Bedrock model IDs with colon (:) cause 403 due to missing URL encoding

[ansoncsh]

When using the AWS Bedrock, requests fail with a 403 error if the specified model ID contains a colon (:), which is commonly present in official Bedrock model version identifiers (e.g. :0). This prevents usage of several supported Bedrock models.

Neo4j version: 2026.02.3
Operating system: Amazon Linux 2023
Installation method: Docker
API/Driver: Docker - Cypher

Steps to reproduce

1. Make sure server has access right to invoke bedrock model
2. Open neo4j browser
3. Input the followings:

CALL apoc.ml.bedrock.custom(
      { inputText: 'hello world' },
      { region: 'us-east-1', model: 'amazon.titan-embed-text-v2:0' }
) YIELD value

4. Run

Expected behavior

Return embedding results

Actual behavior

Return the following error:

52U00: Procedure exception - custom procedure execution error cause
Execution of the procedure apoc.ml.bedrock.custom() failed due to java.lang.RuntimeException: java.io.IOException: Server returned HTTP response code: 403 for URL: https://bedrock-runtime.us-east-1.amazonaws.com/model/amazon.titan-embed-text-v2:0/invoke.

It also appears that any model ID containing a colon (:) consistently triggers the same 403 error. For example, using amazon.titan-embed-text-v1:xxx (which does not exist) results in the same failure, suggesting the issue is related to the presence of : in the model identifier rather than a specific model.

[gem-neo4j]

Hello! I am not working on the APOC extended library, but as a workaround, if you just want to embed text using Bedrock Titan, you can install the genai plugin :) I tested it and it works with this model

WITH {
  accessKeyId: $bedrockAccessKeyId,
  secretAccessKey: $bedrockSecretAccessKey,
  region: 'us-east-1',
  model: 'amazon.titan-embed-text-v2:0'
} AS bedrockConf
RETURN ai.text.embed('hello world', 'bedrock-titan', bedrockConf)

[ansoncsh]

Hello! I am not working on the APOC extended library, but as a workaround, if you just want to embed text using Bedrock Titan, you can install the genai plugin :) I tested it and it works with this model

WITH {
  accessKeyId: $bedrockAccessKeyId,
  secretAccessKey: $bedrockSecretAccessKey,
  region: 'us-east-1',
  model: 'amazon.titan-embed-text-v2:0'
} AS bedrockConf
RETURN ai.text.embed('hello world', 'bedrock-titan', bedrockConf)

Thank you for the workaround. It works on my side too.

However, is it possible to support not requiring the use of accessKeyId and secretAccessKey?
Since Neo4j maybe hosted on an AWS EC2 instance with an IAM role that already has the necessary access.

[gem-neo4j]

Hi, we have plans to improve the secret handling in the coming months, it isn't currently possible though :)