How to Fix SCP-Denied Nova Pro Cross-Region Inference?
Company configures a landing zone in AWS Control Tower. The company handles sensitive data that must remain within the European Union. The company must use only the eu-central-1 Region. The company uses SCPs to enforce data residency policies. GenAI developers at the company are assigned IAM roles that have full permissions for Amazon Bedrock. The company must ensure that GenAI developers can use the Amazon Nova Pro model through Amazon Bedrock only by using cross-Region inference (CRI) and only in eu-central-1. The company enables model access for the GenAI developer IAM roles in Amazon Bedrock. However, when a GenAI developer attempts to invoke the model through the Amazon Bedrock Chat/Text playground, the GenAI developer receives the following error. User: arn:aws:sts::123456789012:assumed-role/AssumedDevRole/DevUserName Action: bedrock:InvokeModelWithResponseStream On resource(s): arn:aws:bedrock:eu-west-3::foundation-model/amazon.nova-pro-v1:0 Context: a service control policy explicitly denies the action The company needs a solution to resolve the error. The solution must retain the company's existing governance controls and must provide precise access control. The solution must comply with the company's existing data residency policies. Which combination of solutions will meet these requirements? (Choose two.)
Community Insight
Tests whether you understand that Bedrock CRI fans out to destination Regions, so both the SCP and the IAM role must allow the inference profile in every Region it can route to; the trap is broadening the SCP to eu.* or adding AdministratorAccess.
Amazon Bedrock cross-Region inference for Nova Pro is blocked by an SCP because the request routes to eu-west-3 instead of staying usable from eu-central-1. This page establishes that the compliant fix is to allow the specific eu.amazon.nova-pro-v1:0 inference profile in the SCP and validate IAM permissions across every EU Region in that profile (B, D).
Many learners choose E because a wildcard eu.* inference profile still looks EU-scoped and simpler, but the question explicitly requires precise access control, and CRI also needs IAM permissions in the destination Regions, so B and D are required.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B fixes the immediate SCP denial by extending the existing control to allow the specific eu.amazon.nova-pro-v1:0 inference profile instead of opening all Bedrock actions or all EU resources. Option D is the necessary companion because cross-Region inference can route the invoke action to another EU Region that serves Nova Pro, so the developer role must have permission to invoke through that inference profile in every eligible EU Region. Together, B and D retain the company's SCP-based governance, keep traffic within the EU geography, and provide precise access control rather than broad wildcard permissions. The error ARN already shows the request reaching eu-west-3, which confirms this is a destination-Region authorization problem, not a missing model-access toggle.
Why the Other Options Are Wrong
Option A is wrong because adding AdministratorAccess does not override an explicit SCP deny and violates least-privilege and precise-access requirements. Option C is wrong because enabling model access for Nova Pro in eu-west-3 does not remove the SCP block and does not address the IAM invoke permissions needed across the CRI destination Regions. Option E is wrong because extending the SCP to the eu.* inference profile is broader than necessary and fails the question's precise access control requirement; it also does not validate the IAM-side permissions that D covers. None of A, C, or E resolves both the SCP deny and the destination-Region IAM requirement while preserving existing governance.
Community Comment Notes
As a9fb7b2 noted, the error shows the request being routed to eu-west-3 and blocked by an SCP, and AWS requires that "you must allow the Bedrock invoke actions in all destination Regions" in the selected profile. SSSam26 similarly explained that B resolves the SCP block for the inference profile resource ARN while D covers multi-Region IAM access for CRI. de1612d stated "Answer is B&D", and 67bdb19 saw the choice as a 50/50 but leaned toward B. The practical consensus is that the SCP and IAM must both be aligned with the EU inference profile.
Official Reference
Exam Strategy
For Bedrock CRI questions, trace the resource ARN in the error and remember that the inference profile can route to multiple destination Regions. Then verify both the SCP allow-list and the IAM permissions for every Region the profile can use, and reject wildcard fixes when the stem demands precise access control.
Frequently Asked Questions
Why is extending the SCP to the eu.* inference profile wrong?
It is broader than the eu.amazon.nova-pro-v1:0 profile and fails the precise access control requirement, even though it stays EU-scoped.
Why does the SCP deny eu-west-3 if the workload is supposed to stay in the EU?
eu-west-3 is in the EU, but the existing SCP still explicitly denies the Bedrock invoke action there; CRI requires each destination Region to be allowed.
Related Analysis
Practice All AIP-C01 Questions
Access 110 questions with complete answers and detailed explanations.
View Full AIP-C01 Practice Test →