Skip to content

Creating Knowledge Base Error: Replacement "" for multi-value placeholder "foundationModelId" was empty or contained a wildcard character

2

More often than not, when creating a new Bedrock Knowledge Base in the console, I get the following error upon submitting "Create knowledge base".

undefined There were problems with the supplied replacements: [Replacement "" for multi-value placeholder "foundationModelId" was empty or contained a wildcard character]

  • This occurs when selecting any embedding model and throws the same error
  • I've tried using the "Quick create a new vector datastore" as well as using a vector Collection on OpenSearch via "Choose a vector store you have created"
  • I noticed a new vector Collection is always created when submitting "Create knowledge base" and then the error throws, so it's possible to reuse that newly created Collection vector db. The same error will throw even when reusing the Collection.

UPDATE | So creating a brand new Role in the console Create Knowledge Base flow, unblocks this issue. However, when I compare the two roles - the old, updated one I was trying to reuse mentioned in comment below and the brand new role created - the old, updated role is a superset of the new role. So all the permissions created in the new role are indeed in the old, updated role. So I don't understand why the old, updated role would be the issue, but apparently it is.

Old Role Policy: AmazonBedrockFoundationModelPolicyForKnowledgeBase_oldrole

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BedrockInvokeModelStatement",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel"
            ],
            "Resource": [
                "arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2:0"
            ]
        }
    ]
}

New Role Policy: AmazonBedrockFoundationModelPolicyForKnowledgeBase_newrole

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BedrockInvokeModelStatement",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel"
            ],
            "Resource": [
                "arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2:0"
            ]
        }
    ]
}

Old Role (i updated with new collection ARN I used in Create Knowledge Base console workflow) Policy: AmazonBedrockOSSPolicyForKnowledgeBase_oldrole

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "OpenSearchServerlessAPIAccessAllStatement",
            "Effect": "Allow",
            "Action": [
                "aoss:APIAccessAll"
            ],
            "Resource": [
                "arn:aws:aoss:us-east-1:account:collection/oldcollection",
                "arn:aws:aoss:us-east-1:account:collection/newcollection"
            ]
        }
    ]
}

New Role Policy: AmazonBedrockOSSPolicyForKnowledgeBase_newrole

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "OpenSearchServerlessAPIAccessAllStatement",
            "Effect": "Allow",
            "Action": [
                "aoss:APIAccessAll"
            ],
            "Resource": [
                "arn:aws:aoss:us-east-1:account:collection/newcollection"
            ]
        }
    ]
}
  • I have actually been getting the exact same error, same behavior as well with the OpenSearch Collection being created and then failing to create the Knowledge Base itself. I opened a support case for it and would be happy to share any solutions or insights I might get from AWS support. For now, they are still investigating.

  • Absolutely! Would be super helpful if you update your findings here :)

  • No new information, just here to say that I observed the exact same behavior with the roles and policies.

1 Answer
0

Hi!

I would verify that the runtime IAM Role that you're passing when creating the Knowledge Base has the correct permissions for the embeddings model and region that you're using.

In my case, I had auto-generated the role in us-east-1, then tried switching to a different model using the same role and ran into the error above. I then tried switching regions and ran into the same problem. After checking the auto-generated permissions it had a policy that looked like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BedrockInvokeModelStatement",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel"
            ],
            "Resource": [
                "arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2:0"
            ]
        }
    ]
}

The simplest and quickest fix would be to auto-generate another role when you create the new knowledge base. It should add the right permissions for what you're trying to do.

In my case I added entries for us-west-2 and the other model I was attempting to use. It worked after that.

If it still doesn't work - make sure you're verifying the permissions on the other policies that reference the OpenSearch collection and buckets.

Hope that helps!

answered 2 years ago
  • Same model. I checked the existing role I'm reusing and the model ARN appears to match the Titan Embed v2 model I selected to use for vector db. I did notice my OSS Collection ARN was missing in the policy, but even adding it didn't change this specific error (i imagine missing the OSS Collection ARN would have thrown a new error further down the authentication workflow if I hadn't added it)

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.