Amazon Bedrock CLI cheat sheet: models, test calls, guardrails, logging, metrics and quotas

Use this when you are on call for an app that calls Amazon Bedrock and need answers fast: which model ID is valid, does a plain call work, is a guardrail blocking it, are we throttled.

All examples assume a profile and region are set:

export AWS_PROFILE=genai-prod
export AWS_REGION=us-east-1
aws sts get-caller-identity --query Arn --output text   # confirm who you are

Tip

Bedrock is regional. Many "model not found" and access errors come from calling the right model in the wrong region. Always check AWS_REGION first.

#Models and model IDs

#List and inspect models

# All text models in this region, ID and lifecycle status
aws bedrock list-foundation-models --by-output-modality TEXT \
  --query 'modelSummaries[].[modelId,modelLifecycle.status,join(`,`,inferenceTypesSupported)]' \
  --output table

# Only one provider
aws bedrock list-foundation-models --by-provider anthropic \
  --query 'modelSummaries[].modelId' --output text

# Details for one model
aws bedrock get-foundation-model --model-identifier amazon.titan-embed-text-v2:0

What the fields tell you:

#Inference profiles

Many newer models only accept calls through a cross-Region inference profile. The profile ID usually has a geography prefix such as us. or eu. in front of the model ID.

aws bedrock list-inference-profiles --type-equals SYSTEM_DEFINED \
  --query 'inferenceProfileSummaries[].[inferenceProfileId,status]' --output table

aws bedrock get-inference-profile --inference-profile-identifier <profile-id>

If an app gets a ValidationException saying on-demand throughput isn't supported for this model, switch it from the model ID to the inference profile ID.

#Model access

# Region, entitlement and authorization status for one model (newer CLI versions)
aws bedrock get-foundation-model-availability --model-id <model-id>

If this command doesn't exist in your CLI, upgrade the CLI or check model access in the Bedrock console. For a full walkthrough of AccessDeniedException, see the Bedrock access post.

#Send a test call

#Converse API (works the same way across most models)

aws bedrock-runtime converse \
  --model-id <model-or-inference-profile-id> \
  --messages '[{"role":"user","content":[{"text":"Reply with the word OK."}]}]' \
  --inference-config '{"maxTokens":20,"temperature":0}' \
  --query '[output.message.content[0].text, usage]'

The usage block shows input and output tokens, which confirms billing is happening on the profile you expect.

#InvokeModel (model-specific request body)

cat > body.json <<'EOF'
{ "inputText": "disk full on /var/log" }
EOF

aws bedrock-runtime invoke-model \
  --model-id amazon.titan-embed-text-v2:0 \
  --body fileb://body.json \
  --content-type application/json \
  out.json && jq '.embedding | length' out.json

Use fileb:// for the body so CLI v2 doesn't try to base64-decode it. Request body formats differ per model provider; check the model's parameter page.

#Reading errors

#Guardrails

aws bedrock list-guardrails --query 'guardrails[].[id,name,version,status]' --output table

aws bedrock get-guardrail --guardrail-identifier <guardrail-id> --guardrail-version DRAFT

Test whether a guardrail blocks a specific text without calling a model:

aws bedrock-runtime apply-guardrail \
  --guardrail-identifier <guardrail-id> \
  --guardrail-version 1 \
  --source INPUT \
  --content '[{"text":{"text":"How do I reset my VPN password?"}}]' \
  --query '[action, outputs[0].text]'

action is GUARDRAIL_INTERVENED when the guardrail blocked or masked something, and NONE when it let the text through. Pass the same version number the app uses. DRAFT and numbered versions can behave differently.

Warning

Editing the guardrail and creating a new version doesn't change running apps until they reference the new version. Before you blame or fix a guardrail, confirm which version the app sends.

#Invocation logging

aws bedrock get-model-invocation-logging-configuration

An empty result means invocation logging is off. You then can't see prompts, responses or per-call token usage after the fact. Turning it on is a one-time setup per region (see the token usage spike post for the full configuration). Treat logged prompts as sensitive data.

#CloudWatch metrics

Bedrock publishes runtime metrics in the AWS/Bedrock namespace with a ModelId dimension. Common metrics are Invocations, InvocationLatency, InvocationClientErrors, InvocationServerErrors, InvocationThrottles, InputTokenCount and OutputTokenCount.

# What model IDs are reporting metrics?
aws cloudwatch list-metrics --namespace AWS/Bedrock --metric-name Invocations \
  --query 'Metrics[].Dimensions[?Name==`ModelId`].Value[]' --output text

# Throttles per 5 minutes over the last 3 hours (GNU date)
aws cloudwatch get-metric-statistics --namespace AWS/Bedrock \
  --metric-name InvocationThrottles \
  --dimensions Name=ModelId,Value=<model-id> \
  --start-time "$(date -u -d '-3 hours' +%FT%TZ)" --end-time "$(date -u +%FT%TZ)" \
  --period 300 --statistics Sum --output table

Swap in OutputTokenCount with --statistics Sum to see token burn, or InvocationLatency with --statistics Average Maximum to check latency.

#Quotas

# Applied quotas for Bedrock in this region, filtered to one model family
aws service-quotas list-service-quotas --service-code bedrock \
  --query "Quotas[?contains(QuotaName, 'Claude')].[QuotaName,Value,QuotaCode]" \
  --output table

# Default values (what a new account gets)
aws service-quotas list-aws-default-service-quotas --service-code bedrock \
  --query "Quotas[?contains(QuotaName, 'tokens per minute')].[QuotaName,Value]" --output table

# Open increase requests
aws service-quotas list-requested-service-quota-change-history --service-code bedrock \
  --query 'RequestedQuotas[].[QuotaName,DesiredValue,Status]' --output table

Quota names include the model name and the limit type (requests per minute or tokens per minute, on-demand or cross-Region). Names change as models are added. Filter with contains() instead of hard-coding quota codes. Don't assume a number; read the applied value for your account and region.

#Provisioned Throughput and batch jobs

aws bedrock list-provisioned-model-throughputs \
  --query 'provisionedModelSummaries[].[provisionedModelName,status,modelUnits]' --output table

aws bedrock list-model-invocation-jobs --status-equals InProgress \
  --query 'invocationJobSummaries[].[jobName,status,submitTime]' --output table

Caution

delete-provisioned-model-throughput removes capacity immediately. Apps that call the provisioned model ARN start failing at once, and recreating the capacity may need a new commitment. Check which apps use the ARN before you delete it.

#Prevent it next time

• Store model and inference profile IDs in app configuration, not code, so a migration is a config change.
• Run a scheduled list-foundation-models check and alert when a model you use shows LEGACY.
• Turn on invocation logging in every region you use before you need it.
• Alarm on InvocationThrottles and InvocationServerErrors per model, and review quotas against peak token usage each month.
• Keep a smoke test (the converse call above) in your deployment pipeline and runbooks.