{"record":{"id":"c8d9b699869f8a44","repo":"openai/openai-python","slug":"the-bedrock-endpoint-region-canonical-region-d","errorCode":null,"errorMessage":"The Bedrock endpoint region `{canonical_region}` does not match the configured AWS region `{region}`.","messagePattern":"The Bedrock endpoint region `(.+?)` does not match the configured AWS region `(.+?)`\\.","errorType":"error_code","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":98,"sourceCode":"\n\ndef _validate_canonical_bedrock_endpoint(\n    base_url: httpx2.URL, *, endpoint: BedrockEndpoint, region: str | None\n) -> None:\n    canonical_endpoint = _parse_bedrock_endpoint_hostname(base_url.host)\n    if canonical_endpoint is None:\n        return\n\n    canonical_family, canonical_region = canonical_endpoint\n    if base_url.scheme != \"https\":\n        raise OpenAIError(\"Canonical Amazon Bedrock endpoints require HTTPS.\")\n    if canonical_family != endpoint:\n        raise OpenAIError(\n            f\"The Bedrock {canonical_family} hostname does not match the selected `{endpoint}` endpoint. \"\n            f\"Set `endpoint='{canonical_family}'` to use this hostname.\"\n        )\n    if region is not None and canonical_region != region:\n        raise OpenAIError(\n            f\"The Bedrock endpoint region `{canonical_region}` does not match the configured AWS region `{region}`.\"\n        )\n\n\ndef _default_bedrock_base_url(endpoint: BedrockEndpoint, region: str) -> httpx2.URL:\n    hostname = (\n        f\"bedrock-runtime.{region}.{_runtime_dns_suffixes(region)[0]}\"\n        if endpoint == \"runtime\"\n        else f\"bedrock-mantle.{region}.api.aws\"\n    )\n    return _normalize_base_url(f\"https://{hostname}/openai/v1\")\n\n\ndef _same_origin(left: httpx2.URL, right: httpx2.URL) -> bool:\n    return (left.scheme, left.host, left.port) == (right.scheme, right.host, right.port)\n\n\ndef _body_for_signing(request: httpx2.Request) -> bytes:","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L80-L116","documentation":"The region embedded in the canonical Bedrock hostname (e.g. `us-west-2` in bedrock-runtime.us-west-2.amazonaws.com) does not equal the region you configured via `region`/environment. SigV4 signing and bearer scoping are region-specific, so the provider refuses the mismatch rather than signing for the wrong region.","triggerScenarios":"Passing `region=\"us-east-1\"` together with `base_url=\"https://bedrock-runtime.us-west-2.amazonaws.com\"`.","commonSituations":"Hardcoded base_url from another account/region; AWS_REGION env var disagreeing with the URL pasted into code; cross-region migration leaving stale URLs.","solutions":["Make region match the hostname's region (or omit region and let it default).","Update base_url to the hostname in your configured region."],"exampleFix":"// before\nprovider = bedrock(region=\"us-east-1\", base_url=\"https://bedrock-runtime.us-west-2.amazonaws.com\")\n\n// after\nprovider = bedrock(region=\"us-west-2\", base_url=\"https://bedrock-runtime.us-west-2.amazonaws.com\")","handlingStrategy":"validation","validationCode":"import re\nm = re.search(r\"\\.([a-z0-9-]+)\\.amazonaws\\.com$\", URL(base_url).host or \"\")\nhost_region = m.group(1) if m else None\nif host_region and region and host_region != region:\n    region = host_region  # or fail fast with a clear message","typeGuard":"def region_matches_host(region: str | None, base_url: str) -> bool:\n    m = re.search(r\"\\.([a-z0-9-]+)\\.amazonaws\\.com$\", URL(base_url).host or \"\")\n    return m is None or region is None or m.group(1) == region","tryCatchPattern":"try:\n    provider = bedrock(region=region, base_url=base_url)\nexcept OpenAIError as e:\n    if \"does not match the configured AWS region\" in str(e):\n        import re\n        host_region = re.search(r\"`([a-z0-9-]+)` does not match\", str(e)).group(1)\n        provider = bedrock(region=host_region, base_url=base_url)\n    else:\n        raise","preventionTips":["Generate base_url from the same region variable passed to bedrock().","Avoid hardcoding region-specific URLs; build them with f-strings from one region constant.","Run config-consistency checks in CI."],"tags":["bedrock","aws","region","config"],"backgroundTag":"region-mismatch","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}