AWS Bedrock Custom Inference Profiles Not Supported - Getting AI_APICallError: Forbidden

Summary
OpenCode fails to work with custom AWS Bedrock inference profiles, returning AI_APICallError: Forbidden errors. The tool appears to only support direct foundational model access rather than custom inference profiles.
Environment

Tool: OpenCode
Provider: Amazon Bedrock
AWS Region: us-east-1
Inference Profile Type: Custom/Application inference profile

Expected Behavior
OpenCode should be able to utilize AWS Bedrock custom inference profiles just like direct foundational model access.

Actual Behavior
When attempting to use a custom AWS Bedrock inference profile, OpenCode returns:
AI_APICallError: Forbidden
The same AWS credentials and inference profile work correctly with:

AWS CLI (aws bedrock-runtime invoke-model)
Direct API calls to Bedrock
Other Bedrock-compatible tools (Claude Code)

Root Cause Analysis
The issue appears to stem from OpenCode making API calls that expect direct foundational model ARNs rather than inference profile ARNs. Custom inference profiles use a different ARN format and may require different API endpoints or permissions.
Direct Model ARN Format:
arn:aws:bedrock:[region]::foundation-model/[model-id]
Inference Profile ARN Format:
arn:aws:bedrock:[region]:[account]:application-inference-profile/[profile-name]
Steps to Reproduce

Create a custom AWS Bedrock inference profile in your AWS account
Configure OpenCode to use the inference profile ARN as the model identifier
Attempt to make any AI-assisted code generation request
Observe the AI_APICallError: Forbidden error

Workaround:
None

Proposed Solution
OpenCode should be updated to:

Detect inference profile ARNs and route requests appropriately
Support both model types transparently to the user
Use correct API endpoints for inference profile invocations
Handle authentication for custom profiles (which may require different IAM permissions)

Additional Context

AWS Bedrock inference profiles are a supported feature for enterprise customers
Other AI development tools (like Claude Code) have successfully implemented support for both direct models and inference profiles
This affects teams using AWS Bedrock in production environments where inference profiles are standard practice

Requested Priority
High - This blocks adoption of OpenCode as a tool in our business

I will look into this for you

Hello, I can see that a fix has been implemented. Do you have any instructions as to how to test this on my end?

@ncino-chamby9

@ncino-chamby9 you could clone the fork that cp90 made: https://github.com/cp90-pixel/opencode

then locally run:

bun i
bun run dev

and see if it works

I did have this same problem. I was able to fix it using as a custom provider. I went to https://github.com/sst/models.dev/tree/dev/providers/amazon-bedrock/models to copy the configurations for the model I was going to use, and then just reimplemented using the inference profile as the ID.

"provider": {
    "myprovider": {
      "id": "my-amazon-bedrock",
      "npm": "@ai-sdk/amazon-bedrock",
      "name": "My Amazon Bedrock",
      "env": ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"],
      "models": {
        "arn:aws:bedrock:us-west-2:XXXXXXXXX:application-inference-profile/XXXXXXXXX": {
          "id": "arn:aws:bedrock:us-west-2:XXXXXXXXX:application-inference-profile/XXXXXXXXX",
          "name": "Claude Sonnet 4.5",
          "attachment": true,
          "reasoning": true,
          "temperature": true,
          "tool_call": true,
          "release_date": "2025-09-29",
          "modalities": {
            "input": ["text", "image"],
            "output": ["text"]
          },
          "open_weights": false,
          "cost": {
            "input": 3,
            "output": 15,
            "cache_read": 0.3,
            "cache_write": 3.75
          },
          "limit": {
            "context": 200000,
            "output": 64000
          }
        }
      }
    }
  }

@BrunoMazzo

@BrunoMazzo Thanks — that custom provider approach looks very promising. Unfortunately, I can't get it to work — an auth issue related to SSO, it seems. I'd sorely appreciate any guidance on getting this up and running...

