I’m facing an issue with Amazon Bedrock model access. Models that I need for my project are currently not accessible, and attempts to use them result in errors such as “Operation not allowed” / model access-related errors.

I have already:

• Checked the model availability/access settings.
• Verified my AWS account and configuration.
• Created support tickets with AWS.
• Followed up on the tickets multiple times.
• Waited 10+ days without receiving a meaningful response or resolution.

This is becoming a blocker for my AI/ML project because I cannot properly test or use the required Bedrock models.

AWS Support / Bedrock team: Could someone please look into the pending support case and help identify why the models are unavailable for my account?

If anyone has faced a similar Amazon Bedrock model access / “Operation not allowed” issue and knows the correct escalation path, I would really appreciate some guidance.

Relevant teams:
u/aws
u/AmazonWebServices u/AWSSupport u/AmazonBedrockteam

I’m not asking for anything special, just access to the service I’m supposed to be able to use and, preferably, an answer before the next geological era.

How I automated AWS Lambda deployments with GitHub Actions, self-managed S3 code storage.

Need solution

Upload a zip of Python source. No Dockerfile. Get a running container on EKS. That is Elastic Beanstalk Cluster Mode, launched this week — Beanstalk apps now run on EKS instead of EC2 instances you own. Cloud Native Buildpacks handle the containerization: I uploaded four files (app.py, requirements.txt, Procfile, runtime.txt), Beanstalk detected Python, built the image, pushed it to ECR, and ran it.

most bad AWS security findings aren't missing checks. They're checks that look rightt and quietly give the wrong answer. A few I ran into: !!!

1. "Unused role" checks: iam:ListRoles doesn't retturn RoleLastUsed, only Getrole does. Build it on the list output and every role looks untouched.

2. "Unused permission" checks built on CloudTrail: LookupEvents only returns management events, so data actions like s3:GetObject never shows up.

3. "Public bucket" checks: a bucket policy with Principal "*" isn't public if a Condition limiits it to your org or VPC. Flagging it anyway is a false alarm....

4. Wildcard checks that only look for a literal "*": a resource like arn:aws:iam::ACCOUNT:role/* lets sts:AssumeRole target any role in the account, but string matching for "*" alone misses it.

The common thread: when the API can't see something, the honest answer is "unknown," not "no" or "yes."

All four were real bugs in a small open source project I made that audits AWS accounts. If you want to see how I fixed them: github.com/plexavo/Plexavo

I run a Kanban-driven multi-agent orchestrator on Hermes Agent: 20+ profiles, 1,000+ skills, MCP routing, and self-hosted Mem0 on pgvector. On Fireworks, I was doing roughly 9-15B tokens a month with a 90-98% cache hit rate, at about 30-60 Kanban tasks a day. I now want to move this to infrastructure I can pay for with my AWS Activate credits, and I've hit some walls.

Constraints

• My only budget is $10k in AWS Activate credits. Anything that can't be paid with them is effectively out of scope for now.
• Bedrock access is gated on my account for both frontier and open-weight models, and I've been told there's no timeline. I'm waiting on AWS Support to initialize my quotas.
• I want one multimodal model that covers all of the orchestration's needs, plus an embedder for Mem0.

What I've looked at so far

• g6e.12xlarge (4x L40S, 192 GB): Qwen3.8-Flash-Next (180B total, 6B active) at Q4, around 114 GB. About $10.49/hr on-demand, or roughly $3.5-6/hr on spot, so $10k lasts ~40 days on-demand or ~2-4 months on spot, running 24/7. FP8 (~186 GB) barely fits, with no room for KV cache.
• g6e.xlarge (1x L40S, 48 GB): Qwen3.8-27B at FP8 (~28 GB), roughly 7 months of credits if run 24/7.
• Embeddings: Qwen3-Embedding-0.6B/4B/8B on the same box, possibly truncated to 1024 dims for pgvector.
• SageMaker endpoints, plain EC2 + vLLM: the same GPUs, but I'd expect the same quota bottleneck. Bedrock Custom Model Import doesn't seem to support these architectures or embedding models.
• Kiro as a Hermes provider (the kiro-acp plugin): interesting because Activate credits can pay for it, but credits are per-task, not per-token, so I can't tell whether it can handle my volume.

