Bug Report: I can't use `bedrock`. it requires access to us-east-2 but I...

Status Fixed / completed
Maintainer reply ✓ Yes — 8enmann
Activity 10 comments · opened Feb 26, 2025 · closed Feb 28, 2025
💡 Likely answer: A maintainer (8enmann, collaborator) responded on this thread — see the highlighted reply below.

Bug Description
I can't use bedrock. it requires access to us-east-2 but I have access only to us-east-1. \
I tried to configure every paramter I can think of to point to us-east-1, but it still fails.\

! env | grep AWS
  ⎿  AWS_DEFAULT_REGION=us-east-1
     AWS_DEFAULT_PROFILE=default
     AWS_PROFILE=default
     AWS_REGION=us-east-1
     BEDROCK_AWS_REGION=us-east-1

> give me an overview of this codebase. create a README.md for it with mermaid diagram of optional workflows. 

  ⎿  API Error: 403 {"Message":"User: arn:aws:sts::12345677890:assumed-role/AWSReservedSSO_ps-global-admin_a7a/abc[at]domain.com is not authorized to perform: bedrock:InvokeModelWithResponseStream on 
resource: arn:aws:bedrock:us-east-2::foundation-model/anthropic.claude-3-7-sonnet-20250219-v1:0 with an explicit deny in a service control policy"}\

Environment Info

  • Platform: macos
  • Terminal: vscode
  • Version: 0.2.14

View original on GitHub ↗

10 Comments

niklas-palm · 1 year ago

I'm successfully using claude code with specifying AWS region. I have temporary credentials in my environment for an AWS account where claude 3.7 is approved in us-west-2

I'm exporting these variables in my env

export AWS_REGION=us-west-2         
export ANTHROPIC_MODEL='us.anthropic.claude-3-7-sonnet-20250219-v1:0'
export CLAUDE_CODE_USE_BEDROCK=1
export DISABLE_PROMPT_CACHING=1

An then launching claude code works.

awickham10 · 1 year ago

I have the same issue. I have these set, but it's still trying to access us-east-2.

# Claude Code
export CLAUDE_CODE_USE_BEDROCK=1
export ANTHROPIC_MODEL='us.anthropic.claude-3-7-sonnet-20250219-v1:0'
export AWS_REGION=us-east-1
export DISABLE_PROMPT_CACHING=0
niklas-palm · 1 year ago

I see! think the issue in your case is that you don't have IAM permission in your role to use Bedrock cross-region inference, which is required for Claude 3.7. Even if you have gotten model access in us-east-1, that model can still only be accessed through a cross-region inference profile (the us.in the beginning of the ANTHROPIC_MODEL gives that away). To use a cross-region inference profile, the IAM role you use must have bedrock:invokeModel and bedrock:InvokeModelWithResponseStream permissions in each region. If your org has SCPs or explicit denies on regions that's part of the inference profile, cross-region inference will not work.

Also, are your purposefully trying to use prompt caching? That feature is in gated preview through Bedrock currently and requires you have been enrolled to the beta.

awickham10 · 1 year ago

In our situation, we don't have access to every region in us.anthropic.claude-3-7-sonnet-20250219-v1:0. We have access to us-east-1 only. Is there a way to disable cross region inference?

I've also since re-enabled prompt caching.

niklas-palm · 1 year ago

No. As far as I understand, 3.7 is only available via cross-region inference on Bedrock at the moment.

awickham10 · 1 year ago

Appreciate the insight. One of our admins has a ticket open with AWS. I'll post back with outcome of that.

8enmann collaborator · 1 year ago

You probably also need to disable your profile
export AWS_PROFILE= and try again. Use the keys from the AWS console. Let us know if that works. Under the hood we're using the plain https://www.npmjs.com/package/@anthropic-ai/bedrock-sdk

marking · 1 year ago

I found that claude would only use bedrock if I explicitly exported both AWS_PROFILE and AWS_REGION, even though they are defined in my ~/.aws/credentials and ~/.aws/config files YMMV

RzNmKX · 1 year ago

+1 on explicit working for us-west-2 region:

saml2aws login -a some-profile-name
export CLAUDE_CODE_USE_BEDROCK=1
export ANTHROPIC_SMALL_FAST_MODEL='us.anthropic.claude-3-5-haiku-20241022-v1:0'
export ANTHROPIC_MODEL='us.anthropic.claude-3-7-sonnet-20250219-v1:0'
export AWS_REGION=us-west-2
export DISABLE_PROMPT_CACHING=1
export AWS_PROFILE=some-profile-name
github-actions[bot] · 1 year ago

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.