Bedrock: get-foundation-model-availability reports AUTHORIZED/AVAILABLE but InvokeModel returns AccessDenied "not available for this account" (Claude Opus 5 / Sonnet 5 / Opus 4.8)

We cannot invoke any Claude model newer than Opus 4.6, although Bedrock's own entitlement API reports full availability for those models. I would like to know whether this is a known provisioning defect and what the correct route to a fix is, because two support cases on this have gone unanswered since June.

The contradiction

aws bedrock get-foundation-model-availability --region eu-central-1 --model-id anthropic.claude-opus-5 returns:

authorizationStatus:       AUTHORIZED
entitlementAvailability:   AVAILABLE
regionAvailability:        AVAILABLE
agreementAvailability:     AVAILABLE

Invoking the corresponding EU inference profile in the same region returns:

AccessDeniedException
anthropic.claude-opus-5 is not available for this account.
You can explore other available models on Amazon Bedrock. For additional
access options, contact AWS Sales at ...

Identical result for anthropic.claude-sonnet-5 and anthropic.claude-opus-4-8.

What works and what does not

Same account, same region, same call, same IAM principal:

EU inference profile	Result
eu.anthropic.claude-opus-5	AccessDenied
eu.anthropic.claude-sonnet-5	AccessDenied
eu.anthropic.claude-opus-4-8	AccessDenied
eu.anthropic.claude-opus-4-7	AccessDenied
eu.anthropic.claude-sonnet-4-6	works
eu.anthropic.claude-opus-4-6-v1	works
eu.anthropic.claude-opus-4-5-20251101-v1:0	works
eu.anthropic.claude-haiku-4-5-20251001-v1:0	works

The boundary sits exactly between generation 4.6 and 4.7.

Reproduced in four EU regions, as root of the management account

Called from CloudShell as the organization's management account root user, so no IAM restriction of any kind applies. The control plane reports AUTHORIZED/AVAILABLE for anthropic.claude-opus-5 in all four regions:

Region	Opus 5	Sonnet 5	Reference Opus 4.6
eu-central-1	AccessDenied	AccessDenied	works
eu-west-1	AccessDenied	AccessDenied	ServiceUnavailable (max retries)
eu-north-1	AccessDenied	AccessDenied	ServiceUnavailable (max retries)
eu-west-3	AccessDenied	AccessDenied	ServiceUnavailable (max retries)

Note the different error classes: the new models fail with a permission error everywhere, while the reference model outside Frankfurt fails with a capacity/routing error. So there is no regional workaround.

Ruled out

• IAM - the same principal invokes four other EU inference profiles successfully in the same run, and the reproduction above ran as management account root.
• Model identifiers - taken from the account's own model catalogue (list-foundation-models --by-provider anthropic); all target models are listed as ACTIVE, and all their eu.* inference profiles are ACTIVE. The error is AccessDeniedException, not ValidationException.
• On-demand vs inference profile - the catalogue lists these models as INFERENCE_PROFILE only, and the calls use the eu. profile accordingly.
• Region - regionAvailability: AVAILABLE, reproduced in four EU regions.
• Agreement / marketplace - agreementAvailability: AVAILABLE.
• Organization SCPs - service control policies are enabled but do not apply to the management account, and all calls originate from it.
• Console model access - there is nothing to enable there; the console shows the same message.
• First-time-use prompt - the playground shows no FTU prompt at all, only the AccessDenied message.

Questions

1. Is this a known defect in the reconciliation between the entitlement control plane and the Bedrock runtime? If so, is there a reference and a timeline?
2. If it is instead a provisioning step that has not completed, what is the correct way to have the entitlement pushed? The runtime message points to AWS Sales, which seems wrong given that agreementAvailability and authorizationStatus are already positive.
3. Is there anything on the customer side that can still be done, or does this require an action inside AWS?

Same symptom reported by others

• "Amazon Bedrock: HTTP 403 model is not available for this account when invoking Claude Fable 5, Claude Sonnet 5, Claude Opus 4.7 and Claude Opus 4.8"
• "Claude Opus 4.7 / 4.8 on Amazon Bedrock returns AccessDeniedException despite full entitlement and valid agreement"
• GitHub anthropics/claude-code issues 51183 and 49238

In every one of those, Opus 4.6 is the last working model - the same boundary we see.

Account ID, organization ID and request IDs are available on request; I am not posting them publicly. Production is not down (we run on Opus 4.6), but we are blocked from every current model.