{"record":{"id":"f4a3eb8afaed09a5","repo":"alibaba/open-code-review","slug":"bedrock-rejected-model-q-s-w-run-aws-bedr","errorCode":null,"errorMessage":"bedrock rejected model %q (%s): %w\n  run `aws bedrock list-inference-profiles%s` to see what this account offers — IDs are account- and region-scoped, and a version suffix such as -v1:0 is invalid for the newer families","messagePattern":"bedrock rejected model %q \\((.+?)\\): %w\n  run `aws bedrock list-inference-profiles(.+?)` to see what this account offers — IDs are account- and region-scoped, and a version suffix such as -v1:0 is invalid for the newer families","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/llm/client.go","lineNumber":1116,"sourceCode":"\t// answers both \"your IAM policy forbids this\" and \"this account has not\n\t// enabled the model\" with AccessDeniedException, and the fixes have nothing\n\t// in common. The specific wording is matched before the generic code.\n\tswitch {\n\t// First: the bearer-token path produces this even when credentials are\n\t// otherwise valid, so a later \"denied\" branch would mislabel it.\n\tcase strings.Contains(msg, \"Invalid API Key format\"):\n\t\tif os.Getenv(\"AWS_BEARER_TOKEN_BEDROCK\") != \"\" {\n\t\t\treturn fmt.Errorf(\"bedrock rejected the token in AWS_BEARER_TOKEN_BEDROCK (%s): %w\\n\"+\n\t\t\t\t\"  unset that variable to sign requests with SigV4 instead\", where, err)\n\t\t}\n\t\treturn fmt.Errorf(\"bedrock rejected an API-key header rather than a signature (%s): %w\\n\"+\n\t\t\t\"  no api_key applies to bedrock; this means a bearer token reached the request, not that a key is missing\", where, err)\n\tcase strings.Contains(msg, \"don't have access to the model\"):\n\t\treturn fmt.Errorf(\"bedrock has no access enabled for model %q (%s): %w\\n\"+\n\t\t\t\"  model access is granted per account and per region in the Bedrock console; an IAM policy alone does not enable it\", model, where, err)\n\tcase strings.Contains(msg, \"model identifier is invalid\"),\n\t\tstrings.Contains(msg, \"inference profile\") && strings.Contains(msg, \"not found\"):\n\t\treturn fmt.Errorf(\"bedrock rejected model %q (%s): %w\\n\"+\n\t\t\t\"  run `aws bedrock list-inference-profiles%s` to see what this account offers — IDs are account- and region-scoped, and a version suffix such as -v1:0 is invalid for the newer families\",\n\t\t\tmodel, where, err, listProfilesRegionArg(c.awsRegion))\n\t// Specific credential codes only. A bare \"expired\" would also claim an\n\t// expired TLS certificate is an SSO problem.\n\tcase strings.Contains(msg, \"ExpiredToken\"), strings.Contains(msg, \"ExpiredTokenException\"),\n\t\tstrings.Contains(msg, \"SSOProviderInvalidToken\"), strings.Contains(msg, \"InvalidGrantException\"),\n\t\tstrings.Contains(msg, \"NoCredentialProviders\"), strings.Contains(msg, \"failed to refresh cached credentials\"):\n\t\treturn fmt.Errorf(\"bedrock could not authenticate: AWS credentials are expired or unavailable (%s): %w\\n\"+\n\t\t\t\"  run `aws sso login%s`, or refresh whichever credential source this profile uses\", where, err, ssoLoginProfileArg(c.awsProfile))\n\t// \"not authorized to invoke this API operation\" is IAM's own wording, so it\n\t// belongs here rather than in the model-access branch above: the fix is a\n\t// policy change, not a console toggle.\n\tcase strings.Contains(msg, \"AccessDenied\"),\n\t\tstrings.Contains(msg, \"not authorized to invoke this API operation\"):\n\t\treturn fmt.Errorf(\"bedrock denied access to model %q (%s): %w\\n\"+\n\t\t\t\"  credentials resolved, so this is an authorization gap: the identity needs bedrock:InvokeModel on this model in this region, and the account needs model access enabled for it\", model, where, err)\n\t}\n\t// Everything else — ValidationException on max_tokens, a network reset, a","sourceCodeStart":1098,"sourceCodeEnd":1134,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/internal/llm/client.go#L1098-L1134","documentation":"explainError (internal/llm/client.go:1116) matches 'model identifier is invalid' and inference-profile-not-found rejections. These are misleading service wordings: usually the model ID does not exist in the selected region/account, an inference profile is region-scoped and not found, or a version suffix like -v1:0 was appended to a model family that forbids it. The rewrite points at `aws bedrock list-inference-profiles` to see valid IDs.","triggerScenarios":"Passing a model ID with an invalid form (e.g. anthropic.claude-3-5-sonnet-v1:0), using a global/cross-region inference profile ID unavailable in the current region, or a model name typo'd or from a newer release than the deployed Bedrock API knows.","commonSituations":"Copy-pasting a model ID from Anthropic docs that differs from the Bedrock ID scheme; hard-coding a -v1:0 suffix; using a US inference profile from a non-US region; region string wrong so the profile lookup fails.","solutions":["Run `aws bedrock list-inference-profiles` (add the region arg this message suggests) and copy an exact ID from the output","Remove version suffixes like -v1:0 from newer model family IDs","Check the model is offered in your region — IDs are account- and region-scoped; try a standard region like us-east-1","Correct the model string in your tool config against AWS's Bedrock model ID documentation"],"exampleFix":"// before\n\"model\": \"anthropic.claude-sonnet-4-20250514-v1:0\"\n// after\n\"model\": \"us.anthropic.claude-sonnet-4-20250514\"  # from list-inference-profiles output","handlingStrategy":"validation","validationCode":"out, err := exec.Command(\"aws\", \"bedrock\", \"list-inference-profiles\",\n    \"--region\", region).Output()\nif err != nil || !strings.Contains(string(out), modelID) {\n    return fmt.Errorf(\"model %q not among this account's inference profiles in %s\", modelID, region)\n}","typeGuard":null,"tryCatchPattern":"_, err := cl.Call(ctx, messages)\nif err != nil && strings.Contains(err.Error(), \"rejected model\") {\n    return fmt.Errorf(\"verify the exact ID via `aws bedrock list-inference-profiles`: %w\", err)\n}","preventionTips":["Copy model IDs directly from list-inference-profiles output, not from provider docs","Never append -v1:0 suffixes to newer model family IDs","Use region-prefixed inference profile IDs (us.anthropic.*) for cross-region inference","Keep the model ID in config reviewed when upgrading model versions"],"tags":["aws","bedrock","model-id","configuration"],"backgroundTag":"invalid-model-identifier","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}