Amazon Bedrock API keys return 403 AccessDeniedException despite allowed IAM permissions

Question

Amazon Bedrock bearer-token API requests consistently return HTTP 403 AccessDeniedException in eu-west-2 (Europe London).

Environment:

Amazon Bedrock, eu-west-2
Model: Amazon Nova Lite (amazon.nova-lite-v1:0)
Nova Lite works successfully in the Bedrock Playground in the same account and region.

Long-term API key:

Generated through the Bedrock console.
Associated IAM user has the AWS-managed AmazonBedrockLimitedAccess policy.
IAM Policy Simulator shows explicit Allow for bedrock:CallWithBearerToken and bedrock:InvokeModel, including foundation-model resources.
There is no permissions boundary on the IAM user.
A direct Converse request to bedrock-runtime.eu-west-2.amazonaws.com, outside our application, returns HTTP 403 AccessDeniedException.

Short-term API key:

Generated in eu-west-2 from an authenticated AWS Management Console session.
Repeating the same direct synthetic Converse request also returns HTTP 403 AccessDeniedException.

Our application receives the same 403. However, because the direct request outside the application also fails, the application request path does not appear to be the immediate cause.

Both tests used synthetic data only.

Why would both long-term and short-term Amazon Bedrock API keys receive AccessDeniedException while the same Nova Lite model succeeds in the Bedrock Playground? Is there an account-, region-, or bearer-token-specific control or enablement that would not be represented by IAM Policy Simulator?

No credentials, AWS account identifiers, ARNs, request IDs, application data or sensitive payloads are included.

Riku_Kobayashi · Answer

Hello.

How exactly are you invoking Bedrock Nova Lite?  
Would it be possible for you to share the sample code where the error occurs?

For reference, I have confirmed that the following Python code works on my AWS account.  
https://docs.aws.amazon.com/bedrock/latest/userguide/getting-started-api-keys.html  
```
import boto3
import os

os.environ['AWS_BEARER_TOKEN_BEDROCK'] = "API Key"

client = boto3.client(
        "bedrock-runtime",
        region_name="us-west-2"
    )

response = client.converse(
        modelId="global.amazon.nova-2-lite-v1:0",
        messages=[
            {
                "role": "user",
                "content": [
                    {
                        "text": "Hi Who are you?"
                    }
                ]
            }
        ],
        inferenceConfig={
            "maxTokens": 500,
            "temperature": 0.7,
            "topP": 0.9
        }
    )

print(response["output"]["message"]["content"][0]["text"])
```

Amazon Bedrock API keys return 403 AccessDeniedException despite allowed IAM permissions

Add your answer

Relevant content