Problem: Amazon Bedrock Returns "AccessDeniedException"

Problem: Amazon Bedrock Returns "AccessDeniedException" 

When attempting to use Amazon Bedrock, you might encounter the following error:

$ aws bedrock list-foundation-models --region us-east-1

An error occurred (AccessDeniedException) when calling the ListFoundationModels operation: 
User is not authorized to perform this action

Issue: 

This error occurs when your AWS Identity and Access Management (IAM) user or role lacks the necessary permissions to interact with Amazon Bedrock. Common causes include:

• Missing IAM policies – The user does not have the correct permissions to access Amazon Bedrock APIs.
• Incorrect role assumption – The AWS CLI might be using the wrong credentials.
• Explicit Deny in SCP or IAM policy – A service control policy (SCP) or IAM permissions boundary is blocking access.
• Regional restrictions – Bedrock is not available in all regions, or access is restricted.
• AWS Organization policies – If your AWS account is part of an organization, an organization policy might be restricting access.

Fix: Grant Proper IAM Permissions and Validate Access

# Step 1: Verify IAM Permissions for the User or Role
aws iam list-attached-user-policies --user-name my-user

# Expected Output (if user has no policies attached)
{
    "AttachedPolicies": []
}

# If empty, the user lacks permissions. Attach the required policy:
aws iam attach-user-policy \
    --user-name my-user \
    --policy-arn arn:aws:iam::aws:policy/AmazonBedrockFullAccess# Verify that the policy was applied:
aws iam list-attached-user-policies --user-name my-user

# Expected Output (if policy is correctly attached)
{
    "AttachedPolicies": [
        {
            "PolicyName": "AmazonBedrockFullAccess",
            "PolicyArn": "arn:aws:iam::aws:policy/AmazonBedrockFullAccess"
        }
    ]
}

# If using an IAM role, ensure the role has the correct permissions:
aws iam attach-role-policy \
    --role-name my-role \
    --policy-arn arn:aws:iam::aws:policy/AmazonBedrockFullAccess

# Step 2: Confirm the Correct Role is Being Used
aws sts get-caller-identity

# Expected Output (if correct credentials are in use)
{
    "UserId": "AIDACKCEVSQ6C2EXAMPLE",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/my-user"
}

# If the ARN does not match your expected user/role, switch profiles:
aws configure --profile my-profile

# Or assume the correct role:
aws sts assume-role \
    --role-arn arn:aws:iam::123456789012:role/my-role \
    --role-session-name BedrockSession

# Step 3: Check for Explicit Deny in SCP or IAM Policies
aws organizations describe-policy --policy-id p-12345678

# Possible Output (if an explicit deny exists)
{
    "PolicySummary": {
        "Type": "SERVICE_CONTROL_POLICY",
        "Name": "DenyAllBedrock",
        "Description": "Prevents all access to AWS Bedrock",
        "Id": "p-12345678",
        "Arn": "arn:aws:organizations::123456789012:policy/service_control_policy/p-12345678"
    }
}

# If this policy exists, an Org admin must update or remove the restriction.

# Step 4: Ensure Bedrock is Available in Your Region
aws configure get region

# If your region is not us-east-1 (or another supported region), change it:
aws configure set region us-east-1

# Check if Bedrock models are available:
aws bedrock list-foundation-models --region us-east-1

# Expected Output (if working correctly)
{
    "models": [
        {
            "modelId": "ai21.j2-ultra",
            "providerName": "AI21",
            "modelName": "Jurassic-2 Ultra"
        },
        {
            "modelId": "anthropic.claude-v1",
            "providerName": "Anthropic",
            "modelName": "Claude v1"
        }
    ]
}

# Step 5: Test Bedrock Access Again
# If this now works without errors, your issue is resolved! 
aws bedrock list-foundation-models --region us-east-1

Need AWS Expertise?

If you're looking for guidance on Amazon Bedrock or any cloud challenges, feel free to reach out! We'd love to help you tackle your Bedrock projects. 🚀

Email us at: info@pacificw.com

Image: Gemini