As I'm authenticating via SSO, I don't have AWS_ACCESS_KEY_ID or AWS_SECRET_KEY env vars; instead I create a session (via aws sso login) and then the env var AWS_PROFILE should be used. The standard amazon-bedrock provider seems to deal with this just fine, apparently picking up AWS_PROFILE from the environment without explicitly being told to do so, and going from there: I can query (say) Sonnet 3.7 just fine. But if I try with a custom provider as described by you above, it doesn't like it:

Error: AWS SigV4 authentication requires AWS credentials. Please provide either:
1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
2. Provide accessKeyId and secretAccessKey in options
3. Use a credentialProvider function
4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option
Original error: AWS access key ID setting is missing. Pass it using the 'accessKeyId' parameter or the AWS_ACCESS_KEY_ID environment variable.

I suspect (just a hunch) the custom config needs something else to ensure authentication happens via a credential provider chain which would find the credentials without assuming IAM access key/secret in env var.

In fact, I think this is the relevant bit of the stock amazon-bedrock provider — setting up a fromNodeProviderChain() credentials provider instance. Unfortunately, I don't know how to translate that into config JSON or if that's even possible, as that code involves e.g. JS module imports. 🤷‍♂️

@gimbo

@gimbo Have you had any success? I'm unfortunately running into the same issue with SSO authentication and the custom provider approach.

@gimbo

Hi! I was able to successfully get AWS Bedrock's Application Inference Profiles (AIPs) working with OpenCode. Here's what I found:

Working Configuration

Application Inference Profile ARNs can be added directly to your opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "amazon-bedrock": {
      "models": {
        "arn:aws:bedrock:eu-west-1:<ACCOUNT_ID>:application-inference-profile/<AIP_PROFILE_ID>": {
          "name": "My AIP Profile",
          "options": {
            "thinking": {
              "type": "enabled",
              "budgetTokens": 1024
            }
          }
        }
      },
      "options": {
        "region": "eu-west-1",
        "profile": "my_aws_profile"
      }
    }
  }
}

After configuring AWS SSO (aws sso login --profile my_aws_profile), the ARN appears in the model list and works correctly.

Version-Specific Behavior

I noticed different authentication behavior between versions:

Development version (bun run dev from fork): Works fine with profile configured in opencode.json
Brew version (1.0.220): Requires additionally theAWS_PROFILE environment variable to be set explicitly:
```
AWS_PROFILE=my_aws_profile opencode
```
(Without the environment variable, I get the same AWS SigV4 authentication requires AWS credentials error that @gimbo reported.)

I was able to confirm that the above solution works for version 1.1.8 of opencode. It even shows a nice error message if your AWS SSO session is not authenticated.

I keep getting a message - "Forbidden: {"Message":"Invalid API Key format: Must start with pre-defined prefix"}", what am I doing wrong? I got the opencode.json setup as above, model selected, sso done, variables exported ... what did I miss?

@Asdafers

@Asdafers try to look for any residual (and wrong) auth info for amazon-bedrock in ~/.local/share/opencode/auth.json. I had leftovers from a previous config attempt (using Anthropic API key auth), deleting it solved it for me

☝️ this worked for me thx

To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.

Navigation Menu

Repository navigation

AWS Bedrock Custom Inference Profiles Not Supported - Getting AI_APICallError: Forbidden #2746

Working Configuration

Version-Specific Behavior

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

AWS Bedrock Custom Inference Profiles Not Supported - Getting AI_APICallError: Forbidden #2746

Description

Activity

rekram1-node commented on Sep 23, 2025

ncino-chamby9 commented on Sep 26, 2025

rekram1-node commented on Sep 26, 2025

BrunoMazzo commented on Oct 11, 2025

gimbo commented on Oct 17, 2025

LordPrkr commented on Jan 7, 2026

alfredolopezzz commented on Jan 9, 2026

Working Configuration

Version-Specific Behavior

nandisc commented on Jan 9, 2026

Asdafers commented on Jan 21, 2026

peloyeje commented on Feb 3, 2026

artemptushkin commented on Feb 5, 2026

github-actions commented on Apr 7, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions