ValidationException: Operation not allowed for ALL bedrock-runtime invocations on AISPL account

The "ValidationException: Operation not allowed" error you're experiencing with Amazon Bedrock runtime invocations on your AISPL (Amazon Internet Services Private Limited) India account appears to be related to permissions for AWS Marketplace model subscriptions, which is a common cause of access issues with Bedrock models.

Even though you have AmazonBedrockFullAccess attached and can list foundation models successfully, you need to ensure your IAM policy explicitly includes permissions for both model invocation AND AWS Marketplace subscription actions. The fact that the Model access page shows "retired, models auto-enabled" suggests the models may need proper activation.

Here are the key steps to resolve this:

1. Verify IAM Policy Permissions: Ensure your IAM role or user has an explicit policy that allows both bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream actions on the specific model ARNs you're trying to use. The policy should look like:

• Action: bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream
• Resource: The ARN of your foundation models (e.g., arn:aws:bedrock:*::foundation-model/amazon.nova-pro-v1:0)

2. AWS Marketplace Activation: For AISPL accounts, there may be additional requirements around AWS Marketplace model activation. Your administrator may need to explicitly activate these models at the account level through API calls before they can be invoked.

3. Contact AWS Support: Given that this appears to be specific to AISPL accounts and you've already verified standard permissions, this may require AWS Support intervention to enable Bedrock runtime operations on your AISPL account backend. AISPL accounts sometimes have different service availability or activation requirements compared to standard AWS accounts.

The issue is likely not a bug but rather a permissions or account activation requirement specific to how Bedrock integrates with AWS Marketplace on AISPL accounts.
Sources
Resolve Amazon Bedrock serverless foundation model access denied errors | AWS re:Post