Claude Opus 4.8 on AWS Bedrock : AccessDeniedException
Problem
Trying to invoke Claude Opus 4.8 on Amazon Bedrock via bedrock-runtime invoke-model. Getting consistent AccessDeniedException:
botocore.errorfactory.AccessDeniedException: An error occurred (AccessDeniedException) when calling the InvokeModel operation:
anthropic.claude-opus-4-8 is not available for this account. You can explore other available models on Amazon Bedrock.
For additional access options, contact AWS Sales at https://aws.amazon.com/contact-us/sales-support/
Same error occurs in the Bedrock Playground console when trying to chat with Opus 4.8.
What I've Already Tried
1. Checked entitlement status via CLI:
bash
aws bedrock get-foundation-model-availability \
--model-id anthropic.claude-opus-4-8 \
--region us-east-1
Response:
json
{
"modelId": "anthropic.claude-opus-4-8",
"agreementAvailability": {
"status": "AVAILABLE"
},
"authorizationStatus": "AUTHORIZED",
"entitlementAvailability": "AVAILABLE",
"regionAvailability": "AVAILABLE"
}
✅ Everything shows green.
2. Accepted the Marketplace agreement:
bash
aws bedrock create-foundation-model-agreement \
--model-id anthropic.claude-opus-4-8 \
--offer-token "<offer-token>" \
--region us-east-1
Initial response showed PENDING, waited ~5 minutes, then re-checked. Status flipped to AVAILABLE. Also received an official AWS Marketplace confirmation email saying the agreement was created successfully.
3. Verified payment method: Confirmed valid payment method is on file in Billing → Payment methods.
What I Think Is Happening
AWS's own documentation says Marketplace models should auto-enable on first invoke once the agreement is finalized. The control plane (where agreement status is queried) shows it's AVAILABLE, but the inference runtime layer still denies access. This suggests a sync issue between:
- Control plane (agreement visible, status = AVAILABLE) ✅
- Runtime layer (still denies invocations) ❌
Additional Context
- Account on AWS Activate credits (not sure if this matters)
- Anyone else hitting this with Opus 4.8 specifically?
- Is this a known issue with Activate-tier accounts?
- Did anyone manage to resolve it without opening a support case?
- Should I just escalate directly to AWS support, or is there a workaround I'm missing?
Any insights appreciated!
