{"record":{"id":"fa05ce38674234c0","repo":"openai/openai-python","slug":"canonical-amazon-bedrock-endpoints-require-https","errorCode":null,"errorMessage":"Canonical Amazon Bedrock endpoints require HTTPS.","messagePattern":"Canonical Amazon Bedrock endpoints require HTTPS\\.","errorType":"error_code","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":91,"sourceCode":"        return \"runtime\", region\n    return None\n\n\ndef _validate_bedrock_region(region: str | None) -> None:\n    if region is not None and _AWS_REGION.fullmatch(region) is None:\n        raise OpenAIError(\"The Bedrock AWS `region` is invalid. Use a standard AWS region such as `us-east-1`.\")\n\n\ndef _validate_canonical_bedrock_endpoint(\n    base_url: httpx2.URL, *, endpoint: BedrockEndpoint, region: str | None\n) -> None:\n    canonical_endpoint = _parse_bedrock_endpoint_hostname(base_url.host)\n    if canonical_endpoint is None:\n        return\n\n    canonical_family, canonical_region = canonical_endpoint\n    if base_url.scheme != \"https\":\n        raise OpenAIError(\"Canonical Amazon Bedrock endpoints require HTTPS.\")\n    if canonical_family != endpoint:\n        raise OpenAIError(\n            f\"The Bedrock {canonical_family} hostname does not match the selected `{endpoint}` endpoint. \"\n            f\"Set `endpoint='{canonical_family}'` to use this hostname.\"\n        )\n    if region is not None and canonical_region != region:\n        raise OpenAIError(\n            f\"The Bedrock endpoint region `{canonical_region}` does not match the configured AWS region `{region}`.\"\n        )\n\n\ndef _default_bedrock_base_url(endpoint: BedrockEndpoint, region: str) -> httpx2.URL:\n    hostname = (\n        f\"bedrock-runtime.{region}.{_runtime_dns_suffixes(region)[0]}\"\n        if endpoint == \"runtime\"\n        else f\"bedrock-mantle.{region}.api.aws\"\n    )\n    return _normalize_base_url(f\"https://{hostname}/openai/v1\")","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L73-L109","documentation":"When the configured base_url host resolves to a canonical Amazon Bedrock endpoint (bedrock-runtime.*.amazonaws.com and friends), the provider enforces HTTPS because AWS SigV4 signing and bearer auth over plain HTTP would leak credentials. A non-https scheme on such a host raises this error.","triggerScenarios":"Setting `base_url=\"http://bedrock-runtime.us-east-1.amazonaws.com\"` (or httpx2 URL with scheme http) while using the bedrock provider.","commonSituations":"Local debugging leftover switching scheme to http; a proxy rewrites URL to http; constructing the URL manually with the wrong scheme.","solutions":["Use https:// for any amazonaws.com Bedrock hostname.","If you genuinely need http (local mock), use a non-canonical hostname so the canonical-endpoint check is skipped."],"exampleFix":"// before\nprovider = bedrock(region=\"us-east-1\", base_url=\"http://bedrock-runtime.us-east-1.amazonaws.com\")\n\n// after\nprovider = bedrock(region=\"us-east-1\", base_url=\"https://bedrock-runtime.us-east-1.amazonaws.com\")","handlingStrategy":"validation","validationCode":"from httpx2 import URL\nu = URL(base_url)\nif u.host and u.host.endswith(\".amazonaws.com\") and u.scheme != \"https\":\n    base_url = str(u.copy_with(scheme=\"https\"))","typeGuard":"def is_safe_bedrock_url(base_url: str) -> bool:\n    u = URL(base_url)\n    return not (u.host and u.host.endswith(\".amazonaws.com\")) or u.scheme == \"https\"","tryCatchPattern":"try:\n    provider = bedrock(base_url=base_url, region=region)\nexcept OpenAIError as e:\n    if \"HTTPS\" in str(e):\n        provider = bedrock(base_url=base_url.replace(\"http://\", \"https://\"), region=region)\n    else:\n        raise","preventionTips":["Default to https when constructing AWS endpoints programmatically.","Never downgrade scheme for 'debugging' against amazonaws.com hosts.","Lint config files for http://*.amazonaws.com URLs."],"tags":["bedrock","aws","https","tls"],"backgroundTag":"https-required-endpoint","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}