AWS Bedrock Model Access Issue - Need Help!

Problem Summary

I'm unable to invoke any AWS Bedrock models despite having what appears to be all the correct permissions and configurations. Every model invocation fails with the same error:

An error occurred (AccessDeniedException) when calling the InvokeModel operation: 
You don't have access to the model with the specified model ID.

What I've Validated ✅

Account Setup

• Account Type: Personal AWS account (not in organization)
• Region: us-east-1 (primary)
• Service Control Policies: Disabled (confirmed in AWS Organizations console)
• Model Access: All models show "Access granted" in Bedrock Console → Model access

IAM Permissions

• User: svc-bedrock
• Group: bedrockfull with the following policy:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": "bedrock:*",
			"Resource": "*"
		}
	]
}

What Works ✅

• bedrock.list_foundation_models() - Returns 85 models
• bedrock.get_foundation_model() - Successfully retrieves model details
• bedrock.list_inference_profiles() - Returns all available inference profiles
• bedrock.get_model_invocation_logging_configuration() - Accessible

What Fails ❌

• All bedrock-runtime.invoke_model() calls
• All bedrock-runtime.converse() calls
• All models tested: Nova Lite, Nova Micro, Claude 3 Haiku, Titan Express
• Both direct model IDs and inference profile IDs
• Both invoke_model and converse APIs

Troubleshooting Steps Attempted

1. Verified model access in Bedrock console - all models show "Access granted"
2. Tested wildcard IAM permissions - "Resource": "*" with full bedrock actions
3. Tested multiple regions - us-east-1, us-west-2
4. Tested multiple model formats:
   • Direct model IDs: amazon.nova-lite-v1:0
   • Inference profiles: us.amazon.nova-lite-v1:0
   • Full ARNs: arn:aws:bedrock:us-east-1:account:inference-profile/us.amazon.nova-lite-v1:0
5. Tested different APIs: InvokeModel, Converse
6. Cleared credential cache and waited for policy propagation
7. Confirmed no permission boundaries or organizational restrictions

Sample Test Code

import boto3

# This works
bedrock = boto3.client('bedrock', region_name='us-east-1')
models = bedrock.list_foundation_models()
print(f"Found {len(models['modelSummaries'])} models")  # ✅ Works

# This fails
bedrock_runtime = boto3.client('bedrock-runtime', region_name='us-east-1')
response = bedrock_runtime.converse(
    modelId='us.amazon.nova-lite-v1:0',
    messages=[{"role": "user", "content": [{"text": "Hello"}]}],
    inferenceConfig={"maxTokens": 10}
)
# ❌ AccessDeniedException: You don't have access to the model

Questions for the Community

1. Has anyone seen this specific issue where list/get operations work but invoke operations fail with full permissions?

2. Are there any account-level settings I might be missing that could cause this?

3. Could this be related to billing/payment methods even though the account is active?

4. Are there any additional IAM actions required for model invocation that aren't documented?

5. Could there be a service-linked role or cross-service permission I'm missing?