Amazon Bedrock Runtime returns "ValidationException: Operation not allowed" for every model despite AdministratorAccess

Question

I'm using a personal AWS account in us-east-1 for a development/hackathon project as a student and I'm unable to invoke any Amazon Bedrock Runtime model.
Every InvokeModel request returns:
ValidationException: Operation not allowed
This happens consistently across multiple unrelated models, including:
amazon.titan-embed-text-v2:0
cohere.embed-v4:0
cohere.embed-english-v3
zai.glm-4.7
I have verified the following:
AWS credentials work (aws sts get-caller-identity succeeds)
Region is us-east-1
IAM user has AdministratorAccess
AmazonBedrockFullAccess is attached
No permissions boundary
Account is not in AWS Organizations, so no SCP
No VPC endpoint is involved
list-foundation-models works
Models appear ACTIVE and support ON_DEMAND
Cohere Embed v4 inference profiles are visible and ACTIVE
Correct model-specific request payloads were tested
Both base model IDs and inference profile IDs were tested
Interestingly, GLM 4.7 works through the Bedrock Mantle endpoint, using the same account and credentials. The failure appears specific to the Bedrock Runtime data plane.
I have also tested both Converse and InvokeModel, with the same Operation not allowed result.
The old Bedrock Model Access page is now retired in the console, so there doesn't appear to be a manual model-access request step available.
I initially suspected IAM permissions, inference profiles, request format, and a missing Bedrock service-linked role, but these have all been investigated. AWS documentation also indicates Bedrock does not use a service-linked role.

Question:
Is there an account-level Bedrock Runtime restriction or activation/entitlement state that is not exposed through the current Bedrock APIs? If so, is there a self-service way to resolve it on a Basic Support/free-tier account?
I would prefer not to upgrade to a paid AWS Support plan just to resolve this.
Any guidance on what account-level setting or prerequisite I should check would be greatly appreciated.

Florian Turnwald · Accepted Answer

My understanding is: **Yes, there is an account-level restriction not exposed via Bedrock APIs.** New or low-usage AWS accounts (especially student or free-tier accounts) often have an internal anti-fraud/billing hold applied to Amazon Bedrock Runtime. This causes ValidationException: Operation not allowed on InvokeModel or Converse APIs, regardless of your IAM permissions, inference profile status, or active model access.

The control plane (e.g., list-foundation-models) works, but the data plane is blocked until your account establishes a billing history or passes manual verification. Additionally, accessing third-party models (like Cohere) requires a background AWS Marketplace subscription handshake, which strictly mandates a valid, verified credit card on file.

**Resolution for Basic Support (Free Tier)**
There is no API-based self-service flag to bypass this, but you do not need to upgrade to a paid Developer/Business Support plan to resolve it.
 * Verify Payment Method: Ensure a valid credit card is linked in the AWS Billing Console. Promotional credits alone typically do not satisfy the Marketplace requirement.
 * Open a Free Billing Case: Go to the AWS Support Center.
 * Create a new case and select the Account and billing category. This specific category is fully accessible to accounts on the Basic Support plan.
 * Explain that your account is fully configured for Bedrock but you are receiving ValidationException: Operation not allowed on all models due to suspected new-account billing restrictions. Request that they manually review the account and lift the Bedrock invocation limit.

**References**
 * AWS re:Post - Amazon Bedrock "Operation not allowed" for ALL models despite full IAM permissions -> https://repost.aws/questions/QUJQZQFtuVTXKDpvKO--OK-g/amazon-bedrock-operation-not-allowed-for-all-models-despite-full-iam-permissions
 * AWS re:Post - New AWS Account - Bedrock Models - Operation not allowed -> https://repost.aws/questions/QU0jAbLUjGTBGSmk4vUi4lBw/new-aws-account-bedrock-models-operation-not-allowed

Amazon Bedrock Runtime returns "ValidationException: Operation not allowed" for every model despite AdministratorAccess

Add your answer

Relevant content