a.generation() Bedrock IAM role missing inference-profile permission (newer Claude models fail with AccessDeniedException)

[alternativereality-agent]

Describe the bug

When using a.generation() with newer Claude models (e.g. Claude Haiku 4.5, Claude Sonnet 4), the auto-generated AppSync IAM role only grants bedrock:InvokeModel on the foundation model ARN, but AWS routes requests through a cross-region inference profile (global.* or us.* prefix). This results in an AccessDeniedException at runtime.

Error message

User: arn:aws:sts::263556453558:assumed-role/GenerationBedrockDat.../APPSYNC_ASSUME_ROLE
is not authorized to perform: bedrock:InvokeModel on resource:
arn:aws:bedrock:us-west-2:263556453558:inference-profile/global.anthropic.claude-haiku-4-5-20251001-v1:0
because no identity-based policy allows the bedrock:InvokeModel action

Root cause

In grapqhl-generation-transformer.js, createBedrockDataSourceRole() only adds a policy for the foundation model ARN:

resources: [`arn:${partition}:bedrock:${region}::foundation-model/${bedrockModelId}`]

It does not include the account-scoped inference profile ARN (arn:aws:bedrock:*:ACCOUNT:inference-profile/*), which AWS requires when routing through cross-region inference.

This is the same root cause as #3162 (which affects a.conversation() + InvokeModelWithResponseStream) but affects a.generation() + InvokeModel.

Workaround (CDK escape hatch in backend.ts)

import { Role } from "aws-cdk-lib/aws-iam"

backend.data.node.findAll().forEach((construct) => {
  if (
    construct instanceof Role &&
    construct.node.id.startsWith("GenerationBedrockDataSource") &&
    construct.node.id.endsWith("IAMRole")
  ) {
    construct.addToPolicy(new PolicyStatement({
      effect: Effect.ALLOW,
      actions: ["bedrock:InvokeModel"],
      resources: [
        `arn:aws:bedrock:*:${backend.stack.account}:inference-profile/*`,
        `arn:aws:bedrock:*::foundation-model/anthropic.*`,
      ],
    }))
  }
})

Expected behavior

The auto-generated role should include both foundation model and inference profile ARNs, consistent with what is needed for current Bedrock model routing behavior.

Related issues

• Amplify AI Access Denied: Missing bedrock:InvokeModelWithResponseStream Permission #3162
• AI kit does not support Cross-region inference docs#8121
• AI Kit / AIConversation with Amazon Nova Micro not working in EU due to Cross-region inference #3218

[alternativereality-agent]

Additional findings: global. vs us. inference profile

The supportedModelsLookup in @aws-amplify/data-schema hardcodes all Claude 4.5/4.6 models to the global. cross-region inference profile:

'Claude Haiku 4.5': 'global.anthropic.claude-haiku-4-5-20251001-v1:0',
'Claude Sonnet 4.5': 'global.anthropic.claude-sonnet-4-5-20250929-v1:0',
// etc.

However, global. inference profiles require a global Marketplace subscription that may not be available in all accounts/regions. Users deployed in a single AWS region (e.g. us-west-2) may only have access to the us. cross-region inference profile.

Workaround — bypass the lookup with a raw resourcePath:

aiModel: { resourcePath: "us.anthropic.claude-haiku-4-5-20251001-v1:0" } as ReturnType<typeof a.ai.model>,

Feature request: Please add us. (and ideally eu./ap.) prefix variants to the supportedModelsLookup for all Claude 4.5/4.6 models, e.g.:

'Claude Haiku 4.5': 'us.anthropic.claude-haiku-4-5-20251001-v1:0',   // or expose regional variants
'Claude Haiku 4.5 (Global)': 'global.anthropic.claude-haiku-4-5-20251001-v1:0',

Or alternatively, document that users can pass a raw resourcePath object and remove the strict keyof typeof supportedModelsLookup type constraint so arbitrary inference profile IDs are accepted without a cast.