{"record":{"id":"4c88e9e90a11a002","repo":"openai/openai-python","slug":"the-bedrock-endpoint-region-region-does-not-ma","errorCode":null,"errorMessage":"The Bedrock endpoint region `{region}` does not match the SigV4 region `{self._config.region}`.","messagePattern":"The Bedrock endpoint region `(.+?)` does not match the SigV4 region `(.+?)`\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":221,"sourceCode":"        self._auth = auth\n\n    def _validate_request(self, request: httpx2.Request) -> bytes:\n        _assert_provider_owns_authorization(request)\n        if not _same_origin(request.url, self._base_url):\n            raise OpenAIError(\n                \"Refusing to sign a Bedrock request for an origin other than the configured provider URL.\"\n            )\n\n        canonical_endpoint = _parse_bedrock_endpoint_hostname(request.url.host)\n        if canonical_endpoint is not None:\n            endpoint, region = canonical_endpoint\n            expected_endpoint = \"runtime\" if self._config.service == \"bedrock\" else \"mantle\"\n            if endpoint != expected_endpoint:\n                raise OpenAIError(\n                    f\"The Bedrock {endpoint} hostname does not match the selected `{expected_endpoint}` endpoint.\"\n                )\n            if region != self._config.region:\n                raise OpenAIError(\n                    f\"The Bedrock endpoint region `{region}` does not match the SigV4 region `{self._config.region}`.\"\n                )\n\n        return _body_for_signing(request)\n\n    def _sign(self, request: httpx2.Request, *, auth: BedrockAwsAuth, body: bytes) -> None:\n        for header in _AWS_SIGNING_HEADERS:\n            request.headers.pop(header, None)\n\n        signed_headers = auth.sign(\n            method=request.method,\n            url=str(request.url),\n            headers=dict(request.headers),\n            body=body,\n        )\n        request.headers.clear()\n        request.headers.update(signed_headers)\n","sourceCodeStart":203,"sourceCodeEnd":239,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L203-L239","documentation":"SigV4 validation: the region parsed from the canonical endpoint hostname differs from the region in the SigV4 config (self._config.region). AWS signatures are region-scoped, so signing with the wrong region key yields 403s at AWS; the provider fails fast instead.","triggerScenarios":"bedrock(region=\"us-east-1\") with SigV4 credentials but a request URL host like bedrock-runtime.eu-west-1.amazonaws.com.","commonSituations":"Region env vars out of sync with a hardcoded base_url; copying endpoint URLs across environments; multi-region setups with stale configs.","solutions":["Make the configured region match the hostname region.","Or drop the custom base_url and let the provider build the default hostname for your region."],"exampleFix":"# before\nprovider = bedrock(region=\"us-east-1\", base_url=\"https://bedrock-runtime.eu-west-1.amazonaws.com\")\n\n# after\nprovider = bedrock(region=\"eu-west-1\", base_url=\"https://bedrock-runtime.eu-west-1.amazonaws.com\")","handlingStrategy":"validation","validationCode":"import re\nm = re.search(r\"\\.([a-z0-9-]+)\\.amazonaws\\.com$\", URL(base_url).host or \"\")\nif m and m.group(1) != region:\n    raise ValueError(f\"base_url region {m.group(1)} != configured {region}\")","typeGuard":"def sigv4_region_matches(region: str, base_url: str) -> bool:\n    m = re.search(r\"\\.([a-z0-9-]+)\\.amazonaws\\.com$\", URL(base_url).host or \"\")\n    return m is None or m.group(1) == region","tryCatchPattern":"try:\n    provider = bedrock(region=region, base_url=base_url, aws_credentials=creds)\nexcept OpenAIError as e:\n    if \"SigV4 region\" in str(e):\n        m = re.search(r\"`([a-z0-9-]+)` does not match\", str(e))\n        provider = bedrock(region=m.group(1), base_url=base_url, aws_credentials=creds)\n    else:\n        raise","preventionTips":["Build base_url from the same region used for signing.","Keep one region constant per environment.","Fail fast on config drift in startup checks."],"tags":["bedrock","aws","sigv4","region"],"backgroundTag":"region-mismatch","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}