anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

AWS Bedrock Custom Inference Profiles Not Supported - Getting AI_APICallError: Forbidden #1798

New Issue
Open
opened 2026-02-16 17:32:40 -05:00 by yindo · 11 comments
yindo commented 2026-02-16 17:32:40 -05:00
Owner
Copy Link
Copy Source

Originally created by @ncino-chamby9 on GitHub (Sep 23, 2025).

Originally assigned to: @rekram1-node on GitHub.

Summary
OpenCode fails to work with custom AWS Bedrock inference profiles, returning AI_APICallError: Forbidden errors. The tool appears to only support direct foundational model access rather than custom inference profiles.
Environment

Tool: OpenCode
Provider: Amazon Bedrock
AWS Region: us-east-1
Inference Profile Type: Custom/Application inference profile

Expected Behavior
OpenCode should be able to utilize AWS Bedrock custom inference profiles just like direct foundational model access.

Actual Behavior
When attempting to use a custom AWS Bedrock inference profile, OpenCode returns:
AI_APICallError: Forbidden
The same AWS credentials and inference profile work correctly with:

AWS CLI (aws bedrock-runtime invoke-model)
Direct API calls to Bedrock
Other Bedrock-compatible tools (Claude Code)

Root Cause Analysis
The issue appears to stem from OpenCode making API calls that expect direct foundational model ARNs rather than inference profile ARNs. Custom inference profiles use a different ARN format and may require different API endpoints or permissions.
Direct Model ARN Format:
arn:aws:bedrock:[region]::foundation-model/[model-id]
Inference Profile ARN Format:
arn:aws:bedrock:[region]:[account]:application-inference-profile/[profile-name]
Steps to Reproduce

Create a custom AWS Bedrock inference profile in your AWS account
Configure OpenCode to use the inference profile ARN as the model identifier
Attempt to make any AI-assisted code generation request
Observe the AI_APICallError: Forbidden error

Workaround:
None

Proposed Solution
OpenCode should be updated to:

Detect inference profile ARNs and route requests appropriately
Support both model types transparently to the user
Use correct API endpoints for inference profile invocations
Handle authentication for custom profiles (which may require different IAM permissions)

Additional Context

AWS Bedrock inference profiles are a supported feature for enterprise customers
Other AI development tools (like Claude Code) have successfully implemented support for both direct models and inference profiles
This affects teams using AWS Bedrock in production environments where inference profiles are standard practice

Requested Priority
High - This blocks adoption of OpenCode as a tool in our business

Originally created by @ncino-chamby9 on GitHub (Sep 23, 2025). Originally assigned to: @rekram1-node on GitHub. Summary OpenCode fails to work with custom AWS Bedrock inference profiles, returning AI_APICallError: Forbidden errors. The tool appears to only support direct foundational model access rather than custom inference profiles. Environment Tool: OpenCode Provider: Amazon Bedrock AWS Region: us-east-1 Inference Profile Type: Custom/Application inference profile Expected Behavior OpenCode should be able to utilize AWS Bedrock custom inference profiles just like direct foundational model access. Actual Behavior When attempting to use a custom AWS Bedrock inference profile, OpenCode returns: AI_APICallError: Forbidden The same AWS credentials and inference profile work correctly with: AWS CLI (aws bedrock-runtime invoke-model) Direct API calls to Bedrock Other Bedrock-compatible tools (Claude Code) Root Cause Analysis The issue appears to stem from OpenCode making API calls that expect direct foundational model ARNs rather than inference profile ARNs. Custom inference profiles use a different ARN format and may require different API endpoints or permissions. Direct Model ARN Format: arn:aws:bedrock:[region]::foundation-model/[model-id] Inference Profile ARN Format: arn:aws:bedrock:[region]:[account]:application-inference-profile/[profile-name] Steps to Reproduce Create a custom AWS Bedrock inference profile in your AWS account Configure OpenCode to use the inference profile ARN as the model identifier Attempt to make any AI-assisted code generation request Observe the AI_APICallError: Forbidden error Workaround: None Proposed Solution OpenCode should be updated to: Detect inference profile ARNs and route requests appropriately Support both model types transparently to the user Use correct API endpoints for inference profile invocations Handle authentication for custom profiles (which may require different IAM permissions) Additional Context AWS Bedrock inference profiles are a supported feature for enterprise customers Other AI development tools (like Claude Code) have successfully implemented support for both direct models and inference profiles This affects teams using AWS Bedrock in production environments where inference profiles are standard practice Requested Priority High - This blocks adoption of OpenCode as a tool in our business
yindo commented 2026-02-16 17:32:40 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Sep 23, 2025):

I will look into this for you

@rekram1-node commented on GitHub (Sep 23, 2025): I will look into this for you
yindo commented 2026-02-16 17:32:40 -05:00
Author
Owner
Copy Link
Copy Source

@ncino-chamby9 commented on GitHub (Sep 26, 2025):

Hello, I can see that a fix has been implemented. Do you have any instructions as to how to test this on my end?

@ncino-chamby9 commented on GitHub (Sep 26, 2025): Hello, I can see that a fix has been implemented. Do you have any instructions as to how to test this on my end?
yindo commented 2026-02-16 17:32:40 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Sep 26, 2025):

@ncino-chamby9 you could clone the fork that cp90 made: https://github.com/cp90-pixel/opencode

then locally run:

bun i
bun run dev

and see if it works

@rekram1-node commented on GitHub (Sep 26, 2025): @ncino-chamby9 you could clone the fork that cp90 made: https://github.com/cp90-pixel/opencode then locally run: bun i bun run dev and see if it works
yindo commented 2026-02-16 17:32:40 -05:00
Author
Owner
Copy Link
Copy Source

@BrunoMazzo commented on GitHub (Oct 11, 2025):

I did have this same problem. I was able to fix it using as a custom provider. I went to https://github.com/sst/models.dev/tree/dev/providers/amazon-bedrock/models to copy the configurations for the model I was going to use, and then just reimplemented using the inference profile as the ID.

"provider": {
    "myprovider": {
      "id": "my-amazon-bedrock",
      "npm": "@ai-sdk/amazon-bedrock",
      "name": "My Amazon Bedrock",
      "env": ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"],
      "models": {
        "arn:aws:bedrock:us-west-2:XXXXXXXXX:application-inference-profile/XXXXXXXXX": {
          "id": "arn:aws:bedrock:us-west-2:XXXXXXXXX:application-inference-profile/XXXXXXXXX",
          "name": "Claude Sonnet 4.5",
          "attachment": true,
          "reasoning": true,
          "temperature": true,
          "tool_call": true,
          "release_date": "2025-09-29",
          "modalities": {
            "input": ["text", "image"],
            "output": ["text"]
          },
          "open_weights": false,
          "cost": {
            "input": 3,
            "output": 15,
            "cache_read": 0.3,
            "cache_write": 3.75
          },
          "limit": {
            "context": 200000,
            "output": 64000
          }
        }
      }
    }
  }
@BrunoMazzo commented on GitHub (Oct 11, 2025): I did have this same problem. I was able to fix it using as a custom provider. I went to https://github.com/sst/models.dev/tree/dev/providers/amazon-bedrock/models to copy the configurations for the model I was going to use, and then just reimplemented using the inference profile as the ID. ``` "provider": { "myprovider": { "id": "my-amazon-bedrock", "npm": "@ai-sdk/amazon-bedrock", "name": "My Amazon Bedrock", "env": ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"], "models": { "arn:aws:bedrock:us-west-2:XXXXXXXXX:application-inference-profile/XXXXXXXXX": { "id": "arn:aws:bedrock:us-west-2:XXXXXXXXX:application-inference-profile/XXXXXXXXX", "name": "Claude Sonnet 4.5", "attachment": true, "reasoning": true, "temperature": true, "tool_call": true, "release_date": "2025-09-29", "modalities": { "input": ["text", "image"], "output": ["text"] }, "open_weights": false, "cost": { "input": 3, "output": 15, "cache_read": 0.3, "cache_write": 3.75 }, "limit": { "context": 200000, "output": 64000 } } } } } ```
yindo commented 2026-02-16 17:32:40 -05:00
Author
Owner
Copy Link
Copy Source

@gimbo commented on GitHub (Oct 17, 2025):

@BrunoMazzo Thanks — that custom provider approach looks very promising. Unfortunately, I can't get it to work — an auth issue related to SSO, it seems. I'd sorely appreciate any guidance on getting this up and running...

