What does Operation not allowed mean?

It is an access error. Bedrock is refusing the request because the model is not enabled, the caller lacks permission, or the request targets a resource that is not available.

I gave AdministratorAccess and it still fails. Why?

IAM permission is not enough by itself. Bedrock also requires model access to be granted for that model in that region.

Does the Bedrock API key bypass IAM?

No. The key is tied to a principal and its permissions. It does not grant model access on its own.

How do I see the exact denied action?

Use CloudTrail. The event shows the API call, the principal, the region, and the error code.

Amazon Bedrock "Operation Not Allowed": The Real Fix

You enable a Claude model, wire up the SDK, and the first request returns AccessDeniedException: Operation not allowed. The message is vague, and the obvious fixes do not always work because there are several independent gates in front of a Bedrock model.

This is the order to check them in.

Gate 1: Model access

Bedrock requires you to request access to each model. IAM permission says "this principal may call Bedrock." Model access says "this account may use this model."

Open the Bedrock console, go to model access, and check the model status. If it is not granted, request it and wait for approval. Some models are instant; others take time.

This is the most common cause after a fresh account setup, and it is the one people miss because the IAM policy looks correct.

Gate 2: IAM permissions

The caller needs permission for the runtime actions, not just the control plane:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*"
    }
  ]
}

Attach that to the user or role that makes the request. If you use an assumed role, confirm the role you think you are using is the one in the error.

Resource: "*" is fine for debugging. Scope it down once it works. For production, restrict it to the model and inference profile ARNs you actually use.

If your organization uses service control policies, check those too. An SCP can deny Bedrock even when the identity policy allows it.

Gate 3: Region

Bedrock is regional. A model enabled in us-east-1 is not automatically available in eu-west-1.

Set the region explicitly:

aws bedrock-runtime converse \
  --region us-east-1 \
  --model-id YOUR_MODEL_ID \
  --messages '[{"role":"user","content":[{"text":"hello"}]}]'

If that works in one region and fails in another, you have found the problem. Enable the model in the second region, or change the region in your application.

Gate 4: Model ID

Bedrock model IDs are not the same as Anthropic API model names. Some models also require an inference profile ID rather than the foundation model ID.

Copy the exact identifier from the Bedrock console. Do not reconstruct it from memory. If the console shows a profile ARN, use that where the SDK expects a model ID.

Gate 5: Credentials and API keys

If you are using a Bedrock API key, remember that it is a bearer token tied to a principal. It does not add permissions that the principal does not have.

Confirm the key has not expired.
Confirm the key was created in the right account.
Confirm the principal behind it has the runtime actions.
Revoke and recreate the key if you suspect it is stale.

If you are using an AWS profile, confirm it is the active one:

aws sts get-caller-identity

The account and ARN in the output must match the account where you enabled the model.

Gate 6: CloudTrail

When the error is still unclear, CloudTrail shows the denied call. Look for the event with the error code, the principal, the region, and the model identifier. That tells you which gate rejected the request instead of guessing.

Common error codes and what they mean:

AccessDeniedException with "not authorized" - IAM policy or SCP.
AccessDeniedException with "Operation not allowed" - model access or regional availability.
ResourceNotFoundException - wrong model ID or wrong region.
ThrottlingException - quota, not permission.
ValidationException - malformed request body.

A five-minute checklist

Model access granted in this account?
Runtime actions allowed in IAM?
Region identical in console and code?
Exact model or inference profile ID?
Credentials belong to the same account?
SCP or permission boundary blocking it?
CloudTrail showing a different error than you assumed?

Work down the list in order. Changing IAM when the real problem is model access just adds noise.

Final thoughts

"Operation not allowed" is not one bug. It is the generic response when one of several access checks fails. Enable the model, allow the runtime actions, match the region, and use the exact ID from the console. If it still fails, let CloudTrail tell you which gate is closed.