[BUG] Bedrock Application Inference Profile ARN SigV4 signing broken (claude-agent-sdk 0.2.93–0.2.96)
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
When using claude-code-action@v1 with AWS Bedrock and an Application Inference Profile ARN as the model, all requests fail with 403. The SDK sends a non-SigV4 Authorization header to the Bedrock endpoint instead of a properly signed AWS4-HMAC-SHA256 header.
What Should Happen?
Requests to Bedrock should be signed with SigV4 using the available AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), matching the behaviour in claude-agent-sdk@0.2.92.
Error Messages/Logs
Failed to authenticate. API Error: 403 Authorization header requires 'Credential' parameter.
Authorization header requires 'Signature' parameter.
Authorization header requires 'SignedHeaders' parameter.
(Hashed with SHA-256 and encoded with Base64) Authorization=cQ4NvdQimYUQF6TWcmXs0EbxtO23QVJZkqGmqPqAElg=
Steps to Reproduce
- Use claude-code-action@v1 (SHA 26ddc358 / claude-agent-sdk@0.2.96) in a GitHub Actions workflow
- Set use_bedrock: true with AWS OIDC credentials (configure-aws-credentials@v4)
- Pass an Application Inference Profile ARN via claude_args: --model arn:aws:bedrock:us-east-1:<account>:application-inference-profile/<id>
- Run the workflow — pre-flight check (aws bedrock-runtime invoke-model) passes, but Claude Code returns 403 auth failure
Workaround: pin to SHA 6e2bd52842c65e914eba5c8badd17560bd26b5de (claude-agent-sdk@0.2.92)
Claude Model
None
Is this a regression?
Yes, this worked in a previous version
Last Working Version
claude-agent-sdk@0.2.92 (action SHA 6e2bd52)
Claude Code Version
check claude-code-action@v1 SHA 26ddc358 bundled version
Platform
AWS Bedrock
Operating System
Ubuntu/Debian Linux
Terminal/Shell
Non-interactive/CI environment
Additional Information
Related issues: #27890, #29660
Note: standard cross-region inference profile model IDs (us.anthropic.claude-*) are NOT affected — only Application Inference Profile ARNs trigger this.
This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