openai/openai-python · error · OpenAIError

The Bedrock endpoint region `{canonical_region}` does not ma

Error message

The Bedrock endpoint region `{canonical_region}` does not match the configured AWS region `{region}`.

What it means

The region embedded in the canonical Bedrock hostname (e.g. `us-west-2` in bedrock-runtime.us-west-2.amazonaws.com) does not equal the region you configured via `region`/environment. SigV4 signing and bearer scoping are region-specific, so the provider refuses the mismatch rather than signing for the wrong region.

Source

Thrown at src/openai/providers/bedrock.py:98


def _validate_canonical_bedrock_endpoint(
    base_url: httpx2.URL, *, endpoint: BedrockEndpoint, region: str | None
) -> None:
    canonical_endpoint = _parse_bedrock_endpoint_hostname(base_url.host)
    if canonical_endpoint is None:
        return

    canonical_family, canonical_region = canonical_endpoint
    if base_url.scheme != "https":
        raise OpenAIError("Canonical Amazon Bedrock endpoints require HTTPS.")
    if canonical_family != endpoint:
        raise OpenAIError(
            f"The Bedrock {canonical_family} hostname does not match the selected `{endpoint}` endpoint. "
            f"Set `endpoint='{canonical_family}'` to use this hostname."
        )
    if region is not None and canonical_region != region:
        raise OpenAIError(
            f"The Bedrock endpoint region `{canonical_region}` does not match the configured AWS region `{region}`."
        )


def _default_bedrock_base_url(endpoint: BedrockEndpoint, region: str) -> httpx2.URL:
    hostname = (
        f"bedrock-runtime.{region}.{_runtime_dns_suffixes(region)[0]}"
        if endpoint == "runtime"
        else f"bedrock-mantle.{region}.api.aws"
    )
    return _normalize_base_url(f"https://{hostname}/openai/v1")


def _same_origin(left: httpx2.URL, right: httpx2.URL) -> bool:
    return (left.scheme, left.host, left.port) == (right.scheme, right.host, right.port)


def _body_for_signing(request: httpx2.Request) -> bytes:

View on GitHub (pinned to 9917c6e28e)

Solutions

Make region match the hostname's region (or omit region and let it default).
Update base_url to the hostname in your configured region.

Example fix

// before
provider = bedrock(region="us-east-1", base_url="https://bedrock-runtime.us-west-2.amazonaws.com")

// after
provider = bedrock(region="us-west-2", base_url="https://bedrock-runtime.us-west-2.amazonaws.com")

Defensive patterns

Strategy: validation

Validate before calling

import re
m = re.search(r"\.([a-z0-9-]+)\.amazonaws\.com$", URL(base_url).host or "")
host_region = m.group(1) if m else None
if host_region and region and host_region != region:
    region = host_region  # or fail fast with a clear message

Type guard

def region_matches_host(region: str | None, base_url: str) -> bool:
    m = re.search(r"\.([a-z0-9-]+)\.amazonaws\.com$", URL(base_url).host or "")
    return m is None or region is None or m.group(1) == region

Try / catch

try:
    provider = bedrock(region=region, base_url=base_url)
except OpenAIError as e:
    if "does not match the configured AWS region" in str(e):
        import re
        host_region = re.search(r"`([a-z0-9-]+)` does not match", str(e)).group(1)
        provider = bedrock(region=host_region, base_url=base_url)
    else:
        raise

Prevention

Generate base_url from the same region variable passed to bedrock().
Avoid hardcoding region-specific URLs; build them with f-strings from one region constant.
Run config-consistency checks in CI.

When it happens

Trigger: Passing `region="us-east-1"` together with `base_url="https://bedrock-runtime.us-west-2.amazonaws.com"`.

Common situations: Hardcoded base_url from another account/region; AWS_REGION env var disagreeing with the URL pasted into code; cross-region migration leaving stale URLs.

Related errors

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/c8d9b699869f8a44. Report an issue: GitHub.