ERR_HTTP2_ERROR while using BedrockRuntimeClient CountTokensCommand

[ui-api-maystreet]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

I got a ERR_HTTP2_ERROR while sending CountTokensCommand with BedrockRuntimeClient.

It just happened with this particular command, my app calls a multitude of aws sdk commands successfully including others using the same BedrockRuntimeClient.

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@aws-sdk/client-bedrock-runtime@3.972.0

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

v22.18.0

Reproduction Steps

I have tried this with several SDK versions between 3.864.0 and 3.972.0.

import { getDefaultRoleAssumer } from '@aws-sdk/client-sts';
import {  defaultProvider } from '@aws-sdk/credential-provider-node';
import { BedrockRuntimeClient, CountTokensCommand } from '@aws-sdk/client-bedrock-runtime';
 
const someProfile = 'foo'
const region = 'us-east-1';

const providerInit = {
      profile: someProfile,
      roleAssumer: getDefaultRoleAssumer({
        region: region
      }),
};
const awsCredentialsProvider = defaultProvider(providerInit);

const bedrockRuntimeClient = new BedrockRuntimeClient({
      region: region,
      credentials: awsCredentialsProvider,
});

const uint8Array = new TextEncoder().encode('{"messages": []}');
// Error following:
const response = await this.bedrockRuntimeClient.send(
      new CountTokensCommand({
        modelId: 'anthropic.claude-3-7-sonnet-20250219-v1:0',
        input: { invokeModel: { body: uint8Array } },
      })
);

Observed Behavior

After sending CountTokensCommand i got:

err: {
      "type": "NghttpError",
      "message": "Protocol error",
      "stack":
          Error [ERR_HTTP2_ERROR]: Protocol error
              at Http2Session.onSessionInternalError (node:internal/http2/core:858:26)
              at Http2Session.callbackTrampoline (node:internal/async_hooks:130:17)
      "code": "ERR_HTTP2_ERROR",
      "errno": -505,
      "$metadata": {
        "attempts": 1,
        "totalRetryDelay": 0
      }
    }

Then tried to downgrade to http1.1 like:

    const requestHandler = new NodeHttpHandler({
      httpsAgent: new https.Agent({
        keepAlive: true,
        maxSockets: 50,
      }),
      connectionTimeout: 30_000,
      requestTimeout: 60_000,
    });

    const bedrockRuntimeClient = new BedrockRuntimeClient({
      region: region,
      credentials: awsCredentialsProvider,
      requestHandler,
    });

With this i got an AccessDeniedException:

AccessDeniedException: User: arn:aws:sts::<id>:assumed-role/<role-name>/aws-sdk-js-1769014056875 is not authorized to perform: bedrock:CountTokens on resource: arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-7-sonnet-20250219-v1:0 because no identity-based policy allows the bedrock:CountTokens action

After adding this permission, the command using http1.1 went through.

Then i removed the custom NodeHttpHandler which forced http1.1, and I still get the ERR_HTTP2_ERROR error.

Expected Behavior

CountTokensCommand sent successfully or some meaningful error message.

Possible Solution

No response

Additional Information/Context

No response

[aBurmeseDev]

Hi @ui-api-maystreet - thanks for reaching out.

I tried reproducing this on my end with the same setup you provided but couldn't get the error. Tested with:

• @aws-sdk/client-bedrock-runtime@3.972.0 (same version you're on)
• The same credential provider setup with defaultProvider and getDefaultRoleAssumer
• CountTokensCommand with a Uint8Array body
• Node version v20.18.3

I think it might be something specific to your environment rather than a SDK bug.

Can you check to confirm the followings:

• Are you behind a corporate proxy or VPN? Those can sometimes mess with HTTP/2 connections
• Does this happen every time, or is it intermittent?
• Are you reusing the same BedrockRuntimeClient instance across a lot of requests?

[ui-api-maystreet]

Hi @aBurmeseDev !

Q: Are you behind a corporate proxy or VPN? Those can sometimes mess with HTTP/2 connections
A: Yes behind ZScaler and I agree it is likely it messes with HTTP/2 connections. But still, why this command in particular, a bunch of other BedrockRuntimeClient commands work fine?
I also use client-bedrock-agent, client-bedrock-agent-runtime, etc without any issue.

Q: Does this happen every time, or is it intermittent?
A: For this command happens all the time.

Q: Are you reusing the same BedrockRuntimeClient instance across a lot of requests?
I do reuse it but not for a lot of requests, something like under 10 req and mostly sequential, not concurrently.
Are there any issues about reusing bedrock clients or any sdk client that I should be aware?