{"record":{"id":"8a5c7b4b064f0879","repo":"JuliusBrussee/caveman","slug":"bedrock-mantle-region-q-is-not-on-the-allowlist","errorCode":null,"errorMessage":"bedrock Mantle region %q is not on the allowlist","messagePattern":"bedrock Mantle region %q is not on the allowlist","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/providers/bedrock/routing.go","lineNumber":186,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"bedrock region %q is not on the allowlist\", region)\n\t\t}\n\t\tmodelID, action := parseModelPath(req.URL.Path)\n\t\tif modelID == \"\" || action == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"bedrock request path %q does not name a model and action\", req.URL.Path)\n\t\t}\n\t\tif !actionAllowed(action) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock action %q is not allowed\", action)\n\t\t}\n\t\tif !modelAllowed(modelID) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock model %q is not on the allowlist\", modelID)\n\t\t}\n\t\tbase.Path = strings.TrimRight(base.Path, \"/\") + strings.TrimPrefix(req.URL.Path, \"/bedrock\")\n\tcase endpointMantle:\n\t\tif !env.Bool(\"CAVE_BEDROCK_MANTLE_ENABLED\", false) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock Mantle endpoint is not enabled\")\n\t\t}\n\t\tif !MantleRegionAllowed(region) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock Mantle region %q is not on the allowlist\", region)\n\t\t}\n\t\tif !mantleActionAllowed(req.URL.Path) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock Mantle path %q is not allowed\", req.URL.Path)\n\t\t}\n\t\tbase, err = resolveMantleBase(base, region)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tbase.Path = strings.TrimRight(base.Path, \"/\") + strings.TrimPrefix(req.URL.Path, \"/bedrock\")\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"bedrock request path %q is not allowed\", req.URL.Path)\n\t}\n\tbase.RawQuery = req.URL.RawQuery\n\n\tif env.IsProduction() {\n\t\tif err := providers.ValidateUpstreamEndpoint(ctx, base, ssrf.ManagedConfig()); err != nil {\n\t\t\treturn nil, err\n\t\t}","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/proxy/providers/bedrock/routing.go#L168-L204","documentation":"Mantle is available only in a narrower set of AWS regions than Bedrock Runtime (defaultMantleRegions follows AWS's endpoint-specific availability list). When a Mantle request's resolved region is not on the Mantle allowlist (built-in list or CAVE_BEDROCK_MANTLE_REGION_ALLOWLIST override, which itself must still pass the base Runtime region allowlist), ResolveUpstreamURL rejects the request.","triggerScenarios":"A POST to /bedrock/anthropic/v1/messages with CAVE_BEDROCK_MANTLE_ENABLED=true where the resolved region (x-cave-aws-region header, endpoint host, or CAVE_BEDROCK_REGION/AWS_REGION env) is not in the Mantle inventory — e.g. ap-east-2, ca-central-1, us-gov-east-1, or any region not in defaultMantleRegions.","commonSituations":"Sending x-cave-aws-region set to a Runtime-only region; CAVE_BEDROCK_REGION pointing at a region where AWS has not launched Mantle; an operator override of CAVE_BEDROCK_MANTLE_REGION_ALLOWLIST (or CAVE_BEDROCK_REGION_ALLOWLIST) accidentally excluding the region in use; assuming Mantle exists wherever Bedrock Runtime does.","solutions":["Check AWS's Mantle region availability and set x-cave-aws-region (or CAVE_BEDROCK_REGION) to a supported Mantle region such as us-east-1, eu-west-1, or ap-northeast-1","If the region genuinely supports Mantle but was excluded by an override, add it to CAVE_BEDROCK_MANTLE_REGION_ALLOWLIST (comma-separated)","Verify CAVE_BEDROCK_REGION_ALLOWLIST has not excluded the region — MantleRegionAllowed also requires the base Runtime allowlist to pass","Alternatively route the request through Bedrock Runtime (/bedrock/model/...) which supports more regions"],"exampleFix":"// before\nPOST /bedrock/anthropic/v1/messages\nx-cave-aws-region: ca-central-1  // not in Mantle inventory -> rejected\n// after\nx-cave-aws-region: us-east-1","handlingStrategy":"validation","validationCode":"mantleRegions := map[string]bool{\"ap-northeast-1\":true,\"ap-south-1\":true,\"ap-southeast-2\":true,\"ap-southeast-3\":true,\"eu-central-1\":true,\"eu-north-1\":true,\"eu-south-1\":true,\"eu-west-1\":true,\"eu-west-2\":true,\"sa-east-1\":true,\"us-east-1\":true,\"us-east-2\":true,\"us-gov-west-1\":true,\"us-west-2\":true}\nif strings.HasPrefix(path, \"/bedrock/anthropic/\") && !mantleRegions[region] {\n\t// pick a Mantle-supported region or use Runtime before sending\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin Mantle traffic to known-supported regions (us-east-1, eu-west-1, ...) in client config","Never assume Mantle availability mirrors Runtime availability; consult the AWS Mantle region list","After overriding CAVE_BEDROCK_MANTLE_REGION_ALLOWLIST, test each region your clients use"],"tags":["bedrock","mantle","region","allowlist"],"backgroundTag":"invalid-argument-value","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}