Every AWS Bedrock Error, Fixed — IAM, Throttling, Guardrails, Converse, and More
Bedrock hosts Claude, Llama, Mistral, Nova, Cohere, and Stability behind one AWS-native API. That means IAM policies, service quotas, cross-region inference profiles, and guardrails on top of every model quirk. Every error page here has real Python + AWS CLI code, tested against the current Bedrock API surface.
Two APIs, One Confusing Choice — Converse vs InvokeModel
Bedrock offers two invocation APIs. Which you use changes how you build tools, handle streaming, and route errors. Most new integrations should default to Converse for the unified schema and built-in tool use.
Unified schema across all model providers. Built-in tool_use, guardrails, and streaming. Recommended for new work.
bedrock-runtime.converse() / converse_stream()
Provider-specific JSON payloads. Better for feature parity with native provider APIs (e.g. specific Claude beta features).
bedrock-runtime.invoke_model() / invoke_model_with_response_stream()
IAM & Access Control
Bedrock permissions live at the intersection of AWS IAM and per-model access grants. Most Bedrock outages start here.
Model Access Not Granted
Model access request required in Bedrock console before invoke. Common on first-use of any new model in an account.
IAM Missing bedrock:InvokeModel
Role or user policy lacks the specific bedrock action. Fix with resource-scoped IAM policy examples.
Service Role Assumption Failed
Custom service role for agents, KBs, or evaluations missing trust relationship or permission set.
Cross-Account Access Denied
Invoking Bedrock model from a different account. Requires resource-based policies + role assumption.
Model Availability & Routing
Bedrock model coverage is per-region, and some models require cross-region inference profiles to reach.
Model Not Available in Region
Latest Claude / Nova models launch in us-east-1 or us-west-2 first. Fix: routing table or cross-region inference profile.
Inference Profile Required
Some Claude models require calling via an inference profile ARN (us., eu., apac.) rather than raw model ID.
Model ID Invalid Format
Wrong model ID format: missing provider prefix, wrong version suffix, or trying an inference profile ID where model ID expected.
Throttling & Quotas
On-demand throughput is per-account, per-region, per-model. Provisioned throughput is dedicated capacity.
Throttling on Invocations
Hit TPS/RPM limit for on-demand throughput. Options: exponential backoff, service quota increase, or switch to Provisioned Throughput.
Tokens per Minute Quota
Per-account TPM quota hit. Different from throttling — quota is a hard soft-limit that requires an AWS support request.
Provisioned Throughput Scaling
PT model unit sizing, commitment periods, and errors when scaling up mid-workload. Cost + capacity tradeoffs.
Converse vs InvokeModel
API-specific body schemas, tool use handling, and how to migrate between the two.
Converse Schema Mismatch
Body doesn't match Converse's unified schema (messages, system, inferenceConfig, toolConfig structure).
InvokeModel Legacy Body
Provider-specific payload structure. Claude on Bedrock expects anthropic_version + specific message shape.
Streaming JSON Parse Failed
invoke_model_with_response_stream chunks vs Converse stream events. Different formats need different parsers.
Guardrails
Bedrock Guardrails apply content policies at invoke time. Config errors and blocked-content handling.
Guardrail Blocked Content
Input or output blocked by attached guardrail. Response format, handling patterns, and category-based fallbacks.
Guardrail Config Invalid
Bad guardrail identifier, missing version, or unsupported policy combination. Config schema reference.
Fewer 3AM Bedrock Pages
Weekly deep-dives on Bedrock IAM patterns, cross-region routing, guardrails, and cost optimization. 12,000+ enterprise developers subscribe.
Subscribe Free →