{"record":{"id":"508fce7c1acc1d26","repo":"BerriAI/litellm","slug":"invalid-region-in-arn-batch-id","errorCode":null,"errorMessage":"Invalid region in ARN: {batch_id}","messagePattern":"Invalid region in ARN: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/llms/bedrock/batches/transformation.py","lineNumber":385,"sourceCode":"            litellm_params: LiteLLM parameters\n\n        Returns:\n            Transformed request data for Bedrock GetModelInvocationJob API\n        \"\"\"\n        # For Bedrock, batch_id should be the full job ARN\n        # The GetModelInvocationJob API expects the full ARN as the identifier\n        if not batch_id.startswith(\"arn:aws:bedrock:\"):\n            raise ValueError(f\"Invalid batch_id format. Expected ARN, got: {batch_id}\")\n\n        # Extract the job identifier from the ARN - use the full ARN path part\n        # ARN format: arn:aws:bedrock:region:account:model-invocation-job/job-name\n        arn_parts: Final = batch_id.split(\":\")\n        if len(arn_parts) < 6:\n            raise ValueError(f\"Invalid ARN format: {batch_id}\")\n\n        region: Final = arn_parts[3]\n        if not re.match(r\"^[a-z][a-z0-9-]*$\", region):\n            raise ValueError(f\"Invalid region in ARN: {batch_id}\")\n\n        # Build the endpoint URL for GetModelInvocationJob\n        # AWS API format: GET /model-invocation-job/{jobIdentifier}\n        # Use the FULL ARN as jobIdentifier and URL-encode it (includes ':' and '/')\n        import urllib.parse as _ul\n\n        encoded_arn: Final = _ul.quote(batch_id, safe=\"\")\n        endpoint_url: Final = f\"https://bedrock.{region}.amazonaws.com/model-invocation-job/{encoded_arn}\"\n\n        # Use common utility for AWS signing\n        request_params: Final = merge_bedrock_aws_request_params(litellm_params, optional_params)\n        signed_headers, _ = self.common_utils.sign_aws_request(\n            service_name=\"bedrock\",\n            data={},  # GET request has no body\n            endpoint_url=endpoint_url,\n            optional_params=request_params,\n            method=\"GET\",\n        )","sourceCodeStart":367,"sourceCodeEnd":403,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/llms/bedrock/batches/transformation.py#L367-L403","documentation":"Thrown by LiteLLM's Bedrock batch retrieval (get_batch) before any HTTP call is made. The batch_id must be the full model-invocation-job ARN returned by the create-batch call; the code splits it on ':' and validates field 4 (the region) against the regex ^[a-z][a-z0-9-]*$. If the region slot is empty or malformed, the lookup is rejected with this ValueError so no request is signed against a bogus endpoint.","triggerScenarios":"Calling litellm.batch_get/aget_batch with provider=\"bedrock\" and a batch_id whose ARN region slot is empty (arn:aws:bedrock:::model-invocation-job/x — leftover colons), starts with a digit or underscore, contains uppercase letters (arn:aws:bedrock:US-West-2:...), or where a hand-assembled ARN put a non-region value in position 3.","commonSituations":"Hand-templating the ARN instead of copying jobArn from the create-batch response; string surgery that drops the region; environment-variable templates with an empty {region}; migrating batch ids from another system that stored short job names or partial ARNs.","solutions":["Pass the exact jobArn returned by the create-batch call (the id on LiteLLM's Batch object) — treat it as an opaque string, do not reconstruct it","If you must build the ARN, verify all 6+ colon fields are present and the region is lowercase letters/digits/hyphens starting with a letter (e.g. us-west-2)","Log the batch_id immediately before the call and diff it against the ARN shown in the AWS Bedrock console under Model invocation jobs","If the id came from an older LiteLLM create response that returned a short id, re-create the batch or upgrade LiteLLM so retrieval uses the ARN form"],"exampleFix":"// before\nbatch_id = \"arn:aws:bedrock:::model-invocation-job/inference-170\"\nresult = litellm.batch_get(provider=\"bedrock\", batch_id=batch_id)\n\n// after\nbatch_id = \"arn:aws:bedrock:us-west-2:123456789012:model-invocation-job/inference-170\"\nresult = litellm.batch_get(provider=\"bedrock\", batch_id=batch_id)","handlingStrategy":"validation","validationCode":"import re\n\nBATCH_ARN_RE = re.compile(r\"^arn:aws:bedrock:[a-z][a-z0-9-]*:\\d{12}:model-invocation-job/.+$\")\n\nif not BATCH_ARN_RE.match(batch_id):\n    raise ValueError(f\"Refusing to call batch_get: malformed ARN {batch_id!r}\")\nresult = litellm.batch_get(provider=\"bedrock\", batch_id=batch_id)","typeGuard":"def is_valid_bedrock_batch_arn(batch_id: str) -> bool:\n    \"\"\"True only for well-formed Bedrock model-invocation-job ARNs.\"\"\"\n    return bool(re.match(r\"^arn:aws:bedrock:[a-z][a-z0-9-]*:\\d{12}:model-invocation-job/.+$\", batch_id))","tryCatchPattern":"try:\n    result = litellm.batch_get(provider=\"bedrock\", batch_id=batch_id)\nexcept ValueError as e:\n    if \"Invalid region in ARN\" in str(e):\n        raise ConfigError(f\"Stored batch id is not a valid ARN: {batch_id!r}\") from e\n    raise","preventionTips":["Persist the jobArn returned by create_batch verbatim and treat it as an opaque string","Never assemble job ARNs via string templating","Add a unit test asserting every stored batch id matches arn:aws:bedrock:<region>:<account>:model-invocation-job/<name>"],"tags":["bedrock","batch","arn","input-validation","aws"],"backgroundTag":"invalid-arn-format","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}