[FEATURE] Add BEDROCK_AWS_PROFILE env variable or config flag to make Bedrock independent from current profile

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/25394
2. https://github.com/anthropics/claude-code/issues/20384
3. https://github.com/anthropics/claude-code/issues/148

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

Found 3 possible duplicate issues: 1. [[FEATURE] Separate AWS profile for Bedrock API calls vs. shell command environment #25394](https://github.com/anthropics/claude-code/issues/25394) 2. [[FEATURE] separate AWS profiles for Bedrock model calls and for AWS API calls #20384](https://github.com/anthropics/claude-code/issues/20384) 3. Feature request: allow to set AWS profile #148 This issue will be automatically closed as a duplicate in 3 days. If your issue is a duplicate, please close it and 👍 the existing issue instead To prevent auto-closure, add a comment or 👎 this comment 🤖 Generated with Claude Code

First two issues were closed with no resolution and no answers, the last one is simply asking on how to configure the profile

Two-part fix needed for Bedrock credential isolation

This issue has been reported repeatedly since February 2025 and auto-closed every time without resolution. Here is the full chain:

| Issue | Title | Closed By |
|-------|-------|-----------|
| #148 | Feature request: allow to set AWS profile | Stale bot |
| #11953 | awsCredentialExport seems to have lower priority than .aws/credentials | Stale bot (despite active comments) |
| #20384 | Separate AWS profiles for Bedrock model calls and AWS API calls | Duplicate bot → #148 |
| #25394 | Separate AWS profile for Bedrock API calls vs. shell command environment | Stale bot |
| #29765 | Bedrock Credentials inherited by child processes, override ~/.aws/ | Duplicate bot → #25394 |

Each "duplicate" target was itself already closed. No human from Anthropic has addressed the underlying problem.

The fix has two distinct parts:

Part 1: awsCredentialExport should override the default AWS credential chain

Currently, if ~/.aws/credentials or AWS_PROFILE provides valid credentials, awsCredentialExport is silently skipped (#11953). The debug log confirms this:

Fetched AWS caller identity, skipping AWS credential export command

This is backwards. awsCredentialExport is a Claude-specific setting that users explicitly configure — it should take priority over ambient AWS credentials, not be overridden by them. The whole point of configuring awsCredentialExport is to provide different credentials for Bedrock than what's already in the environment.

Part 2: Introduce CLAUDE_BEDROCK_AWS_PROFILE (or BEDROCK_AWS_PROFILE)

A dedicated env var / config option that Claude Code uses exclusively for Bedrock API calls. Shell commands and child processes should inherit the user's ambient AWS_PROFILE (or no profile), not the Bedrock one.

Proposed credential resolution order for Bedrock calls:

1. awsCredentialExport (explicit credential command — highest priority)
2. CLAUDE_BEDROCK_AWS_PROFILE (dedicated Bedrock profile)
3. Standard AWS SDK provider chain (AWS_PROFILE, ~/.aws/credentials, instance metadata, etc.)

For child processes (shell commands, MCP servers):

• Inherit the user's original environment
• Do NOT inject Bedrock credentials into the child process env

This is a productivity blocker for anyone using separate AWS accounts for Bedrock vs. development work. The current behaviour means shell commands and MCP servers silently authenticate as the wrong AWS identity, leading to confusing permission errors or operations against unintended accounts.

