{"record":{"id":"76c0e87c64bf7955","repo":"JuliusBrussee/caveman","slug":"bedrock-region-q-is-not-on-the-allowlist","errorCode":null,"errorMessage":"bedrock region %q is not on the allowlist","messagePattern":"bedrock region %q is not on the allowlist","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/providers/bedrock/routing.go","lineNumber":168,"sourceCode":"\t\tbaseURL = route.BaseURL\n\t}\n\tbase, err := url.Parse(baseURL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"bedrock base url invalid: %w\", err)\n\t}\n\tregion, err := resolveRegion(req, base)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tkind := endpointKindForPath(req.URL.Path)\n\tif configuredKind := strings.ToLower(strings.TrimSpace(route.EndpointKind)); configuredKind != \"\" && configuredKind != kind {\n\t\treturn nil, fmt.Errorf(\"bedrock configured endpoint kind %q does not allow request kind %q\", configuredKind, kind)\n\t}\n\tswitch kind {\n\tcase endpointRuntime:\n\t\tif !RegionAllowed(region) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock region %q is not on the allowlist\", region)\n\t\t}\n\t\tmodelID, action := parseModelPath(req.URL.Path)\n\t\tif modelID == \"\" || action == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"bedrock request path %q does not name a model and action\", req.URL.Path)\n\t\t}\n\t\tif !actionAllowed(action) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock action %q is not allowed\", action)\n\t\t}\n\t\tif !modelAllowed(modelID) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock model %q is not on the allowlist\", modelID)\n\t\t}\n\t\tbase.Path = strings.TrimRight(base.Path, \"/\") + strings.TrimPrefix(req.URL.Path, \"/bedrock\")\n\tcase endpointMantle:\n\t\tif !env.Bool(\"CAVE_BEDROCK_MANTLE_ENABLED\", false) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock Mantle endpoint is not enabled\")\n\t\t}\n\t\tif !MantleRegionAllowed(region) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock Mantle region %q is not on the allowlist\", region)","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/proxy/providers/bedrock/routing.go#L150-L186","documentation":"Bedrock Runtime requests are validated against a region allowlist (built-in list of AWS Bedrock regions, overridable via CAVE_BEDROCK_REGION_ALLOWLIST). The resolved region — from the endpoint host, x-cave-aws-region header, or environment — is not on the list, so the request is refused before signing.","triggerScenarios":"A /bedrock/model/... request whose resolved region (bedrock-runtime.<region>.amazonaws.com host, x-cave-aws-region header, or CAVE_BEDROCK_REGION/AWS_REGION/AWS_DEFAULT_REGION fallback) is not in the effective allowlist — e.g. a newly launched region or us-iso-*, or a region removed by a custom CAVE_BEDROCK_REGION_ALLOWLIST.","commonSituations":"AWS launching a new region not yet in the default list; an operator narrowing the allowlist but clients still targeting old regions; ambient AWS_REGION set to a region Bedrock does not serve; GovCloud/China partition regions outside the list.","solutions":["Target an allowlisted Bedrock region (e.g. us-east-1, us-west-2, eu-west-1).","If the region is genuinely available, add it via CAVE_BEDROCK_REGION_ALLOWLIST (comma-separated).","Set x-cave-aws-region or CAVE_BEDROCK_REGION explicitly to the intended region so an ambient AWS_REGION is not picked up.","Verify the configured endpoint host encodes the region you expect."],"exampleFix":"// before\nexport AWS_REGION=us-iso-east-1\n// after\nexport CAVE_BEDROCK_REGION=us-east-1","handlingStrategy":"validation","validationCode":"region := os.Getenv(\"CAVE_BEDROCK_REGION\")\nif region == \"\" {\n\tregion = os.Getenv(\"AWS_REGION\")\n}\nallowed := []string{\"us-east-1\", \"us-west-2\", \"eu-west-1\" /* ... */}\nif !slices.Contains(allowed, region) {\n\treturn fmt.Errorf(\"region %q not on bedrock allowlist\", region)\n}","typeGuard":null,"tryCatchPattern":"// Go\nif _, err := adapter.ResolveUpstreamURL(ctx, req, route); err != nil {\n\tif strings.Contains(err.Error(), \"is not on the allowlist\") {\n\t\t// configuration/allowlist problem: surface to operator, no retry\n\t\treturn fmt.Errorf(\"bedrock routing rejected: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Set CAVE_BEDROCK_REGION explicitly so ambient AWS_REGION does not select an unlisted region.","When AWS launches new regions you use, extend CAVE_BEDROCK_REGION_ALLOWLIST.","Keep endpoint hosts region-consistent with the x-cave-aws-region header."],"tags":["bedrock","aws","region","allowlist","config"],"backgroundTag":"invalid-config-value","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}