{"record":{"id":"45037bcd4ce9c482","repo":"alibaba/open-code-review","slug":"bedrock-request-failed-s-w","errorCode":null,"errorMessage":"bedrock request failed (%s): %w","messagePattern":"bedrock request failed \\((.+?)\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/llm/client.go","lineNumber":1138,"sourceCode":"\t// expired TLS certificate is an SSO problem.\n\tcase strings.Contains(msg, \"ExpiredToken\"), strings.Contains(msg, \"ExpiredTokenException\"),\n\t\tstrings.Contains(msg, \"SSOProviderInvalidToken\"), strings.Contains(msg, \"InvalidGrantException\"),\n\t\tstrings.Contains(msg, \"NoCredentialProviders\"), strings.Contains(msg, \"failed to refresh cached credentials\"):\n\t\treturn fmt.Errorf(\"bedrock could not authenticate: AWS credentials are expired or unavailable (%s): %w\\n\"+\n\t\t\t\"  run `aws sso login%s`, or refresh whichever credential source this profile uses\", where, err, ssoLoginProfileArg(c.awsProfile))\n\t// \"not authorized to invoke this API operation\" is IAM's own wording, so it\n\t// belongs here rather than in the model-access branch above: the fix is a\n\t// policy change, not a console toggle.\n\tcase strings.Contains(msg, \"AccessDenied\"),\n\t\tstrings.Contains(msg, \"not authorized to invoke this API operation\"):\n\t\treturn fmt.Errorf(\"bedrock denied access to model %q (%s): %w\\n\"+\n\t\t\t\"  credentials resolved, so this is an authorization gap: the identity needs bedrock:InvokeModel on this model in this region, and the account needs model access enabled for it\", model, where, err)\n\t}\n\t// Everything else — ValidationException on max_tokens, a network reset, a\n\t// throttle — keeps the service's own wording. Guessing at a cause here would\n\t// send people after the wrong problem, which is the failure this function\n\t// exists to prevent.\n\treturn fmt.Errorf(\"bedrock request failed (%s): %w\", where, err)\n}\n\nfunc listProfilesRegionArg(region string) string {\n\tif region == \"\" {\n\t\treturn \"\"\n\t}\n\treturn \" --region \" + region\n}\n\n// anthropicThinkingBudgetTokens extracts budget_tokens from an\n// extra_body.thinking map. Returns ok=false for unrecognized shapes.\nfunc anthropicThinkingBudgetTokens(v any) (int64, bool) {\n\tm, ok := v.(map[string]any)\n\tif !ok {\n\t\treturn 0, false\n\t}\n\tswitch n := m[\"budget_tokens\"].(type) {\n\tcase float64:","sourceCodeStart":1120,"sourceCodeEnd":1156,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/internal/llm/client.go#L1120-L1156","documentation":"Bedrock request wrapper that preserves the service's own error wording. It only rewrites the message when diagnostics indicate a credentials or authorization gap (no credentials resolved, or an access-denied class of failure); in that case it explains that the identity needs bedrock:InvokeModel on the model in that region and that model access must be enabled for the account. Everything else (ValidationException, network reset, throttling) is wrapped verbatim so developers chase the real cause instead of a guess.","triggerScenarios":"Any call through the Bedrock LLM client whose InvokeModel/Converse request returns an error from the AWS SDK — auth failures, ValidationException (e.g. max_tokens too large), throttling, and network resets.","commonSituations":"Missing or expired AWS credentials; IAM role/policy lacking bedrock:InvokeModel; model access not enabled in the Bedrock console for that model/region; wrong region configured; max_tokens violating model limits; transient network failures.","solutions":["Check the wrapped (%w) inner error to identify the underlying AWS failure class","If it is an authorization/access-denied error: grant the identity bedrock:InvokeModel on the model ARN in that region and enable model access for the account in the Bedrock console","Verify AWS credentials are valid (aws sts get-caller-identity) and the correct profile/env vars are set","Confirm the configured region matches where the model is available and model access is enabled","For ValidationException, fix the offending parameter (e.g. reduce max_tokens); for throttling, back off and retry"],"exampleFix":"// before\nmodel: \"anthropic.claude-3-sonnet-v1\" // no model access in this account/region\n// after\n// enable model access in Bedrock console, then use the correct regional model ID\nmodel: \"anthropic.claude-3-5-sonnet-20240620-v1:0\" // region: us-east-1","handlingStrategy":"try-catch","validationCode":"// pre-check credentials before invoking\nif err := exec.Command(\"aws\", \"sts\", \"get-caller-identity\").Run(); err != nil {\n\t// credentials broken; fix before calling Bedrock\n}","typeGuard":"func isAccessDenied(err error) bool {\n\tvar ae smithy.APIError\n\treturn errors.As(err, &ae) && ae.ErrorCode() == \"AccessDeniedException\"\n}","tryCatchPattern":"if err != nil {\n\tvar ae smithy.APIError\n\tif errors.As(err, &ae) && ae.ErrorCode() == \"AccessDeniedException\" {\n\t\t// fix IAM policy (bedrock:InvokeModel on this model ARN) and enable model access\n\t}\n\treturn fmt.Errorf(\"bedrock invoke: %w\", err)\n}","preventionTips":["Grant bedrock:InvokeModel on the exact model ARN in your IAM policy","Enable model access in the Bedrock console for each region you use","Validate credentials with aws sts get-caller-identity at startup","Pin the region and confirm the model ID exists there"],"tags":["aws","bedrock","authentication","network"],"backgroundTag":"aws-bedrock-access-denied","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}