How do I troubleshoot InvokeModel API errors in Amazon Bedrock?

7 minute read

I want to resolve the AccessDeniedException or ValidationException error that I get when I call the InvokeModel API in Amazon Bedrock.

Resolution

AccessDeniedException and ValidationException errors occur when the InvokeModel API can't access the base model that it's invoking. The errors can also occur if your AWS account doesn't have the required AWS Identity and Access Management (IAM) permissions to run the operation.

Model access errors

Access to Amazon Bedrock foundation models is turned on by default with the correct AWS Marketplace permissions in all commercial AWS Regions.

If you receive an "AccessDeniedException" error, then check that you meet the following prerequisites:

AWS Marketplace permissions
First Time Use (FTU) form for Anthropic models
A valid payment method

For programmatic access to Anthropic models, you must complete the First Time Use (FTU) form before you invoke the model. This requirement doesn't apply to Anthropic models that you access through the bedrock-mantle endpoint. See Manage model access using SDK and CLI.

Note: You might also receive the error "An error occurred (AccessDeniedException) when calling the InvokeModel operation: model is not available for this account." Check whether you have an account-level restriction rather than a model access issue.

IAM permissions errors

If the IAM user or role that invoked the API lacks the required permissions, then you receive an error message similar to the following examples:

"AccessDeniedException: An error occurred (AccessDeniedException) when calling the InvokeModel operation: User: username is not authorized to perform: bedrock:InvokeModel on resource: resourcename with an explicit deny in an identity-based policy."

"AccessDeniedException: An error occurred (AccessDeniedException) when calling the InvokeModel operation: User: username is not authorized to perform: bedrock:InvokeModel on resource: resourcename because no identity-based policy allows the bedrock:InvokeModel action."

To resolve this issue, confirm that the IAM user or role that invokes the API has the following required permissions:

{  "Version": "2012-10-17",
  "Statement": {
    "Sid": "AllowInference",
    "Effect": "Allow",
    "Action": [
      "bedrock:InvokeModel",
      "bedrock:InvokeModelWithResponseStream"
    ],
    "Resource": "arn:aws:bedrock:*::foundation-model/model-id"
  }
}

Your IAM role must also have the aws-marketplace:Subscribe, aws-marketplace:Unsubscribe, and aws-marketplace:ViewSubscriptions permissions. Third-party models are delivered through AWS Marketplace, and Amazon Bedrock uses these permissions to complete the model subscription automatically the first time that you invoke the model. If these permissions are missing, then you receive the following error:

"AccessDeniedException: Model access is denied due to IAM user or service role is not authorized to perform the required AWS Marketplace actions (aws-marketplace:ViewSubscriptions, aws-marketplace:Subscribe) to enable access to this model."

For more information, see Grant IAM permissions to request access to Amazon Bedrock foundation models with a product ID.

Certain models are available only through a cross-Region inference profile. If the policy allows only the foundation model ARN, then invocations that use an inference profile return AccessDeniedException. If you invoke a model through an inference profile, then add the inference profile ARN to the Resource element, as in the following example:

arn:aws:bedrock:*::inference-profile/inference-profile-id

Note: Replace inference-profile-id with the ID of your inference profile resource.

SCP error

If a service control policy (SCP) has specific restrictions on your account, then you receive the following error message:

"User: username is not authorized to perform: bedrock:InvokeModel on resource: resourcename with an explicit deny in a service control policy"

The preceding error occurs even if you provided the required permissions to the IAM role that invoked the API. Typically, this error occurs when you use cross-Region interference that routes the call to an AWS Region that the SCP blocks.

To resolve the issue, check your AWS CloudTrail events for the API call and Region that it's directed to. Then, check whether the SCP restricts actions for that API or Region. Also, check for other SCP restrictions such as the restrictions on a specific model ID.

API action error

Specify bedrock-runtime as a service

If you used the incorrect API action, then you receive the following error message:

"ValidationException: An error occurred (ValidationException) when calling the InvokeModel operation: The requested operation is not recognized by the service."

To resolve the preceding error, specify bedrock-runtime as a service in your API call. For more information, see BedrockRuntime.

Configure model availability

You might also receive the following error messages:

"An error occurred (ValidationException) when calling the InvokeModel operation: The provided model identifier is invalid"

"ResourceNotFoundException: An error occurred (ResourceNotFoundException) when calling the InvokeModel operation: Could not resolve the foundation model from the provided model identifier."

The preceding errors occur because of configuration issues. To troubleshoot this issue, take the following actions:

Confirm that the model is available in the Region where you invoke the API.
Check that the model ID is correct.

Use an inference profile when on-demand throughput isn't supported

Certain models don't support on-demand invocation by their base model ID and must be invoked through a cross-Region inference profile. If you invoke one of these models with the base model ID, then you receive the following error:

"An error occurred (ValidationException) when calling the InvokeModel operation: Invocation of model ID model-id with on-demand throughput isn't supported. Retry your request with the ID or ARN of an inference profile that contains this model."

To resolve this issue, pass the inference profile ID or ARN as the modelId instead of the base model ID. For example, use us.anthropic.claude-3-5-sonnet-20241022-v2:0 instead of anthropic.claude-3-5-sonnet-20241022-v2:0. For more information, see Supported Regions and models for cross-Region inference.

SDK version error

If you use an incompatible AWS SDK for Python (Boto3) version to call the InvokeModel API, then you receive the following error message:

"UnknownServiceError: Unknown service: 'bedrock-runtime"

To resolve this issue, upgrade the SDK to the latest version. To view the latest version of the SDK, see boto3/CHANGELOG.rst on the GitHub website.

Account security restriction error

If your account has a security restriction, then you receive the following error:

"An error occurred (ValidationException) when calling the InvokeModel operation: Operation not allowed"

To resolve this issue, contact AWS Support.

You might also receive an AccessDeniedException that indicates the model isn't available for your account because of an account-level restriction. These restrictions don't appear in the Amazon Bedrock console and can't be resolved through IAM permissions or model access settings. You receive an error similar to the following:

"AccessDeniedException: is not available for this account. You can explore other available models on Amazon Bedrock. For additional access options, contact AWS Sales."

Amazon Bedrock runtime quotas for the affected model can show values of 0 in the Service Quotas console, even when the AWS default quotas are non-zero. This is another indicator of an account-level restriction. To resolve this issue, contact Support.

Service unavailable error

If Amazon Bedrock temporarily can't handle a request because of high demand or temporary capacity constraints, then you receive an error similar to the following:

"An error occurred (ServiceUnavailableException) when calling the InvokeModel operation: Bedrock is unable to process your request."

This is an HTTP 503 error. It's a transient service-side condition and isn't related to your account quotas or rate limits. To resolve this issue, see How do I troubleshoot the "503 Service Unavailable" error in Amazon Bedrock?

Throttling error

If your requests exceed the account quotas or rate limits for the model, then you receive an error similar to one of the following:

"An error occurred (ThrottlingException) when calling the InvokeModel operation: Too many requests, please wait before trying again."

"An error occurred (ThrottlingException) when calling the InvokeModel operation: Too many tokens, please wait before trying again."

This is an HTTP 429 error. To resolve this issue, see [How do I troubleshoot the "ThrottlingException" error when I use Amazon Bedrock on-demand resources?](https://How do I troubleshoot the "ThrottlingException" error when I use Amazon Bedrock on-demand resources).