Access keys and secrets are not getting passed when creating the session

[rajib76]

Checks

• I have updated to the lastest minor and patch version of Strands
• I have checked the documentation and this is not expected behavior
• I have searched ./issues and there are no duplicates of my issue

Strands Version

0.1.1

Python Version

3.11

Operating System

windows

Installation Method

pip

Steps to Reproduce

Although, I have the keys and secret in .env. I am getting "Your account is not authorized to invoke this API operation."

Below is the code I am running

boto_session = boto3.session.Session(aws_access_key_id=AWS_ACCESS_KEY_ID,
                                     aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
                                     region_name="us-west-1")

bedrock_model = BedrockModel(
    model_id="us.anthropic.claude-3-7-sonnet-20250219-v1:0",
    temperature=0.3,
    boto_session=boto_session
)
agent = Agent(model=bedrock_model)

# Ask the agent a question
agent("Tell me about agentic AI")

To make it work, I had to update

strands/models/bedrock.py code as below

        # updated self.client as below

class BedrockModel(Model):
        ....
        ....
        self.client = boto3.client('bedrock-runtime', region_name="us-east-1")
        # self.client = session.client(
        #     service_name="bedrock-runtime",
        #     config=client_config,
        # )

Expected Behavior

It should not give me access violation as I already have access

Actual Behavior

getting error as "Your account is not authorized to invoke this API operation."

Additional Context

No response

Possible Solution

No response

Related Issues

No response

[awsarron]

Thank you for reporting this issue @rajib76.

In your first code sample the us-west-1 region is used. In your second code sample the us-east-1 region is used. Amazon Bedrock is not available in the us-west-1 (N. California) region - https://docs.aws.amazon.com/bedrock/latest/userguide/models-supported.html.

Does this sample work for you:

boto_session = boto3.session.Session(aws_access_key_id=AWS_ACCESS_KEY_ID,
                                     aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
                                     region_name="us-east-1")

bedrock_model = BedrockModel(
    model_id="us.anthropic.claude-3-7-sonnet-20250219-v1:0",
    temperature=0.3,
    boto_session=boto_session
)
agent = Agent(model=bedrock_model)

# Ask the agent a question
agent("Tell me about agentic AI")

[rajib76]

No, I tried this as well. Looks like the access key and secret key are not getting passed to the client

Got the same error
botocore.errorfactory.AccessDeniedException: An error occurred (AccessDeniedException) when calling the ConverseStream operation: You don't have access to the model with the specified model ID.

Here is the code

import os

import boto3
from dotenv import load_dotenv
from strands import Agent
from strands.models import BedrockModel
from strands.models.litellm import LiteLLMModel

load_dotenv()
AWS_ACCESS_KEY_ID = os.environ.get("AWS_ACCESS_KEY_ID")
AWS_SECRET_ACCESS_KEY = os.environ.get("AWS_SECRET_ACCESS_KEY")
OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY")

boto_session = boto3.session.Session(aws_access_key_id=AWS_ACCESS_KEY_ID,
                                     aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
                                     region_name="us-west-1")

bedrock_model = BedrockModel(
    model_id="us.anthropic.claude-3-7-sonnet-20250219-v1:0",
    temperature=0.3,
    boto_session=boto_session
)

# Create a BedrockModel
model = BedrockModel(
    model_id="us.anthropic.claude-3-7-sonnet-20250219-v1:0",
    temperature=0.3
)


# model = LiteLLMModel(
#     client_args={
#         "api_key": OPENAI_API_KEY,
#     },
#     # **model_config
#     model_id="openai/gpt-4o",
#     params={
#         "max_tokens": 1000,
#         "temperature": 0.7,
#     }
# )

agent = Agent(model=model)

# Ask the agent a question
agent("Tell me about agentic AI")

[awsarron]

Thanks for the additional information.

In this case using the us-east-1 region the error message is different:

botocore.errorfactory.AccessDeniedException: An error occurred (AccessDeniedException) when calling the ConverseStream operation: You don't have access to the model with the specified model ID.

You will need to enable Claude 3.7 Sonnet model access in Amazon Bedrock us-east-1 region in your AWS account: https://strandsagents.com/0.1.x/user-guide/concepts/model-providers/amazon-bedrock/#requesting-access-to-bedrock-models_1

[rajib76]

I tried with us-west-1 also. It is the same error

botocore.errorfactory.AccessDeniedException: An error occurred (AccessDeniedException) when calling the ConverseStream operation: You don't have access to the model with the specified model ID.

