Bedrock API call error: Your account is not authorized to invoke this API operation.

Question

When calling bedrock invoke_model (), I am getting the following error:
AccessDeniedException: An error occurred (AccessDeniedException) when calling the InvokeModel operation: Your account is not authorized to invoke this API operation.

Here is the source code: response = bedrock_runtime.invoke_model(body=body, modelId=modelId, accept=accept, contentType=contentType)
Note: This line of code is part of Amazon Bedrock Workshop.

This happened when I use SageMaker notebook with the Role (IAM role ARN
arn:aws:iam::XXXXXXXXXXX:role/service-role/AmazonSageMakerServiceCatalogProductsUseRole ) which I already added the following in-line permission to the Role:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BedrockFullAccess",
            "Effect": "Allow",
            "Action": ["bedrock:*"],
            "Resource": "*"
        }
    ]
}

Btw, If I use my IAM user (which has the above BedrockFullAccess permission) to run the code, I got the exact same error message. This document https://catalog.us-east-1.prod.workshops.aws/workshops/a4bdb007-5600-4368-81c5-ff5b4154f518/en-US/20-intro doesn't help much. 
Please help. 
Joshua

Answer

From my original post, I was trying to configure the amazon.titan-tg1-large model and I stuck with "Your account is not authorized to invoke this API operation".  After carefully reading the current documentation here: https://us-west-2.console.aws.amazon.com/bedrock/home?region=us-west-2#/providers, the "amazon.titan-tg1-large" is not on the list.

As a workaround,  From my Python API calls, I used "modelId": "ai21.j2-ultra-v1" or "modelId": "anthropic.claude-v1" instead. They worked as expected and completed my calling the models from Python API.

Looking back, the error message "Your account is not authorized to invoke this API operation" is misleading. The better error message should pinpoint the fact that your specified mode is not found (amazon.titan-tg1-large) as an example.

Answer

Before using a foundational model in Bedrock your account needs to be granted access first. For some reason the workshop does not mention this.

Follow the steps here to add models: https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html#add-model-access

Some models require some additional information and take some time before you are granted access. Once the model shows "Access granted" on the Model Access page, you should be able to call the invoke_model() function without the error.

Answer

Hi,
I'm admin in one of my account but I can not use Titan, it's marked as available but I can not use it in the playground or with boto3.

I tried Stability model and it works in the Console with the same user/session

For instance the following code:

```
modelId = "amazon.titan-tg1-large"
accept = "application/json"
contentType = "application/json"

response = boto3_bedrock.invoke_model(
    body=body, modelId=modelId, accept=accept, contentType=contentType
)
```
Raises the exception:
```
botocore.errorfactory.AccessDeniedException: An error occurred (AccessDeniedException) when calling the InvokeModel operation: Your account is not authorized to invoke this API operation.
```

I also tried in another account where I'm also admin, same issue, it's marked as enabled but I can't do anything.

Any idea what it could be?

Thanks.

![Enter image description here](/media/postImages/original/IMN0NqUwJRS6KddN0WFbDBxg)

![Enter image description here](/media/postImages/original/IM8EtSggifRACHO5NBcs-DBw)

Answer

I am experiencing the same issue (OlivierS posted)  by calling the API with the modelID = "amazon.titan-tg1-large". 
Btw, other API modelIDs worked okay for me so far.

Answer

According to the issues below, some of the titan models are in preview. Unless you have access to the private preview of the model, the call will fail.

https://github.com/aws-samples/amazon-bedrock-workshop/issues/109

https://github.com/aws-samples/amazon-bedrock-workshop/issues/71

Bedrock API call error: Your account is not authorized to invoke this API operation.

Relevant content