Bedrock authorization errors with regional access

Last updated: February 13, 2026

Summary

AWS Bedrock Claude model requests fail with authorization errors like:

User: arn:aws:iam::XXXXXXXXXXXX:user/service-accounts/braintrust/braintrust-XXXXXXX is not authorized to perform: bedrock:InvokeModelWithResponseStream on resource: arn:aws:bedrock:us-east-2::foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0 because no identity-based policy allows the bedrock:InvokeModelWithResponseStream action

When service account policies lack regional access permissions. The issue is resolved by updating the AWS service account IAM policy to include bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream permissions for the target regions.

Applicable To

Plans: Enterprise

Deployments: Hybrid

Use case: AWS Bedrock Claude models with service account authentication

Resolution Steps

Step 1: Validate service account policy

Make sure you IAM account has access to Bedrock invocation permissions to your AWS service account IAM policy. 

Multi-region access example

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockInvokeFoundationModelsMultiRegion",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:*::foundation-model/*"
    }
  ]
}

Step 2: Verify regional access

Ensure the service account policy allows access to the specific AWS region where your Bedrock models are hosted. This is especially important when using inference profiles that require access to specific regions.

Region specific policy example

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockInvokeFoundationModelsTwoRegions",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:us-east-1::foundation-model/*",
        "arn:aws:bedrock:us-west-2::foundation-model/*"
      ]
    }
  ]
}

Step 3: Test invocation

Make a test call to your Bedrock Claude model to confirm authorization is working.

Note that the policies here are just examples, you should validate the AWS documentation for accurate guidance on how to set up your IAM policy for access to Bedrock

Relevant Links