### Two-part fix needed for Bedrock credential isolation This issue has been reported repeatedly since February 2025 and auto-closed every time without resolution. Here is the full chain: Issue Title Closed By #148 Feature request: allow to set AWS profile Stale bot #11953 awsCredentialExport seems to have lower priority than .aws/credentials Stale bot (despite active comments) #20384 Separate AWS profiles for Bedrock model calls and AWS API calls Duplicate bot → #148 #25394 Separate AWS profile for Bedrock API calls vs. shell command environment Stale bot #29765 Bedrock Credentials inherited by child processes, override ~/.aws/ Duplicate bot → #25394 Each "duplicate" target was itself already closed. No human from Anthropic has addressed the underlying problem. The fix has two distinct parts: Part 1: awsCredentialExport should override the default AWS credential chain Currently, if ~/.aws/credentials or AWS_PROFILE provides valid credentials, awsCredentialExport is silently skipped (#11953). The debug log confirms this: `` Fetched AWS caller identity, skipping AWS credential export command ` This is backwards. awsCredentialExport is a Claude-specific setting that users explicitly configure — it should take priority over ambient AWS credentials, not be overridden by them. The whole point of configuring awsCredentialExport is to provide _different_ credentials for Bedrock than what's already in the environment. **Part 2: Introduce CLAUDE_BEDROCK_AWS_PROFILE (or BEDROCK_AWS_PROFILE)** A dedicated env var / config option that Claude Code uses exclusively for Bedrock API calls. Shell commands and child processes should inherit the user's ambient AWS_PROFILE (or no profile), not the Bedrock one. **Proposed credential resolution order for Bedrock calls:** 1. awsCredentialExport (explicit credential command — highest priority) 2. CLAUDE_BEDROCK_AWS_PROFILE (dedicated Bedrock profile) 3. Standard AWS SDK provider chain (AWS_PROFILE, ~/.aws/credentials`, instance metadata, etc.) For child processes (shell commands, MCP servers): Inherit the user's original environment Do NOT inject Bedrock credentials into the child process env This is a productivity blocker for anyone using separate AWS accounts for Bedrock vs. development work. The current behaviour means shell commands and MCP servers silently authenticate as the wrong AWS identity, leading to confusing permission errors or operations against unintended accounts.

This. I've found the 'awsCredentialExport' option some time after opening this issue and was positively excited that I might be able to go around it. Well, I wasn't able to, as even after writing a custom credentials provider the only thing I managed to create was a fallback mechanism for when the currently active profile is somehow broken (that's the way I tested it at first, I broke the session token for the active profile and checked if I still can interact with Bedrock via Claude Code). It turned out that my provider was silently ignored when the active profile was working and the only reason I found out was that I introduced my own logging to my custom provider and found no logs for a situation when it should have logged stuff.

This behaviour is not intuitive and doesn't really make sense, as when I use a custom credentials provider it's my conscious decision to do so and it should take precedence over the active profile instead of just being a fallback. Not even mentioning the fact that the bedrock profile choice should just be a configuration option, it's even available in other tools that directly compete with Claude Code.

This would make Claude Code much more useful for my team. AWS access is required to fetch the container with build tools, so it's a constant hassle. Many of us have been switching to Cursor because we don't have this problem with it.

The behavior here seems to contradict the docs:

You can use settings files for environment variables like AWS_PROFILE that you don’t want to leak to other processes.

Putting environment variables like AWS_PROFILE in your settings file does, in fact, leak them to other processes (namely, every process that Claude Code spins up).

If anyone is looking for a workaround, you can use the CLAUDE_ENV_FILE (not sure if this works with MCP):

Make a .env file somewhere such as the ~/.claude directory with this line:

export AWS_PROFILE=<your personal profile>

Then in the claude settings.json set these environment variables:

{
  "model": "claude-opus-4-6",
  "env": {
    "AWS_PROFILE": "<bedrock profile>",
    "CLAUDE_ENV_FILE": "<path to your .env file>"
  }
}

Note that the CLAUDE_ENV_FILE doesn't support tilde expansion here.

But there definitely needs to be an option to simply set the Bedrock profile directly.

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

I noticed this in the Claude Code 2.1.172 changelog entry:

Amazon Bedrock now reads the AWS region from ~/.aws config files when AWS_REGION isn’t set, matching AWS SDK precedence; /status shows where the region came from

I confirmed that I no longer need to set the AWS_REGION env var for Claude: I just have AWS_PROFILE set, and it uses the region defined for that profile in ~/.aws/config.

So that partly solves the problem here, at least. Having AWS_REGION set to my Bedrock region was the main source of my agent's AWS commands getting tripped up.