mem0ai/mem0 · critical · ValueError

Unauthorized access to Bedrock. Please ensure your AWS crede

Error message

Unauthorized access to Bedrock. Please ensure your AWS credentials have permission to access Bedrock in region {self.config.aws_region}.

What it means

Raised when the initial Bedrock handshake (list_foundation_models via the bedrock client) returns ClientError with code UnauthorizedOperation: credentials resolved fine, but the identity lacks IAM permission for bedrock:ListFoundationModels (and by extension Bedrock access). Mem0 converts it to ValueError at LLM init so the permission gap fails fast.

Source

Thrown at mem0/llms/aws_bedrock.py:102

        """Initialize AWS Bedrock client with proper credentials."""
        try:
            aws_config = self.config.get_aws_config()

            # Create Bedrock runtime client
            self.client = boto3.client("bedrock-runtime", **aws_config)

            # Test connection
            self._test_connection()

        except NoCredentialsError:
            raise ValueError(
                "AWS credentials not found. Please set AWS_ACCESS_KEY_ID, "
                "AWS_SECRET_ACCESS_KEY, and AWS_REGION environment variables, "
                "or provide them in the config."
            )
        except ClientError as e:
            if e.response["Error"]["Code"] == "UnauthorizedOperation":
                raise ValueError(
                    f"Unauthorized access to Bedrock. Please ensure your AWS credentials "
                    f"have permission to access Bedrock in region {self.config.aws_region}."
                )
            else:
                raise ValueError(f"AWS Bedrock error: {e}")

    def _test_connection(self):
        """Test connection to AWS Bedrock service."""
        try:
            # List available models to test connection
            bedrock_client = boto3.client("bedrock", **self.config.get_aws_config())
            response = bedrock_client.list_foundation_models()
            self.available_models = [model["modelId"] for model in response["modelSummaries"]]

            # Check if our model is available
            if self.config.model not in self.available_models:
                logger.warning(f"Model {self.config.model} may not be available in region {self.config.aws_region}")
                logger.info(f"Available models: {', '.join(self.available_models[:5])}...")

View on GitHub (pinned to 001c235229)

Solutions

1. Attach an IAM policy allowing bedrock:InvokeModel AND bedrock:ListFoundationModels on * (or at least the region's resources) to the user/role
2. If ListFoundationModels cannot be granted, contribute/use a config path that skips the connection test or use the standard OpenAI-compatible Bedrock proxy
3. Check region: the policy must cover the region in the error message; enable model access in Bedrock console for the account
4. For SCP-blocked accounts, ask the admin to allowlist bedrock in that region

Example fix

// before
# IAM policy with only InvokeModel -> ValueError at init

# after
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["bedrock:InvokeModel", "bedrock:ListFoundationModels"],
    "Resource": "*"
  }]
}

# preflight: verify the identity can use Bedrock before mem0 init
import boto3
client = boto3.client("bedrock", region_name="us-east-1")
try:
    client.list_foundation_models()
except client.exceptions.AccessDeniedException:
    raise SystemExit("IAM policy must allow bedrock:ListFoundationModels and bedrock:InvokeModel")

try:
    llm = AWSBedrockLLM(config)
except ValueError as e:
    if "Unauthorized access to Bedrock" in str(e):
        # permissions issue: do not retry, fix IAM first
        raise PermissionsError(str(e)) from e
    raise

When it happens

Trigger: IAM user/role with credentials but no Bedrock policy attached; SCP or permissions boundary denying bedrock:*; using a policy that grants only bedrock:InvokeModel — the connection test additionally calls ListFoundationModels, which must also be allowed

Common situations: Least-privilege policies granting InvokeModel only; corporate SCPs blocking Bedrock in the account/region; new team member with read-only AWS access trying mem0.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• AWS credentials not found. Please set AWS_ACCESS_KEY_ID, AWS
• The 'boto3' library is required. Please install it using 'pi
• Unknown provider_override '{explicit_provider}'. Valid provi
• Unknown provider in model: {model}
• AWS Bedrock error: {e}

AI-assisted analysis of mem0ai/mem0@001c235229 (2026-08-15). Data as JSON: /api/errors/032c038a320f4473. Report an issue: GitHub.