However, if I change the code in bedrock.py as below, it works

self.client=boto3.client('bedrock-runtime', region_name="us-east-1")

[awsarron]

The error message shown is because model access has not been enabled in your AWS account. Try these steps:

1. Enable model access for Claude 3.7 Sonnet in your desired AWS region (us-east-1 in this example) following https://strandsagents.com/0.1.x/user-guide/concepts/model-providers/amazon-bedrock/#requesting-access-to-bedrock-models_1
2. Run your code sample, changing the region from us-west-1 to us-east-1 (Bedrock is not available in us-west-1):

import os

import boto3
from dotenv import load_dotenv
from strands import Agent
from strands.models import BedrockModel
from strands.models.litellm import LiteLLMModel

load_dotenv()
AWS_ACCESS_KEY_ID = os.environ.get("AWS_ACCESS_KEY_ID")
AWS_SECRET_ACCESS_KEY = os.environ.get("AWS_SECRET_ACCESS_KEY")
OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY")

boto_session = boto3.session.Session(aws_access_key_id=AWS_ACCESS_KEY_ID,
                                     aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
                                     region_name="us-east-1")

bedrock_model = BedrockModel(
    model_id="us.anthropic.claude-3-7-sonnet-20250219-v1:0",
    temperature=0.3,
    boto_session=boto_session
)

# Create a BedrockModel
model = BedrockModel(
    model_id="us.anthropic.claude-3-7-sonnet-20250219-v1:0",
    temperature=0.3
)


# model = LiteLLMModel(
#     client_args={
#         "api_key": OPENAI_API_KEY,
#     },
#     # **model_config
#     model_id="openai/gpt-4o",
#     params={
#         "max_tokens": 1000,
#         "temperature": 0.7,
#     }
# )

agent = Agent(model=model)

# Ask the agent a question
agent("Tell me about agentic AI")

[rajib76]

I already enabled the model access, it works if I change the code in bedrock.py

[awsarron]

Ah, thanks for confirming! In your code there is bedrock_model and model defined. model doesn't use the boto session that specifies the us-east-1 region.

Here is the sample corrected:

import os

import boto3
from dotenv import load_dotenv
from strands import Agent
from strands.models import BedrockModel
from strands.models.litellm import LiteLLMModel

load_dotenv()
AWS_ACCESS_KEY_ID = os.environ.get("AWS_ACCESS_KEY_ID")
AWS_SECRET_ACCESS_KEY = os.environ.get("AWS_SECRET_ACCESS_KEY")
OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY")

boto_session = boto3.session.Session(aws_access_key_id=AWS_ACCESS_KEY_ID,
                                     aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
                                     region_name="us-east-1")

bedrock_model = BedrockModel(
    model_id="us.anthropic.claude-3-7-sonnet-20250219-v1:0",
    temperature=0.3,
    boto_session=boto_session
)

agent = Agent(model=bedrock_model)

# Ask the agent a question
agent("Tell me about agentic AI")

[rajib76]

I think the problem is in the below part in bedrock.py

        session = boto_session or boto3.Session(
            region_name=region_name or "us-west-1",
        )

If I change the above to

        session = boto_session or boto3.Session(
            region_name=region_name or "us-east-1",
        )

it works.

But ideally since I passed boto_session, boto3.Session should not have any impact, but not sure why it works if change to "us-east-1" in the above

[rajib76]

I found the issue, it works. I was making a mistake. Thanks you are right. The change to "us-east-1" made it work. May be the error message could be made more expressive.

import os

import boto3
from dotenv import load_dotenv
from strands import Agent
from strands.models import BedrockModel
from strands.models.litellm import LiteLLMModel

load_dotenv()
AWS_ACCESS_KEY_ID = os.environ.get("AWS_ACCESS_KEY_ID")
AWS_SECRET_ACCESS_KEY = os.environ.get("AWS_SECRET_ACCESS_KEY")
OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY")

boto_session = boto3.session.Session(aws_access_key_id=AWS_ACCESS_KEY_ID,
                                     aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
                                     region_name="us-east-1")

model = BedrockModel(
    model_id="us.anthropic.claude-3-7-sonnet-20250219-v1:0",
    temperature=0.3,
    boto_session=boto_session
)


# model = LiteLLMModel(
#     client_args={
#         "api_key": OPENAI_API_KEY,
#     },
#     # **model_config
#     model_id="openai/gpt-4o",
#     params={
#         "max_tokens": 1000,
#         "temperature": 0.7,
#     }
# )

agent = Agent(model=model)

# Ask the agent a question
agent("Tell me about agentic AI")

[awsarron]

Glad to hear it's working for you 🥳🚀!!

The errors from the model provider are returned directly as is, in this case from the Amazon Bedrock APIs. I have taken a note to make this clearer in the Bedrock model provider documentation as well, thank you for the feedback.

Looking forward to see what you build on Strands Agents ☺️.