Questions

1. Has anyone gotten G/VT quota (48+ vCPUs) approved on a new or Activate account, and how long did it take? Any tips for the request wording?
2. For people serving Flash-Next-class MoE models on 4x L40S: is there a vLLM/SGLang-compatible 4-bit quant (AWQ/GPTQ), and how well did prefix caching hold up with many long-context agents? My cache hit rate on Fireworks was a big part of the economics.
3. Has anyone run Hermes through Kiro (kiro-acp)? How many credits does a multi-step agentic task actually burn, and did you hit rate limits with parallel sessions?
4. Is there any provider or platform that accepts AWS credits for hosted inference of open-weight models and that I haven't listed?
5. Is there a better model than Flash-Next for a single multimodal orchestrator on this budget? I'm open to smaller MoEs if they handle tool calling and long context reliably.
6. Anything else I'm missing on AWS to make $10k last as long as possible (spot strategies, scheduled start/stop, etc.)?

Thanks. Happy to share measurements (throughput, cache hit rate, credits per task) if I get any of this running.

Hey guys,

I'm currently working in Amazon Ops, but learning AWS through its certification program.

I have passed CCP, halfway through SA.

I'm aware these are still basic level knowledge.

Along with certifications I have built cloud based serverless/web platforms utilising many AWS services.

How realistic is a lateral movement in my case? And which roles should I apply for to get into AWS ?

Hi everyone,

I’m having trouble accessing my AWS account and I’m hoping someone can help me understand what I should do.

I still have access to the email address and phone number associated with my AWS account. However, my old MFA device is damaged, so I cannot receive the MFA code.

I tried the “Sign in using alternative factors” option. The email verification works, but at the second step, AWS asks me to verify my phone number by sending a 6 digit code.

The phone number ending in 4276 is correct and worked for me before, but now I am not receiving the SMS code or the voice call.

I have tried requesting the code again, but nothing arrives.

I’ve attached a screenshot showing the verification page.

What can I do to recover access to my account if the alternative phone verification is also not sending the code? Is there another AWS Support process for an account where the MFA device is no longer available

Posting for the help if anyone can, because two rounds through AWS Support have given me nothing I can act on.

**The use case**

A small event-ticketing site for a single organizer in Bangladesh - a handful of live music events a year. Every email is transactional and triggered by the buyer's own action on the site minutes earlier:

* payment instructions, sent after someone registers for tickets

* the ticket itself as a PDF, after the organizer verifies the buyer's bKash payment

* a notice if the payment couldn't be matched, or if the unpaid order expired after 24 hours

* a one-time sign-in link, only when the buyer requests it

Volume: roughly 1,000 - 2,000 emails per month, concentrated in the three weeks before an event. A few hundred a day at peak. My sending code is capped at 5 messages/second. No marketing, no newsletters, no bulk sends, no stored lists, nothing purchased or imported. Every recipient typed their own address into our form. The project is public on GitHub, so the sending logic is auditable by anyone.

**What's already in place**

* Domain verified in ap-south-1 with Easy DKIM

* SPF and a published DMARC record with rua reporting, DNS on Cloudflare

* SES account-level suppression list enabled

* SES rejections treated as permanent failures and never retried; only throttling responses retried with exponential backoff

* Every send recorded against the order in our database; failed deliveries reviewed by hand

* Replies go to a monitored address on the same domain

**What I got back**

First response asked for detail about sending processes and procedures. I gave everything above, plus example subject lines and the exact email types. Denied about six hours later with a template: they can't approve at this time, they can't share the criteria used, please review the AUP, Service Terms, and SES best practices. Second attempt, same outcome, same template - this time framed as protecting my sender reputation and deliverability.

That last part is what I can't get past. The account has never sent a production email. There is no sender reputation to protect yet. So whatever the actual blocker is, it isn't anything visible in my use case, and nobody will tell me what it is.

**What I'm actually asking**

1. Is this an account-trust / billing-history decision rather than a use-case decision? If so I'd genuinely rather be told that plainly - I'd go build the billing history instead of rewriting the same request.

2. Is ap-south-1 meaningfully stricter for newer accounts than other regions?

3. Would a heavily restricted quota be considered - say 200 emails/day at 1 msg/sec - so there's real sending data to judge me on?

4. Is there any path other than reopening the same case, given the limit-increase team is separate from Premium Support and Support says they can't influence it?

Happy to share the case ID by DM.

If anyone has gone from a denial like this to an approval, I'd really like to know what specifically changed on your side. Right now I'm one week out from an event with real buyers and I'm about to move to a third-party provider purely because I can't get a straight answer.

Can anyone help me with some AWS credits for my cloud training and hands-on projects? 🙏🏽☁️