Stream error is not returned

[oleg-boulanov]

Describe the bug

See #3649

There is 403 returned by hhtp-decoder (because of invalid action, "InvokeModelWithBidirectionalStream")
But there is no error message logged, no stream error callback invoked, and the message can be found only in full trace.

Unacceptable.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

Request should fail (with 403), or stream error returned, or, at absolute minimum - 403 logged as ERROR, not as TRACE

Current Behavior

TRACE logged as:
[TRACE] http-decoder [2784] id=038D8770 Decoded header field: ":status: 403"

Reproduction Steps

Run on Bedrock Sonic EC2 instance, with no bedrock-runtime:invokemodel permission

Possible Solution

No response

Additional Information/Context

No response

AWS CPP SDK version used

1.11.705

Compiler and Version used

Visual Studio 2022, C++

Operating System and version

Windows 11/2022

[kai-ion]

@oleg-boulanov
Thanks for reporting this issue. I attempted to reproduce the 403 error handling problem but I need some clarification on the specific scenario. In my test that uses invalid credentials to force a 403, the 403 error was properly logged at ERROR level and returned. Do you have a code example I can use to replicate your issue?

[oleg-boulanov]

@kai-ion Thanks for looking into it.

I my scenario, credentials are correct, but the EC2 instance profile security group policy did not include permission: "bedrock:InvokeModel" (I mistakenly wrote "bedrock:InvokeModelWithBidirectionalStream").

In that case, the request itself succeeded, but no stream was established, and no error/warning or even debug message was produced.
Instead, there was one and only [TRACE] http-decoder [2784] id=038D8770 Decoded header field: ":status: 403" message.

I think it would be reasonable to see an ERROR message, if not request failure.

[kai-ion]

@oleg-boulanov
I was able to make a mock program in the scenario you mentioned, which uses an EC2 instance and using imds configuration with an iam role attached with wrong permissions:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "DenyBedrockInvokeForRepro",
			"Effect": "Allow",
			"Action": [
				"bedrock-runtime:InvokeModel",
				"bedrock-runtime:InvokeModelWithResponseStream",
				"bedrock:InvokeModelWithBidirectionalStream"
			],
			"Resource": "*"
		}
	]
}

In my example with an instance role that allows the wrong Bedrock actions, the Nova Sonic bidirectional streaming call returns HTTP 403 AccessDenied.
In this configuration the SDK logs the 403 at ERROR level
[ERROR] 2026-01-05 19:58:23.181 AWSJsonClient [3108] HTTP response code: 403
`
main.cpp

Is there a code sample you can provide me for a better reproduction of your issue?

[oleg-boulanov]

@kai-ion Happy New Year!
Thank you for your example, I can see now that my code (too complicated) must not be handling onDone properly.

Still, I'd expect this error to be logged by the SDK code itself, too.
Along with [TRACE] http-decoder [2784] id=038D8770 Decoded header field: ":status: 403" logged as ERROR, not TRACE.
Wouldn't you agree?

[sbiscigl]

must not be handling onDone properly

Yep, for detecting a error in the operation you must check the output of the operation for a error. (docs)

Along with [...] logged as ERROR, not TRACE. Wouldn't you agree?

I dont agree with this change. That log is actually coming from the http client not the SDK itself. To the http client it is a request regardless of response code. furthermore that log is actually coming from the CRT not from the SDK.

So use onDone to detect for errors on the request, and that log will remain at trace as the http client should not conditionally log on response code.

[github-actions]

Greetings! It looks like this issue hasn’t been active in longer than a week. We encourage you to check if this is still an issue in the latest release. Because it has been longer than a week since the last update on this, and in the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or add an upvote to prevent automatic closure, or if the issue is already closed, please feel free to open a new one.

[oleg-boulanov]

Sorry, I must have missed your reply.

Thank you for your advice.

Submitted a ticket to aws-c-http

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.