Invalid input or configuration provided error while testing Bedrock knowledge bases

Question

I built a RAG app using API Gateway, Lambda, and Bedrock and everything was running smoothly for a few weeks. The last time I tested it, on September 10, it worked perfectly. However, when I tried again on September 15, I started getting this error from my Lambda function.

```
LAMBDA_WARNING: Unhandled exception. The most likely cause is an issue in the function code. However, in rare cases, a Lambda runtime update can cause unexpected function behavior.
For functions using managed runtimes, runtime updates can be triggered by a function change, or can be applied automatically. 
To determine if the runtime has been updated, check the runtime version in the INIT_START log entry. If this error correlates with a change in the runtime version, you may be able to mitigate this error by temporarily rolling back to the previous runtime version.
For more information, see https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html
[ERROR] ValidationException: An error occurred (ValidationException) when calling the RetrieveAndGenerate operation: Invalid input or configuration provided. Check the input and Knowledge Base configuration and try your request again.
Traceback (most recent call last):
  File "/var/task/lambda_function.py", line 50, in lambda_handler
    response = bedrock.retrieve_and_generate(
  File "/var/lang/lib/python3.12/site-packages/botocore/client.py", line 565, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/var/lang/lib/python3.12/site-packages/botocore/client.py", line 1021, in _make_api_call
    raise error_class(parsed_response, operation_name)
```

So I checked my knowledge bases and attempted to generate responses and also test the retrieval, but I encountered the same error each time. The full error message is:

```
Invalid input or configuration provided. 
Check the input and Knowledge Base configuration and try your request again.
```

Even though my data source was already synced,I tried syncing my data source. I received another error during the sync:

```
Knowledge base role arn:aws:iam:::role/service-role/ is not able to call specified bedrock embedding model arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2:0: Operation not allowed.
```

So i thought this could be the root of my problem and tried everything to resolve this. I gave the knowledge base role administrator access permission, but the error persisted. I tried to create a new knowledge base with the root user and sync it but that didn't work. I also created a new knowledge base by using another embedding model which was cohere.embed-english-v3 and I added the same administator access permission to the knowledge base role, but i got the same error.

All services i use is in us-east-1 region. And I have access to every model on the model access page. It says access granted for claude 3 haiku(llm i used for the generation), titan text embeddings v2 and cohere embed english. So model access shouldn't be an issue i think.

Finally i checked the [document history of Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/doc-history.html) and i found [this new feature](https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-supported.html) that was added in September 11. It says "You can now use cross region inference when generating responses based on results queried from a knowledge base and when parsing a data source.". I couldn't find anything that could affect my workflow but maybe my issue was arising from here i don't know.

Makendran G · Answer

To resolve this:

a. Go to the IAM console

b. Find the role mentioned in the error message (arn:aws:iam:::role/service-role/)

c. Add the necessary permissions to allow the role to use the Bedrock embedding model (amazon.titan-embed-text-v2:0)

You might need to add a policy similar to this:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel"
            ],
            "Resource": "arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2:0"
        }
    ]
}
```

d. After updating the IAM role permissions, try syncing your data source again.

[+] https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-perform-actions-pt

Ufuk · Answer

Firstly, thanks for your answer.
I already had this permission attached to my knowledge base role. I tried attaching the bedrock full access and also the administrator access permission to my role but even those couldn't solve this operation not allowed error.
Additionaly for Cohere Embed English model i tried to remove my access to that model and re-enable it. Then i tried to sync the knowledge base i built with the Cohere Embed English but i still got the same error.
Remember that i had multiple knowledge bases running without any issue few days ago. But somehow all of them are not working right now. When i try to test them, i get the same error which is:
```
Invalid input or configuration provided. 
Check the input and Knowledge Base configuration and try your request again.
```
When i try to sync the data source for each of them, i get the same Operation Not Allowed error that i shared before.
So I don't think the issue was about the roles because these roles were working just fine before the error. But thanks for your answer again.

kangkyu · Answer

I would check if what models are used by your process.

In my case, when I saw the error "Invalid input or configuration provided. Check the input and Knowledge Base configuration and try your request again", I went to Bedrock > Knowledge Bases > Select > Data Source > Select and then clicked the "Sync" button. And then, it gave me an error that I was using a model I didn't get the access granted for. After the access has been granted, it worked without error.

Invalid input or configuration provided error while testing Bedrock knowledge bases

Relevant content