Logo
AWS Bedrock GenAI AI agents

AWS Bedrock AccessDenied: model marked as legacy or not active (upgrade to an active model)

Fix AccessDenied on Bedrock when a model is marked legacy or not active: the 30-day inactivity rule, deprecated version pinning, and switching to an active model or inference profile.

Jerzy Kopaczewski ·
A model call on Amazon Bedrock (InvokeModel or Converse) returns AccessDeniedException with a message like "this model is marked by provider as legacy... please upgrade to an active model". In most cases this is not an IAM policy problem but a model-lifecycle one: the model was retired, or your account has not invoked it in the last 30 days. This runbook separates the two causes and fixes each.

This runbook covers model-access failures on Bedrock (not throttling). For where model choice fits in an agent architecture, see Amazon Bedrock AgentCore: architecture and pricing. For help designing the model layer in production, book a consultation.

Symptoms

The error appears in one of the forms below. Work out which one first, because the fix differs.

# 1. Model marked legacy after a period of inactivity
AccessDeniedException: Access denied. This model is marked by provider as legacy
and you have not been actively using the model in the last 30 days.
Please upgrade to an active model on Amazon Bedrock.

# 2. No model access / pinned deprecated version
AccessDeniedException when calling the InvokeModel operation:
You don't have access to the model with the specified model ID.
# e.g. with a pinned "anthropic.claude-3-5-sonnet-20241022-v2:0"

Visible impact:

  • A previously working agent or application suddenly returns AccessDenied on every model call
  • The error appears after a longer gap in using a specific model (the 30-day rule)
  • The error appears after AWS announces a model retirement, or after pinning a specific, older model version

Cause

The same error code (AccessDeniedException) has two distinct model-lifecycle causes here, not an IAM-permissions one.

  1. The 30-day inactivity rule for legacy models. AWS marks some model versions “legacy”. If your account has not invoked a given model for around 30 days, access is revoked and the next call returns AccessDenied with the “marked by provider as legacy… upgrade to an active model” message. The fix is to switch to the current, active model version (or, where offered, request access again).
  2. Access not granted, or a pinned deprecated version. The account never had (or lost) access to the specific model ID, or the code pins a retiring version (anthropic.claude-3-5-sonnet-20241022-v2:0) being replaced by a newer snapshot or an inference profile.

One nuance worth knowing: newer Anthropic models on Bedrock are increasingly accessed through inference profiles (cross-region), not a bare model ID. Pinning a bare, older model ID is itself a trigger.

Common triggers:

  • A gap in using a legacy model longer than 30 days
  • A pinned, retiring model version instead of the current ID or an inference profile
  • Model access not granted on the account or in the region
  • A call after AWS announces a model retirement

Fix

Step 1: Check which models are active

List the available foundation models and confirm their status and current IDs.

# List active foundation models in the region
aws bedrock list-foundation-models \
  --region eu-central-1 \
  --query 'modelSummaries[].{Id:modelId, Name:modelName, Lifecycle:modelLifecycle.status}'

# Details for a specific model (confirm lifecycle status)
aws bedrock get-foundation-model \
  --model-identifier anthropic.claude-3-5-sonnet-20241022-v2:0 \
  --region eu-central-1

If the model status is LEGACY (or the model is absent from the active list), this is the lifecycle case (Step 2). If the model is active but you still get AccessDenied, check model access (Step 3).

Step 2: Switch to an active model or inference profile

Replace the deprecated model ID with the current, active version. For newer Anthropic models, use an inference profile rather than a bare ID.

# Anti-pattern: pinned, retiring model ID
model_id = "anthropic.claude-3-5-sonnet-20241022-v2:0"   # legacy

# Better: current active model ID (or its cross-region inference profile)
# Verify the current identifier in `list-foundation-models` / the AWS docs
model_id = "anthropic.claude-sonnet-5"          # current active model
# or, via a cross-region inference profile:
# model_id = "eu.anthropic.claude-sonnet-5"
  • Do not hard-pin a bare, older model ID in production code
  • Keep the model identifier in configuration, not in code, so it can change without a deployment
  • Consider a fallback to a second active model when the primary returns AccessDenied

Step 3: Confirm or re-grant model access

If the model is active but the call still fails with AccessDenied, check model access on the account and in the region (Bedrock console → Model access). Where needed, request access again to the correct, active version.

Step 4: Prevention

  • Do not let a legacy model sit idle for more than 30 days if it must stay available, or plan the move to an active model ahead of time
  • Monitor AWS model-lifecycle and retirement announcements
  • Keep at least one active model “warm” as a fallback path

Validation

Confirm that a call to an active model returns 200.

# Invoke an active model / inference profile: expect 200 and a model response
aws bedrock-runtime invoke-model \
  --model-id anthropic.claude-sonnet-5 \
  --body '{"anthropic_version":"bedrock-2023-05-31","max_tokens":16,"messages":[{"role":"user","content":"ping"}]}' \
  --cli-binary-format raw-in-base64-out \
  --region eu-central-1 \
  /dev/stdout

Expected: the call returns a model response with no AccessDenied. If the error persists on an active model, return to Step 3 (model access).