{"record":{"id":"33581e27124c82c9","repo":"crewAIInc/crewAI","slug":"error-error-code-error-message","errorCode":null,"errorMessage":"Error ({error_code}): {error_message}","messagePattern":"Error \\((.+?)\\): (.+?)","errorType":"exception","errorClass":"BedrockAgentError","httpStatus":null,"severity":"error","filePath":"lib/crewai-tools/src/crewai_tools/aws/bedrock/agents/invoke_agent_tool.py","lineNumber":172,"sourceCode":"                if \"chunk\" in response:\n                    debug_info[\"chunk_keys\"] = list(response[\"chunk\"].keys())\n\n                raise BedrockAgentError(\n                    f\"Failed to extract completion: {json.dumps(debug_info, indent=2)}\"\n                )\n\n            return completion\n\n        except ClientError as e:\n            error_code = \"Unknown\"\n            error_message = str(e)\n\n            # Try to extract error code if available\n            if hasattr(e, \"response\") and \"Error\" in e.response:\n                error_code = e.response[\"Error\"].get(\"Code\", \"Unknown\")\n                error_message = e.response[\"Error\"].get(\"Message\", str(e))\n\n            raise BedrockAgentError(f\"Error ({error_code}): {error_message}\") from e\n        except BedrockAgentError:\n            # Re-raise BedrockAgentError exceptions\n            raise\n        except Exception as e:\n            raise BedrockAgentError(f\"Unexpected error: {e!s}\") from e\n","sourceCodeStart":154,"sourceCodeEnd":178,"githubUrl":"https://github.com/crewAIInc/crewAI/blob/754d7323beb2fd042e33444a115ea2d5a47193f0/lib/crewai-tools/src/crewai_tools/aws/bedrock/agents/invoke_agent_tool.py#L154-L178","documentation":"A BedrockAgentError raised when boto3 raises ClientError during InvokeAgent — i.e. the AWS API call itself failed. The handler extracts error_code and error_message from e.response['Error'] (Code/Message) when present, defaulting to 'Unknown' and str(e), and formats them as \"Error (<code>): <message>\".","triggerScenarios":"Any AWS-side failure: AccessDeniedException (bad/missing IAM credentials), ResourceNotFoundException (wrong agent_id/alias), ValidationException (bad request payload), ThrottlingException, ModelStreamErrorException, or expired AWS session tokens — all surface as botocore ClientError in _run and get re-wrapped here.","commonSituations":"Missing bedrock:InvokeAgent IAM permission; unset AWS credentials in the environment; wrong region (agent exists in us-east-1 but default us-west-2 is used — the code reads AWS_REGION/AWS_DEFAULT_REGION with us-west-2 fallback); expired SSO tokens; deleted agent or alias.","solutions":["Read the code in the message: AccessDeniedException → grant bedrock:InvokeAgent and bedrock:InvokeModel; ResourceNotFoundException → verify agent_id/alias_id and region.","Set the region explicitly: export AWS_REGION=us-east-1 (the tool defaults to us-west-2).","Refresh credentials: aws sso login / aws sts get-caller-identity to verify the active identity.","For ThrottlingException, add backoff/retry or reduce request rate."],"exampleFix":"# before: Error (AccessDeniedException): ... because region defaults to us-west-2\n# after — pin the correct region in the environment\nimport os\nos.environ[\"AWS_REGION\"] = \"us-east-1\"  # before creating the tool/agent","handlingStrategy":"try-catch","validationCode":"import boto3, os\n\nsts = boto3.client(\"sts\")\nsts.get_caller_identity()  # fail fast on bad credentials\nos.environ.setdefault(\"AWS_REGION\", \"us-east-1\")  # avoid silent us-west-2 default","typeGuard":null,"tryCatchPattern":"from crewai_tools.aws.bedrock.agents.invoke_agent_tool import BedrockAgentError\n\ntry:\n    result = tool._run(query)\nexcept BedrockAgentError as e:\n    msg = str(e)\n    if \"AccessDeniedException\" in msg:\n        fix_iam()          # grant bedrock:InvokeAgent\n    elif \"ResourceNotFound\" in msg:\n        check_ids_and_region()\n    elif \"ThrottlingException\" in msg:\n        backoff_and_retry()\n    else:\n        raise","preventionTips":["Pre-flight with `aws sts get-caller-identity` and a test InvokeAgent before deploying crews.","Always set AWS_REGION explicitly — the tool falls back to us-west-2 silently.","Grant least-privilege IAM: bedrock:InvokeAgent on the specific agent resource; refresh SSO tokens on a schedule."],"tags":["aws","bedrock","iam","credentials","runtime"],"backgroundTag":null,"analyzedSha":"754d7323beb2fd042e33444a115ea2d5a47193f0","analyzedAt":"2026-08-15T04:06:56.746Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}