fix(AWS Bedrock Chat Model Node): Extract region from modelName ARNs

[schrothbn]

Summary

When using the AWS Bedrock Chat Model node with an inference profile specified as a full ARN (e.g. arn:aws:bedrock:eu-west-3:123456:inference-profile/eu.amazon.nova-pro-v1:0), the node ignored the region in the ARN and always used the credential’s region instead. This caused AccessDenied errors for users whose AWS organizations restrict which regions can be used via Service Control Policies.

The fix parses the region from the ARN when one is provided and uses it for the BedrockRuntimeClient and ChatBedrockConverse configuration. When the model is specified as a short ID (e.g. amazon.nova-pro-v1:0 or eu.amazon.nova-pro-v1:0), the credential region is used as before.

Related Linear tickets, Github issues, and Community forum posts

https://linear.app/n8n/issue/AI-2174

Review / Merge checklist

• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with release/backport (if the PR is an urgent fix that needs to be backported)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/@n8n/nodes-langchain/nodes/llms/LmChatAwsBedrock/LmChatAwsBedrock.node.ts">

<violation number="1" location="packages/@n8n/nodes-langchain/nodes/llms/LmChatAwsBedrock/LmChatAwsBedrock.node.ts:244">
P2: This ARN parser only handles the `aws` partition, so valid Bedrock ARNs from GovCloud/China will still ignore the region and fall back to the credential region.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant Engine as Workflow Engine
    participant Node as LmChatAwsBedrock Node
    participant Credentials as Credential Store
    participant SDK as BedrockRuntimeClient (AWS SDK)
    participant LC as ChatBedrockConverse (LangChain)

    Note over Engine,LC: Node Initialization Flow (supplyData)

    Engine->>Node: supplyData()
    Node->>Credentials: getCredentials()
    Credentials-->>Node: { region, accessKeyId, secretAccessKey }
    Node->>Node: getNodeParameter("model")

    Note over Node: Region Resolution Logic

    alt NEW: Model name is a full ARN
        Note right of Node: e.g. arn:aws:bedrock:eu-west-3:...
        Node->>Node: NEW: Regex extract region from ARN
    else Model name is short ID
        Note right of Node: e.g. amazon.nova-pro-v1:0
        Node->>Node: Use region from credentials
    end

    Node->>SDK: NEW: new BedrockRuntimeClient(config)
    Note right of SDK: CHANGED: config.region uses resolved region

    Node->>LC: NEW: new ChatBedrockConverse(options)
    Note right of LC: CHANGED: options.region uses resolved region<br/>options.client = SDK instance

    Node-->>Engine: Return model instance

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[DeveloperTheExplorer]

Looks good but I'm a bit confused as to how to properly handle this. If the user puts a region in their credentials that is different from the ARN url, perhaps we should at least put out a warning? May lead to some confusion.

[n8n-assistant]

Got released with n8n@2.14.0