[BUG] Bedrock: Claude Opus 4.7 returns permission_error despite AUTHORIZED entitlement status
Status Open
Reported on v2.1.113
Maintainer reply None cached
Workaround ✓ Mentioned in thread ↓
Activity 39 comments · opened Apr 20, 2026
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
Summary
Claude Opus 4.7 on Amazon Bedrock returns a permission_error at runtime despite the account being fully authorized according to AWS's control plane APIs.
Environment
- Regions tested: us-east-1, us-east-2, us-west-2
- Model ID: anthropic.claude-opus-4-7
- Inference Profiles: us.anthropic.claude-opus-4-7, global.anthropic.claude-opus-4-7
- AWS CLI: 2.34.32
- IAM Role: AdministratorAccess (full permissions)
- Date: 2026-04-20
Control Plane Says AUTHORIZED
aws bedrock get-foundation-model-availability \
--model-id anthropic.claude-opus-4-7 \
--region us-east-1
{
"modelId": "anthropic.claude-opus-4-7",
"agreementAvailability": { "status": "AVAILABLE" },
"authorizationStatus": "AUTHORIZED",
"entitlementAvailability": "AVAILABLE",
"regionAvailability": "AVAILABLE"
}
Inference profiles also show ACTIVE:
aws bedrock list-inference-profiles --region us-east-1 \
--query "inferenceProfileSummaries[?contains(inferenceProfileId, 'opus-4-7')].{id:inferenceProfileId, status:status}"
[
{ "id": "us.anthropic.claude-opus-4-7", "status": "ACTIVE" },
{ "id": "global.anthropic.claude-opus-4-7", "status": "ACTIVE" }
]
### What Should Happen?
Invoking `us.anthropic.claude-opus-4-7` via Bedrock should return a model response, consistent with the account's entitlement status (AUTHORIZED, AVAILABLE) as reported by `get-foundation-model-availability`. The same invocation pattern works for Claude Opus 4.6 on the same account.
### Error Messages/Logs
```shell
Both invoke-model and converse APIs fail:
aws bedrock-runtime converse \
--model-id us.anthropic.claude-opus-4-7 \
--messages '[{"role":"user","content":[{"text":"hi"}]}]' \
--inference-config '{"maxTokens":10}' \
--region us-east-1
{
"type": "error",
"error": {
"type": "permission_error",
"message": "anthropic.claude-opus-4-7 is not available for this account. You can explore other available models on Amazon Bedrock. For additional access options, contact AWS Sales at https://aws.amazon.com/contact-us/sales-support/"
}
}Steps to Reproduce
Steps to Reproduce
- Confirm model entitlement shows AUTHORIZED:
aws bedrock get-foundation-model-availability \
--model-id anthropic.claude-opus-4-7 \
--region us-east-1
Expected output:
{
"modelId": "anthropic.claude-opus-4-7",
"agreementAvailability": { "status": "AVAILABLE" },
"authorizationStatus": "AUTHORIZED",
"entitlementAvailability": "AVAILABLE",
"regionAvailability": "AVAILABLE"
}
Confirm inference profile is ACTIVE:
aws bedrock list-inference-profiles --region us-east-1 \
--query "inferenceProfileSummaries[?contains(inferenceProfileId, 'opus-4-7')].{id:inferenceProfileId, status:status}"
Attempt to invoke the model:
aws bedrock-runtime converse \
--model-id us.anthropic.claude-opus-4-7 \
--messages '[{"role":"user","content":[{"text":"hi"}]}]' \
--inference-config '{"maxTokens":10}' \
--region us-east-1
Observe permission_error despite step 1 and 2 confirming access:
{
"type": "error",
"error": {
"type": "permission_error",
"message": "anthropic.claude-opus-4-7 is not available for this account."
}
}
### Claude Model
Opus
### Is this a regression?
Yes, this worked in a previous version
### Last Working Version
Claude Opus 4.6 (us.anthropic.claude-opus-4-6-v1)
### Claude Code Version
2.1.113
### Platform
AWS Bedrock
### Operating System
Windows
### Terminal/Shell
VS Code integrated terminal
### Additional Information
The same permission_error occurs in the AWS Bedrock Console Model Playground when selecting Claude Opus 4.7, confirming this is not a CLI or SDK issue but an account-level entitlement problem.
Additionally, `get-foundation-model-availability` returns all green (AUTHORIZED, AVAILABLE) which contradicts the runtime behavior. This suggests a sync issue between the AWS entitlement control plane and Anthropic's runtime access layer.
