AWS Bedrock Error: 'ConnectTimeoutError' When Invoking AWS Bedrock
.jpeg)
A diagnostic guide to resolving AWS Bedrock failures caused by network reachability or connection setup issues.
Problem
An AWS Bedrock invocation fails with a connection timeout error.
Typical symptoms:
- Python (Botocore):
ConnectTimeoutError - Node.js: Connection attempt hangs, then times out
- CLI: Command fails quickly or after a short wait
- General: No inference begins; the request never connects
The failure occurs before any model inference starts.
Clarifying the Issue
This is not an IAM issue.
This is not a model or SDK capability issue.
📌 ConnectTimeoutError means the client cannot establish a network connection to the Bedrock endpoint.
📌 This is a reachability problem, not a performance problem.
Why It Matters
This error commonly appears when:
- Workloads run in private subnets
- Lambda functions are attached to a VPC
- NAT gateways are missing or misconfigured
- VPC endpoints are absent or blocked
- Security group or NACL rules restrict outbound traffic
- Corporate proxies or firewalls intercept traffic
The request never reaches Bedrock.
Key Terms
- Connect timeout – Time limit for establishing a TCP connection
- Private subnet – Subnet without direct internet access
- NAT gateway – Provides outbound internet access
- VPC endpoint (PrivateLink) – Private connectivity to AWS services
- Security group egress – Outbound traffic rules
Steps at a Glance
- Confirm the error is a connection timeout
- Verify outbound network access
- Check NAT gateway or VPC endpoint configuration
- Validate security group and NACL rules
- Retest the invocation
Detailed Steps
1. Confirm the Error Type
Ensure the error explicitly indicates a connect timeout, not a read timeout.
- Connect timeout: Cannot establish connection
- Read timeout: Connected, but response is slow
📌 This article applies only to Connect Timeout errors.
For Read timeout errors, see the following article:
AWS Bedrock Error: 'ReadTimeoutError' When Calling AWS Bedrock
2. Verify Outbound Network Access
If the workload runs in a private subnet, it must have one of the following:
Option A: NAT Gateway
- NAT gateway exists in a public subnet
- NAT gateway status is Available
- Private subnet route table includes:
0.0.0.0/0 → nat-xxxxxxxx
Without NAT, outbound connections fail.
Option B: VPC Endpoint (Preferred)
- VPC endpoint for Amazon Bedrock Runtime
- Endpoint associated with the private subnets
- Security groups allow HTTPS (TCP 443)
This avoids internet routing and NAT costs.
3. Check Security Group Egress Rules
Minimum outbound requirement:
- Protocol: TCP
- Port: 443
- Destination: Allowed (0.0.0.0/0 or endpoint SG)
Overly restrictive egress rules will cause connect timeouts.
4. Check Network ACLs (NACLs)
If NACLs are used:
- Outbound and return traffic must be allowed
- Ephemeral ports must be open
- Stateless rules must permit both directions
NACL misconfiguration can silently block connections.
5. Check Client Connect Timeout Settings
Aggressive client-side settings can cause premature failures.
Python (Boto3):
from botocore.config import Config
import boto3
config = Config(
connect_timeout=10,
read_timeout=120
)
client = boto3.client(
"bedrock-runtime",
config=config
)
Ensure the connect timeout is reasonable for the environment.
6. Retest the Invocation
After correcting:
- Network routing
- NAT or VPC endpoint setup
- Security group and NACL rules
- Client timeout configuration
Retry the Bedrock call.
If it succeeds, the root cause was network reachability.
Pro Tips
ConnectTimeoutErrormeans no connection was made- Lambda loses internet access when attached to a VPC
- NAT is the fastest fix; endpoints are the cleanest fix
- Security group egress is a common oversight
- Read timeouts and connect timeouts are different failures
Conclusion
ConnectTimeoutError occurs when the client cannot reach AWS Bedrock at all.
Once:
- Outbound access is restored
- Routing is correct
- Security rules allow HTTPS
- Client timeouts are sane
The connection establishes and inference proceeds.
Fix connectivity first.
Then retry.
Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.
Comments
Post a Comment