openai/openai-python · error · OpenAIError

Canonical Amazon Bedrock endpoints require HTTPS.

Error message

Canonical Amazon Bedrock endpoints require HTTPS.

What it means

When the configured base_url host resolves to a canonical Amazon Bedrock endpoint (bedrock-runtime.*.amazonaws.com and friends), the provider enforces HTTPS because AWS SigV4 signing and bearer auth over plain HTTP would leak credentials. A non-https scheme on such a host raises this error.

Source

Thrown at src/openai/providers/bedrock.py:91

        return "runtime", region
    return None


def _validate_bedrock_region(region: str | None) -> None:
    if region is not None and _AWS_REGION.fullmatch(region) is None:
        raise OpenAIError("The Bedrock AWS `region` is invalid. Use a standard AWS region such as `us-east-1`.")


def _validate_canonical_bedrock_endpoint(
    base_url: httpx2.URL, *, endpoint: BedrockEndpoint, region: str | None
) -> None:
    canonical_endpoint = _parse_bedrock_endpoint_hostname(base_url.host)
    if canonical_endpoint is None:
        return

    canonical_family, canonical_region = canonical_endpoint
    if base_url.scheme != "https":
        raise OpenAIError("Canonical Amazon Bedrock endpoints require HTTPS.")
    if canonical_family != endpoint:
        raise OpenAIError(
            f"The Bedrock {canonical_family} hostname does not match the selected `{endpoint}` endpoint. "
            f"Set `endpoint='{canonical_family}'` to use this hostname."
        )
    if region is not None and canonical_region != region:
        raise OpenAIError(
            f"The Bedrock endpoint region `{canonical_region}` does not match the configured AWS region `{region}`."
        )


def _default_bedrock_base_url(endpoint: BedrockEndpoint, region: str) -> httpx2.URL:
    hostname = (
        f"bedrock-runtime.{region}.{_runtime_dns_suffixes(region)[0]}"
        if endpoint == "runtime"
        else f"bedrock-mantle.{region}.api.aws"
    )
    return _normalize_base_url(f"https://{hostname}/openai/v1")

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Use https:// for any amazonaws.com Bedrock hostname.
2. If you genuinely need http (local mock), use a non-canonical hostname so the canonical-endpoint check is skipped.

Example fix

// before
provider = bedrock(region="us-east-1", base_url="http://bedrock-runtime.us-east-1.amazonaws.com")

// after
provider = bedrock(region="us-east-1", base_url="https://bedrock-runtime.us-east-1.amazonaws.com")

from httpx2 import URL
u = URL(base_url)
if u.host and u.host.endswith(".amazonaws.com") and u.scheme != "https":
    base_url = str(u.copy_with(scheme="https"))

def is_safe_bedrock_url(base_url: str) -> bool:
    u = URL(base_url)
    return not (u.host and u.host.endswith(".amazonaws.com")) or u.scheme == "https"

try:
    provider = bedrock(base_url=base_url, region=region)
except OpenAIError as e:
    if "HTTPS" in str(e):
        provider = bedrock(base_url=base_url.replace("http://", "https://"), region=region)
    else:
        raise

When it happens

Trigger: Setting `base_url="http://bedrock-runtime.us-east-1.amazonaws.com"` (or httpx2 URL with scheme http) while using the bedrock provider.

Common situations: Local debugging leftover switching scheme to http; a proxy rewrites URL to http; constructing the URL manually with the wrong scheme.

Related errors

• Could not find credentials for Bedrock. Set `AWS_BEARER_TOKE
• Pass refreshable Bedrock credentials via `bedrock_token_prov
• Bedrock authentication is ambiguous. Configure exactly one e
• The Bedrock AWS `region` is invalid. Use a standard AWS regi
• The Bedrock {canonical_family} hostname does not match the s

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/fa05ce38674234c0. Report an issue: GitHub.