aws_bedrock_runtime:invoke_model not working

[hedleym]

Hello:

When I make the following call (using version aws─1.0.7+build.995.refd16d091 on OTP27.2):

aws_bedrock_runtime:invoke_model(Client, ModelId, Body)

Where:

ModelId = ~"us.anthropic.claude-3-5-sonnet-20241022-v2:0"

and

Body = #{<<"anthropic_version">> => <<"bedrock-2023-05-31">>,
<<"max_tokens">> => 1024,
<<"messages">> =>
[#{<<"content">> =>
[#{<<"text">> => <<"Hello world">>,<<"type">> => <<"text">>}],
<<"role">> => <<"user">>}]}

AWS responds with:

{error,#{<<"message">> =>
<<"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.">>},
{403,
[{<<"Date">>,<<"Mon, 20 Jan 2025 00:01:58 GMT">>},
{<<"Content-Type">>,<<"application/json">>},
{<<"Content-Length">>,<<"192">>},
{<<"Connection">>,<<"keep-alive">>},
{<<"x-amzn-RequestId">>,
<<"39c52d8a-a39c-42bb-a269-ec2735bdccc6">>},
{<<"x-amzn-ErrorType">>,
<<"InvalidSignatureException:http://internal.amazon.com/coral/com.amazon.coral.service/">>}],
#Ref<0.1110152351.2238447618.62956>}}

If I make the same request using the aws_cli, the query works (same credentials as above):

aws bedrock-runtime invoke-model --model-id "us.anthropic.claude-3
-5-sonnet-20241022-v2:0" --body "{"anthropic_version":"bedrock-2023-05-31","max_tokens":1024,"messages":[{"content":[{
"text":"Hello world","type":"text"}],"role":"user"}]}" output.txt
{
"contentType": "application/json"
}

file output.txt:

{"id":"msg_bdrk_013V7VAwj1mQxWZkqWWVK6pe","type":"message","role":"assistant","model":"claude-3-5-sonnet-20241022","content":[{"type":"text","text":"Hi! How are you today? I'm Claude, an AI assistant created by Anthropic. I aim to be direct and helpful while staying truthful about what I am. How can I help you?"}],"stop_reason":"end_turn","stop_sequence":null,"usage":{"input_tokens":9,"output_tokens":45}}

[onno-vos-dev]

Hi @hedleym 👋

Are you able to patch aws_bedrock_runtime.erl#L1168 temporarily and set it to true? Just for testing purposes, if so, I can generate the code with that value set to true so your patch can go out the window 👍

I'm unable to debug this myself as I currently don't have access to bedrock-runtime (don't have the setup for it) but I suspect you might be hit by: aws_signature.erl#L379-L382 which very innocently claims this is "fine" and I suspect this to be lies 😅

The error you're seeing is not in aws-erlang but rather coming from aws-signature which signs the request and sends a signature along with the request to AWS. AWS in turn calculates a signature based on your request and ensures those are equal. If not, you get the error you're seeing 🙂

My suspicion is some header is missing (most likely) or some encoding is wrong somewhere (unlikely). I can't see any issues with the encoding so my guess is that a header (the aforementioned <<"X-Amz-CheckSum-SHA256">>) is missing in the request but AWS does not provide a lot of info on the exact signature issues so it's a bit hard for me to debug...

[hedleym]

Hi @onno-vos-dev

I found the issue I was having. For the bedrock apis, the ModelId values typically have a ':' in the string, and this string is used to build the path. The path is URI encoded, which results in a '%" appearing in the encoded path, and then during the aws_signature:sign_v4 operation, it is expected that the uri_encode_path is true., which will further encode the % sign. To work around this in my fork of aws_erlang, I expose the Options in an aws_request:sign_request/6 function, and set the uri_encode_path to true in the aws_bedrock_* calls to aws_request:sign_request/6.

[onno-vos-dev]

Hi @hedleym Cool! Then that can easily be fixed in a similar fashion as #162 I'll roll out a fix shortly so you don't need to rely on a fork 👍

[onno-vos-dev]

Should be available in a few minutes on: https://hex.pm/packages/aws_erlang/1.0.10

[hedleym]

@onno-vos-dev, I believe so, although I am only testing bedrock-runtime and bedrock at the moment.

…

________________________________ From: Onno Vos ***@***.***> Sent: Monday, January 27, 2025 1:27 AM To: aws-beam/aws-erlang ***@***.***> Cc: Mark Hedley ***@***.***>; Mention ***@***.***> Subject: Re: [aws-beam/aws-erlang] aws_bedrock_runtime:invoke_model not working (Issue #161) @hedleym</~https://github.com/hedleym> I assume this goes for all aws_bedrock_* modules right? — Reply to this email directly, view it on GitHub<#161 (comment)>, or unsubscribe</~https://github.com/notifications/unsubscribe-auth/ABWF6XZDGJPF4N6MYYNIYF32MXGWBAVCNFSM6AAAAABVPHBC76VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMJUHEZTQMZVHA>. You are receiving this because you were mentioned.Message ID: ***@***.***>