validateCredentials(sourceOptions: SourceOptions): void {\n    const hasAccessKey = sourceOptions.access_key && sourceOptions.secret_access_key;\n    const hasSessionToken = sourceOptions.session_token;\n\n    if (hasSessionToken && !hasAccessKey) {\n      throw new QueryError(\n        \"Invalid credentials configuration\",\n        \"Session tokens require temporary credentials (access key + secret + token)\",\n        {\n          validation: {\n            error: \"session_token_requires_access_keys\"","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/ToolJet/ToolJet/blob/20602a8e101f2e59686c9afde0d1402aac2c8871/marketplace/plugins/aws-bedrock/lib/index.ts#L131-L167","documentation":"Thrown by the AWS Bedrock plugin's testConnection() when the ListFoundationModelsCommand probe against the BedrockClient fails. The default message is 'Connection test failed'; it is refined to 'Invalid AWS credentials' (CredentialsProviderError), 'Insufficient permissions' (AccessDeniedException), or 'AWS Bedrock Connection Failed' (any other BedrockServiceException). The original AWS SDK message is forwarded as the QueryError message and AWS metadata (httpStatusCode, requestId) is attached.","triggerScenarios":"Calling the Bedrock datasource 'Test connection' action with credentials the SDK cannot resolve (CredentialsProviderError), an IAM principal lacking bedrock:ListFoundationModels (AccessDeniedException), an unsupported/typo region, no network path to bedrock.<region>.amazonaws.com, or an account that has not been granted Bedrock model access in that region.","commonSituations":"Wrong region selected (Bedrock is not available in all regions); access key pasted without the secret; STS temporary credentials expired; IAM policy missing the Bedrock read action; running in an environment without AWS_PROFILE/AWS_REGION where the user expected shared-config resolution.","solutions":["Inspect QueryError.details.aws_error.name: if 'CredentialsProviderError', re-enter access_key + secret_access_key (and session_token if STS) in the datasource config.","If name is 'AccessDeniedException', attach an IAM policy granting bedrock:ListFoundationModels (and bedrock:InvokeModel / bedrock:InvokeModelWithResponseStream for queries) to the principal.","Verify the region field matches a Bedrock-enabled region (e.g. us-east-1, us-west-2, eu-central-1) and that the account has subscribed to the desired model.","Use the forwarded aws_error.request_id and http_status_code when opening an AWS support case.","Check network egress / proxy settings if the error is a socket/timeout rather than an AWS service exception."],"exampleFix":"// before: IAM policy missing Bedrock read\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Effect\": \"Allow\",\n    \"Action\": [\"bedrock:InvokeModel\"],\n    \"Resource\": \"*\"\n  }]\n}\n// after: add ListFoundationModels so the connection probe passes\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Effect\": \"Allow\",\n    \"Action\": [\"bedrock:ListFoundationModels\", \"bedrock:InvokeModel\"],\n    \"Resource\": \"*\"\n  }]\n}","handlingStrategy":"try-catch","validationCode":"// Pre-flight the IAM principal and region before calling testConnection\nimport { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts';\n\nasync function assertBedrockReady(opts: { access_key: string; secret_access_key: string; session_token?: string; region: string }) {\n  const sts = new STSClient({\n    region: opts.region,\n    credentials: {\n      accessKeyId: opts.access_key,\n      secretAccessKey: opts.secret_access_key,\n      sessionToken: opts.session_token,\n    },\n  });\n  const id = await sts.send(new GetCallerIdentityCommand({}));\n  if (!id.Arn) throw new Error(`Credentials invalid in ${opts.region}`);\n  return id;\n}","typeGuard":"import { BedrockServiceException } from '@aws-sdk/client-bedrock';\n\nfunction isBedrockServiceException(e: unknown): e is BedrockServiceException {\n  return e instanceof BedrockServiceException\n    || (typeof e === 'object' && e !== null && '$metadata' in e && 'name' in e);\n}","tryCatchPattern":"try {\n  await datasource.testConnection(sourceOptions);\n} catch (e) {\n  if (e instanceof QueryError) {\n    const aws = e.details?.aws_error;\n    if (aws?.name === 'CredentialsProviderError') {/* re-enter creds */}\n    else if (aws?.name === 'AccessDeniedException') {/* fix IAM */}\n    else {/* region/network */}\n  }\n  throw e;\n}","preventionTips":["Run aws sts get-caller-identity with the same credentials before configuring the datasource.","Keep IAM policies version-controlled and assert bedrock:ListFoundationModels in CI.","Default the region field to a known Bedrock-enabled region to avoid typos.","Log aws_error.request_id on failure for AWS support correlation."],"tags":["aws","bedrock","credentials","iam","network"],"backgroundTag":null,"analyzedSha":"20602a8e101f2e59686c9afde0d1402aac2c8871","analyzedAt":"2026-08-13T05:58:54.221Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}