AWS Bedrock AccessDeniedException — Model Access Not Granted

import boto3
from botocore.exceptions import ClientError

# Point this at the region you actually invoke from.
# A common mistake: your default AWS_REGION is us-east-1, but your code
# pins us-west-2 in the client — access must exist in us-west-2.
REGION = "us-east-1"

# Models you plan to invoke. Update this list to match your production set.
TARGETS = [
    "anthropic.claude-sonnet-4-6-20250929-v1:0",
    "anthropic.claude-haiku-4-5-20251001-v1:0",
    "amazon.nova-pro-v1:0",
    "meta.llama3-3-70b-instruct-v1:0",
]

bedrock = boto3.client("bedrock", region_name=REGION)
runtime = boto3.client("bedrock-runtime", region_name=REGION)

def check_model(model_id: str) -> dict:
    """Returns a dict with lifecycle status, access status, and invoke-test result."""
    result = {"model_id": model_id, "lifecycle": None, "invoke_ok": False, "error": None}
    try:
        meta = bedrock.get_foundation_model(modelIdentifier=model_id)
        result["lifecycle"] = meta["modelDetails"].get("modelLifecycle", {}).get("status")
    except ClientError as e:
        result["error"] = e.response["Error"]["Code"]
        return result

    # Tiny Converse call — 1 token in, 1 token out. Costs fractions of a cent.
    try:
        runtime.converse(
            modelId=model_id,
            messages=[{"role": "user", "content": [{"text": "hi"}]}],
            inferenceConfig={"maxTokens": 1},
        )
        result["invoke_ok"] = True
    except ClientError as e:
        result["error"] = e.response["Error"]["Code"]
    return result

if __name__ == "__main__":
    print(f"Checking Bedrock access in {REGION}\n")
    for model_id in TARGETS:
        r = check_model(model_id)
        status = "✓ OK" if r["invoke_ok"] else f"✗ {r['error']}"
        print(f"  {model_id}")
        print(f"    lifecycle={r['lifecycle']}  invoke={status}\n")

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockInvokeFoundationModels",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:Converse",
        "bedrock:ConverseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-*",
        "arn:aws:bedrock:us-east-1::foundation-model/amazon.nova-*",
        "arn:aws:bedrock:us-east-1::foundation-model/meta.llama*"
      ]
    },
    {
      "Sid": "BedrockDiscovery",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels",
        "bedrock:GetFoundationModel"
      ],
      "Resource": "*"
    }
  ]
}

# 1. Save policy JSON above as bedrock-invoke-policy.json
# 2. Create the policy
aws iam create-policy \
  --policy-name BedrockInvokeAccess \
  --policy-document file://bedrock-invoke-policy.json

# 3. Attach to your role (replace with your role name)
aws iam attach-role-policy \
  --role-name MyAppExecutionRole \
  --policy-arn arn:aws:iam::123456789012:policy/BedrockInvokeAccess

# 4. If using cross-region inference profiles, also grant:
#    bedrock:InvokeModel* on arn:aws:bedrock:*:ACCOUNT:inference-profile/*

import os
import boto3
from botocore.exceptions import ClientError

def diagnose_region():
    env_region = os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")
    session_region = boto3.Session().region_name
    print(f"AWS_REGION env       : {env_region}")
    print(f"boto3 session region : {session_region}")

    client = boto3.client("bedrock-runtime")
    print(f"Client actual region : {client.meta.region_name}")

def use_inference_profile(profile_id: str, prompt: str):
    """Cross-region inference profiles let one call span multiple regions.
    Use when Anthropic Claude Sonnet is available in us-east-1, us-west-2, and
    us-east-2 but you don't want to pin one region."""
    runtime = boto3.client("bedrock-runtime", region_name="us-east-1")
    try:
        resp = runtime.converse(
            modelId=profile_id,  # e.g. "us.anthropic.claude-sonnet-4-6-20250929-v1:0"
            messages=[{"role": "user", "content": [{"text": prompt}]}],
            inferenceConfig={"maxTokens": 100},
        )
        return resp["output"]["message"]["content"][0]["text"]
    except ClientError as e:
        code = e.response["Error"]["Code"]
        if code == "AccessDeniedException":
            print("Inference profile requires access to the model in ALL member regions.")
            print("Open the console → Model access in each region listed on the profile.")
        raise

if __name__ == "__main__":
    diagnose_region()
    # The "us." prefix denotes a US cross-region profile.
    # EU equivalent starts with "eu.", APAC with "apac.".
    result = use_inference_profile(
        "us.anthropic.claude-sonnet-4-6-20250929-v1:0",
        "Summarize why cross-region profiles improve availability.",
    )
    print(result)