SCP Error while deploying cross region inference

The error you're encountering is related to Service Control Policies (SCPs) blocking cross-Region inference for Amazon Bedrock. Even though your client claims they haven't added any SCPs, the error message clearly indicates there is "an explicit deny in a service control policy" affecting your ability to use cross-Region inference.

For cross-Region inference to work properly with Amazon Bedrock, you need to ensure that all potential destination Regions in the inference profile are allowed in your SCPs. If any destination Region in a cross-Region inference profile is blocked by SCPs, the request will fail even if other Regions remain allowed.

Here are some steps to resolve this issue:

1. Verify if there are any organization-level SCPs that might be denying access to certain Regions. Common scenarios include landing zone configurations that deny access to Regions not explicitly allowed.

2. Check if there's a Region deny policy (like GRREGIONDENY) that's blocking access to some of the Regions included in the cross-Region inference profile.

3. Modify the existing SCPs to allow Amazon Bedrock inference actions in all destination Regions included in your chosen inference profile. You'll need to add exceptions for bedrock:InvokeModel* operations in the Regions where Claude 4 Sonnet is available.

4. For your IAM policy, ensure you have the necessary permissions for using inference profiles:

• Add bedrock:GetInferenceProfile, bedrock:ListInferenceProfiles, and bedrock:UseInferenceProfile permissions for the inference profile resources.

The error specifically mentions that the operation is being denied on the resource arn:aws:bedrock:::foundation-model/anthropic.claude-sonnet-4-20250514-v1:0, which suggests that the SCP is blocking access to this foundation model in one of the Regions that the cross-Region inference is attempting to use.
Sources
Enable Amazon Bedrock cross-Region inference in multi-account environments | AWS Machine Learning Blog
CDK - Resource handler returned message: "Access denied for operation 'AWS::Bedrock::Agent'." when creating an agent with foundationModel set as inference-profile. | AWS re:Post
Implementing Cross-Region Inference with Amazon Bedrock while Maintaining Your Landing Zone Structure | AWS re:Post
How inference works in Amazon Bedrock - Amazon Bedrock