[Error] ValidationException: Operation not allowed

Hi,

Did you programmatically check the identity under which you run the Python script ?

Please, do it, either via CLI on the machine where you run Python. Use https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html

Or (better), modify the python code to add:

import boto3
boto3.client('sts').get_caller_identity().get('Account')

Best,

Didier

The "Operation not allowed" error you're encountering is likely related to model access permissions in Amazon Bedrock. Even though you have full account permissions via your IAM policy, you still need to explicitly enable access to the specific foundation models you want to use in Amazon Bedrock.

To resolve this issue:

1. Navigate to the Amazon Bedrock console
2. In the navigation pane, expand "Bedrock configurations" and select "Model access"
3. Check the "Access status" column for the models you're trying to use (Nova Lite in your case)
4. If the model is not enabled, you need to request access to it

Additionally, make sure that:

• You're in the correct region (eu-west-1) and that the model you're trying to use is available in that region
• If your organization uses Service Control Policies (SCPs), check if there are any explicit denies for AWS Marketplace actions, as these can prevent access to Bedrock foundation models

For the AgentCore Gateway specifically, verify that:

• The execution role has the necessary permissions to invoke the model
• The trust relationship for the role is properly configured to allow bedrock.amazonaws.com to assume the role

If you continue to experience issues, you can check CloudTrail event history for more detailed error information about what might be causing the "Operation not allowed" error.
Sources
Amazon Bedrock batch job: Validation Error: Operation Not Allowed | AWS re:Post
Resolve access denied errors for Amazon Bedrock Agents | AWS re:Post
Resolve SCP conflicts that prevent access to Amazon Bedrock | AWS re:Post
Troubleshoot AgentCore built-in tools - Amazon Bedrock AgentCore