As I'm authenticating via SSO, I don't have AWS_ACCESS_KEY_ID or AWS_SECRET_KEY env vars; instead I create a session (via aws sso login) and then the env var AWS_PROFILE should be used. The standard amazon-bedrock provider seems to deal with this just fine, apparently picking up AWS_PROFILE from the environment without explicitly being told to do so, and going from there: I can query (say) Sonnet 3.7 just fine. But if I try with a custom provider as described by you above, it doesn't like it:

Error: AWS SigV4 authentication requires AWS credentials. Please provide either:
1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
2. Provide accessKeyId and secretAccessKey in options
3. Use a credentialProvider function
4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option
Original error: AWS access key ID setting is missing. Pass it using the 'accessKeyId' parameter or the AWS_ACCESS_KEY_ID environment variable.

I suspect (just a hunch) the custom config needs something else to ensure authentication happens via a credential provider chain which would find the credentials without assuming IAM access key/secret in env var.

In fact, I think this is the relevant bit of the stock amazon-bedrock provider — setting up a fromNodeProviderChain() credentials provider instance. Unfortunately, I don't know how to translate that into config JSON or if that's even possible, as that code involves e.g. JS module imports. 🤷‍♂️

@gimbo commented on GitHub (Oct 17, 2025): @BrunoMazzo Thanks — that custom provider approach looks very promising. Unfortunately, I can't get it to work — an auth issue related to SSO, it seems. I'd sorely appreciate any guidance on getting this up and running... As I'm authenticating via SSO, I don't have `AWS_ACCESS_KEY_ID` or `AWS_SECRET_KEY` env vars; instead I create a session (via `aws sso login`) and then the env var `AWS_PROFILE` should be used. The standard `amazon-bedrock` provider seems to deal with this just fine, apparently picking up `AWS_PROFILE` from the environment without explicitly being told to do so, and going from there: I can query (say) Sonnet 3.7 just fine. But if I try with a custom provider as described by you above, it doesn't like it: ``` Error: AWS SigV4 authentication requires AWS credentials. Please provide either: 1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables 2. Provide accessKeyId and secretAccessKey in options 3. Use a credentialProvider function 4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option Original error: AWS access key ID setting is missing. Pass it using the 'accessKeyId' parameter or the AWS_ACCESS_KEY_ID environment variable. ``` I suspect (just a hunch) the custom config needs something else to ensure authentication happens [via a credential provider chain](https://ai-sdk.dev/providers/ai-sdk-providers/amazon-bedrock#using-aws-sdk-credentials-chain-instance-profiles-instance-roles-ecs-roles-eks-service-accounts-etc) which would find the credentials without assuming IAM access key/secret in env var. In fact, I _think_ [this](https://github.com/sst/opencode/blob/dev/packages/opencode/src/provider/provider.ts#L80) is the relevant bit of the stock `amazon-bedrock` provider — setting up a [`fromNodeProviderChain()`](https://github.com/aws/aws-sdk-js-v3/tree/main/packages/credential-providers#fromnodeproviderchain) credentials provider instance. Unfortunately, I don't know how to translate that into config JSON or if that's even possible, as that code involves e.g. JS module imports. 🤷‍♂️
yindo commented 2026-02-16 17:32:40 -05:00
Author
Owner
Copy Link
Copy Source

@LordPrkr commented on GitHub (Jan 7, 2026):

@gimbo Have you had any success? I'm unfortunately running into the same issue with SSO authentication and the custom provider approach.

@LordPrkr commented on GitHub (Jan 7, 2026): @gimbo Have you had any success? I'm unfortunately running into the same issue with SSO authentication and the custom provider approach.
yindo commented 2026-02-16 17:32:40 -05:00
Author
Owner
Copy Link
Copy Source

@alfredolopezzz commented on GitHub (Jan 9, 2026):

Hi! I was able to successfully get AWS Bedrock's Application Inference Profiles (AIPs) working with OpenCode. Here's what I found:

Working Configuration

Application Inference Profile ARNs can be added directly to your opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "amazon-bedrock": {
      "models": {
        "arn:aws:bedrock:eu-west-1:<ACCOUNT_ID>:application-inference-profile/<AIP_PROFILE_ID>": {
          "name": "My AIP Profile",
          "options": {
            "thinking": {
              "type": "enabled",
              "budgetTokens": 1024
            }
          }
        }
      },
      "options": {
        "region": "eu-west-1",
        "profile": "my_aws_profile"
      }
    }
  }
}

After configuring AWS SSO (aws sso login --profile my_aws_profile), the ARN appears in the model list and works correctly.