Tested with:
- AWS CLI v2.34.32 (invoke-model + converse APIs)
- AWS Bedrock Console Playground
- Inference profiles: us.anthropic.claude-opus-4-7, global.anthropic.claude-opus-4-7
- Regions: us-east-1, us-east-2, us-west-2
- Last working model: Claude Opus 4.6 (us.anthropic.claude-opus-4-6-v1)
39 Comments
Found 1 possible duplicate issue:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
Why this is not a duplicate of #49238:
Issue #49238 was a 400 invalid_request_error: "invalid beta flag" — a client-side request formatting problem (Claude Code was sending a beta header that Bedrock didn't recognize). That was resolved by fixing the client.
Our issue is a permission_error: "anthropic.claude-opus-4-7 is not available for this account" — an account-level entitlement/authorization problem on Anthropic's runtime side. The request format is valid (same request works for Opus 4.6). The issue is that:
get-foundation-model-availability returns AUTHORIZED + AVAILABLE
list-inference-profiles shows the model as ACTIVE
Yet the runtime rejects with a permission error
Addendum: Quotas and Entitlements Confirmed
All AWS-side checks pass — the block is on Anthropic's runtime layer.
Service Quotas (non-zero, healthy)
Entitlement Status
Inference Profiles
Summary
Every AWS control plane check confirms this account is authorized and provisioned for Opus 4.7. The permission_error is originating from Anthropic's runtime behind Bedrock, not from AWS IAM, entitlements, or quotas.
Commenting to say I have the same issue. Reached out on aws support chat (sales) as the error states, to no avail. Also have admin access policy, and on us-east-1. 4.6 is working fine as always- this newer model only returns the same error:
ValidationException
The model returned the following errors: {"type":"error","request_id":"req_53moalmez7mmete26kseeghquow2ieie4tovdwyzxm2bkjffcexa","error":{"type":"permission_error","message":"anthropic.claude-opus-4-7 is not available for this account. You can explore other available models on Amazon Bedrock. For additional access options, contact AWS Sales at https://aws.amazon.com/contact-us/sales-support/"}}
To restate very plainly, as it pertains to the "reach out to sales" message. I have reached out, and our AWS rep isn't clear on what's going on. Per my last comment above, when inspecting via the
aws cli, it appears that we have bothmodel availabilityand aquota— so, technically, I can't see what's wrong. However, when we look at our AWS Dashboard on Bedrock'sQuota page, we seeNot supportedto request a quota increase.So, I have no idea how to go about realizing a fix here. So, strictly speaking, perhaps this isn't a software bug per se. Perhaps all the systems are working as expected — but this is certainly a policy bug, because I'm chasing my tail for the whole day, and the solution is absolutely opaque to me.
<img width="1612" height="588" alt="Image" src="https://github.com/user-attachments/assets/892bb9b6-9ddd-4336-84bb-99baaa138f02" />
Same issue here on us-east-1. Confirming the AUTHORIZED-but-denied state described in the OP.
Environment
us-east-1us.anthropic.claude-opus-4-7,global.anthropic.claude-opus-4-7us.anthropic.claude-opus-4-6-v1(works fine)AmazonBedrockFullAccess+AmazonBedrockMarketplaceAccess+AWSMarketplaceFullAccessattached directly, no SCP restrictionsRuntime error
Control plane disagrees — reports fully authorized
Account ID redacted but happy to share privately with an Anthropic/AWS engineer if it helps correlate on the runtime entitlement side.
I have the same issue.
Can confirm same issue. All other model/endpoint worked. Tried different inference profiles, no luck.
Having the same issue as well.
I've heard back from AWS Support, and can confirm that Opus 4.7 is gated in a way that's not visible via the public API. At least for now, it seems like this is a "call your rep" situation. I'll update again once we find a resolution. I'd appreciate it if anyone could do the same.
In the meantime, this doesn't seem to be a technical or configuration issue.
If we request they open it for the account or we only need to wait?
It seems to have resolved for me, I am not sure what changed in the background
I also get error in the playground UI from models catalog. which region are you working with?
<img width="1554" height="782" alt="Image" src="https://github.com/user-attachments/assets/9877a6cc-362b-4ccf-805f-f96a695126b2" />
us-east-1
tried it on the playground and it worked. then with api using
global.anthropic.claude-opus-4-7
On Wed, Apr 22, 2026 at 3:48 PM Ali Mirzaei @.***>
wrote:
I also still get the same error; anyone else able to get it fixed?
+1 Also started working for me. AWS Quota still shows - for RPM, 15M TPM.
