Bug Report: I can't use `bedrock`. it requires access to us-east-2 but I...
Status Fixed / completed
Maintainer reply ✓ Yes — 8enmann
Activity 10 comments · opened Feb 26, 2025 · closed Feb 28, 2025
💡 Likely answer: A maintainer (8enmann, collaborator)
responded on this thread — see the highlighted reply below.
Bug Description
I can't use bedrock. it requires access to us-east-2 but I have access only to us-east-1. \
I tried to configure every paramter I can think of to point to us-east-1, but it still fails.\
! env | grep AWS
⎿ AWS_DEFAULT_REGION=us-east-1
AWS_DEFAULT_PROFILE=default
AWS_PROFILE=default
AWS_REGION=us-east-1
BEDROCK_AWS_REGION=us-east-1
> give me an overview of this codebase. create a README.md for it with mermaid diagram of optional workflows.
⎿ API Error: 403 {"Message":"User: arn:aws:sts::12345677890:assumed-role/AWSReservedSSO_ps-global-admin_a7a/abc[at]domain.com is not authorized to perform: bedrock:InvokeModelWithResponseStream on
resource: arn:aws:bedrock:us-east-2::foundation-model/anthropic.claude-3-7-sonnet-20250219-v1:0 with an explicit deny in a service control policy"}\
Environment Info
- Platform: macos
- Terminal: vscode
- Version: 0.2.14
10 Comments
I'm successfully using claude code with specifying AWS region. I have temporary credentials in my environment for an AWS account where claude 3.7 is approved in us-west-2
I'm exporting these variables in my env
An then launching claude code works.
I have the same issue. I have these set, but it's still trying to access us-east-2.
I see! think the issue in your case is that you don't have IAM permission in your role to use Bedrock cross-region inference, which is required for Claude 3.7. Even if you have gotten model access in
us-east-1, that model can still only be accessed through a cross-region inference profile (theus.in the beginning of theANTHROPIC_MODELgives that away). To use a cross-region inference profile, the IAM role you use must havebedrock:invokeModelandbedrock:InvokeModelWithResponseStreampermissions in each region. If your org has SCPs or explicit denies on regions that's part of the inference profile, cross-region inference will not work.Also, are your purposefully trying to use prompt caching? That feature is in gated preview through Bedrock currently and requires you have been enrolled to the beta.
In our situation, we don't have access to every region in
us.anthropic.claude-3-7-sonnet-20250219-v1:0. We have access tous-east-1only. Is there a way to disable cross region inference?I've also since re-enabled prompt caching.
No. As far as I understand, 3.7 is only available via cross-region inference on Bedrock at the moment.
Appreciate the insight. One of our admins has a ticket open with AWS. I'll post back with outcome of that.
You probably also need to disable your profile
export AWS_PROFILE=and try again. Use the keys from the AWS console. Let us know if that works. Under the hood we're using the plain https://www.npmjs.com/package/@anthropic-ai/bedrock-sdkI found that claude would only use bedrock if I explicitly exported both AWS_PROFILE and AWS_REGION, even though they are defined in my ~/.aws/credentials and ~/.aws/config files YMMV
+1 on explicit working for us-west-2 region:
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.