Version-Specific Behavior

I noticed different authentication behavior between versions:

  • Development version (bun run dev from fork): Works fine with profile configured in opencode.json
  • Brew version (1.0.220): Requires additionally theAWS_PROFILE environment variable to be set explicitly: 
    AWS_PROFILE=my_aws_profile opencode
    (Without the environment variable, I get the same AWS SigV4 authentication requires AWS credentials error that @gimbo reported.)
@alfredolopezzz commented on GitHub (Jan 9, 2026): Hi! I was able to successfully get AWS Bedrock's Application Inference Profiles (AIPs) working with OpenCode. Here's what I found: ## Working Configuration Application Inference Profile ARNs can be added directly to your `opencode.json`: ```json { "$schema": "https://opencode.ai/config.json", "provider": { "amazon-bedrock": { "models": { "arn:aws:bedrock:eu-west-1:<ACCOUNT_ID>:application-inference-profile/<AIP_PROFILE_ID>": { "name": "My AIP Profile", "options": { "thinking": { "type": "enabled", "budgetTokens": 1024 } } } }, "options": { "region": "eu-west-1", "profile": "my_aws_profile" } } } } ``` After configuring AWS SSO (`aws sso login --profile my_aws_profile`), the ARN appears in the model list and works correctly. ## Version-Specific Behavior I noticed different authentication behavior between versions: - **Development version** (`bun run dev` from fork): Works fine with profile configured in `opencode.json` - **Brew version (1.0.220)**: Requires additionally the`AWS_PROFILE` environment variable to be set explicitly: ```bash AWS_PROFILE=my_aws_profile opencode ``` (Without the environment variable, I get the same `AWS SigV4 authentication requires AWS credentials` error that @gimbo reported.)
yindo commented 2026-02-16 17:32:40 -05:00
Author
Owner
Copy Link
Copy Source

@nandisc commented on GitHub (Jan 9, 2026):

I was able to confirm that the above solution works for version 1.1.8 of opencode. It even shows a nice error message if your AWS SSO session is not authenticated.

@nandisc commented on GitHub (Jan 9, 2026): I was able to confirm that the above solution works for version `1.1.8` of opencode. It even shows a nice error message if your AWS SSO session is not authenticated.
yindo commented 2026-02-16 17:32:40 -05:00
Author
Owner
Copy Link
Copy Source

@Asdafers commented on GitHub (Jan 21, 2026):

I keep getting a message - "Forbidden: {"Message":"Invalid API Key format: Must start with pre-defined prefix"}", what am I doing wrong? I got the opencode.json setup as above, model selected, sso done, variables exported ... what did I miss?

@Asdafers commented on GitHub (Jan 21, 2026): I keep getting a message - "Forbidden: {"Message":"Invalid API Key format: Must start with pre-defined prefix"}", what am I doing wrong? I got the opencode.json setup as above, model selected, sso done, variables exported ... what did I miss?
yindo commented 2026-02-16 17:32:40 -05:00
Author
Owner
Copy Link
Copy Source

@peloyeje commented on GitHub (Feb 3, 2026):

@Asdafers try to look for any residual (and wrong) auth info for amazon-bedrock in ~/.local/share/opencode/auth.json. I had leftovers from a previous config attempt (using Anthropic API key auth), deleting it solved it for me

@peloyeje commented on GitHub (Feb 3, 2026): @Asdafers try to look for any residual (and wrong) auth info for `amazon-bedrock` in `~/.local/share/opencode/auth.json`. I had leftovers from a previous config attempt (using Anthropic API key auth), deleting it solved it for me
yindo commented 2026-02-16 17:32:40 -05:00
Author
Owner
Copy Link
Copy Source

@artemptushkin commented on GitHub (Feb 5, 2026):

☝️ this worked for me thx

@artemptushkin commented on GitHub (Feb 5, 2026): ☝️ this worked for me thx
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#1798
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?