/ troubleshooting
Bedrock 400 with an API key and no region
A Bedrock API key needs x-ace-aws-region: a short-term key is bound to the region it was minted in, so ACE will not default one.
Symptom
Bedrock calls carrying x-ace-bedrock-api-key return HTTP 400 about the region.
Cause
With an access-key pair the region is part of the SigV4 scope and defaults to us-east-1 when absent. With an API key there is no safe default — a short-term key only works in the region it was minted in — so a missing region is a 400, never a defaulted host.
Fix
Send x-ace-aws-region with every Bedrock API-key call, set to the key's region.