[BUG] Bedrock Application Inference Profile ARN SigV4 signing broken (claude-agent-sdk 0.2.93–0.2.96)

Resolved 💬 2 comments Opened Apr 8, 2026 by karthikeyan-somanathan Closed Apr 8, 2026

Preflight Checklist

  • [x] I have searched existing issues and this hasn't been reported yet
  • [x] This is a single bug report (please file separate reports for different bugs)
  • [x] I am using the latest version of Claude Code

What's Wrong?

When using claude-code-action@v1 with AWS Bedrock and an Application Inference Profile ARN as the model, all requests fail with 403. The SDK sends a non-SigV4 Authorization header to the Bedrock endpoint instead of a properly signed AWS4-HMAC-SHA256 header.

What Should Happen?

Requests to Bedrock should be signed with SigV4 using the available AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), matching the behaviour in claude-agent-sdk@0.2.92.

Error Messages/Logs

Failed to authenticate. API Error: 403 Authorization header requires 'Credential' parameter.                                                              
Authorization header requires 'Signature' parameter.                                                                                                      
Authorization header requires 'SignedHeaders' parameter.                                                                                                  
(Hashed with SHA-256 and encoded with Base64) Authorization=cQ4NvdQimYUQF6TWcmXs0EbxtO23QVJZkqGmqPqAElg=

Steps to Reproduce

  1. Use claude-code-action@v1 (SHA 26ddc358 / claude-agent-sdk@0.2.96) in a GitHub Actions workflow
  2. Set use_bedrock: true with AWS OIDC credentials (configure-aws-credentials@v4)
  3. Pass an Application Inference Profile ARN via claude_args: --model arn:aws:bedrock:us-east-1:<account>:application-inference-profile/<id>
  4. Run the workflow — pre-flight check (aws bedrock-runtime invoke-model) passes, but Claude Code returns 403 auth failure

Workaround: pin to SHA 6e2bd52842c65e914eba5c8badd17560bd26b5de (claude-agent-sdk@0.2.92)

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

claude-agent-sdk@0.2.92 (action SHA 6e2bd52)

Claude Code Version

check claude-code-action@v1 SHA 26ddc358 bundled version

Platform

AWS Bedrock

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Non-interactive/CI environment

Additional Information

Related issues: #27890, #29660
Note: standard cross-region inference profile model IDs (us.anthropic.claude-*) are NOT affected — only Application Inference Profile ARNs trigger this.

View original on GitHub ↗

This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