Bedrock model playground and Claude Code via Bedrock also works. Without reaching out to sales or anything.
These env vars for claude code finally got it to work for me:
CLAUDE_CODE_USE_BEDROCK=1 ANTHROPIC_MODEL="global.anthropic.claude-opus-4-7" CLAUDE_CODE_USE_MANTLE=1 AWS_REGION=us-east-1Confirming @nickyli98 's message. 4.7 started working for us. Quotas still read as not supported.
Claude Code worked with AWS Bedrock for a few days (Claude Code ~2.1.11x), but now seems from ~2.1.12x, it doesn't work again, with only dreadful "...retry x/8 and no error message like before) ... checked AWS Bedrock Management Console: both geo and global quotas are zero, aws cli confirms too:
despite authorized:
<img width="1407" height="303" alt="Image" src="https://github.com/user-attachments/assets/8c93c8bb-5a43-4e3b-be40-0cb97a32f332" />
Submitted on AWS "quota increase requests", wait and see...
I found the probable cause. The quotas are zero and that is limiting you for using the models. there are three dots as shared by charles-cai so basically click on the three dots and then you have request increase quota TPM and RPM , just click the TPM and write a big number like 100,000,000 and send the request (if it is too big then it will warn you) so then just put the biggest possible number and send it. it will take some time to be reviewed and then it will be activated. I just did it for both Claude 4.7 models and then you have to wait for it. it seems like a slow process 4-5 days. I hope it works please try it out and I hope we get it solved!
I did request quota increase (from zero), and got rejected :( there was a real person responding to my request but he said after talking with service team, because I'm not using 90% of the existing quota hence the rejection, and I could request again next billing month... so still not solved.
Sigh, I tried the new "Claude Platform on AWS" https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws, but got another error - should be raising a new ticket on this one in CC: API Error: 400 Missing 'anthropic-workspace-id' header. (which I did supply via environment variable).
I feel you. I used a lot of the capacity and I am almost out of credits so perhaps I will have chance to get accepted, I am rate limited in all requests by minute and day on all available models. I see it was much easier to use Claude code to keep track of the usage. and even better is the Github copilot from first of June since it will also apply the pay as you go with the credits. AWS was good to test and try but it is causing too much complication and confusion. I used Github Copilot to set it up :))
I hope you also find a solution soon. If you have used Claude Opus 4.7 you know how powerful it is in one run it always fixes all issues for me (but it is very expensive) :(
OK, good news: after some trial and error, based on https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws I replaced my existing ~/.env for AWS Bedrock with Claude Platform on AWS environment variables: created a new account registration via AWS Marketplace -> Claude Console + new API key, back and forth between AWS Claude Platform Console and Claude Console), and it worked, i.e. now my Claude code is powered by Claude Platform on AWS, Opus 4.7 is there as the default.
The billing is still on AWS so all our credits should still work; thought granular console via Claude Workspace is big weird, I can only see / create one workspace, but I still can create more API keys, so at least I have segregation for different projects or by different team members.
Next see how stable / rate limiting it might be, and how the billing / cost splitting works.
I also got some issue in claude Opus 4.7 and Opus 4.6, but it worked with Opus 4.5 and other anthropic model.
Wandering here, how to make it work for me.
<img width="1853" height="810" alt="Image" src="https://github.com/user-attachments/assets/ef08b053-679c-4ec8-a5cc-ced54f986360" />
I had no luck restoring access through an AWS support ticket, so sharing this since someone else might be in the same boat:
Anyone have any luck with this? Still having this error with 4.7 & 4.8.
It does work for me for Claude Platform on AWS, but it has a separate bill (it counts for AWS marketplace on AWS bills instead of AWS Bedrock) which could not use my current AWS credit.
Adding our data point — confirming this is still active for Opus 4.8 as of 2026-06-08 (~3 hours ago and just now).
Environment
us.anthropic.claude-opus-4-8,global.anthropic.claude-opus-4-8,us.anthropic.claude-opus-4-7us.anthropic.claude-sonnet-4-6,us.anthropic.claude-haiku-4-5(no issues, normal latency)AmazonBedrockFullAccess+ explicit model ARNs). Identical 403 either way.Control plane: AUTHORIZED on every signal
I also just hit this same issue
i have this same issue
I have the same issue.
same issue.
same issue
same issue
same
Same.
Just saw this earlier: https://www.reddit.com/r/aws/comments/1ukgucj/claude_opus_48_on_aws_bedrock/
Can someone confirm they are not on credits and still having this issue? (or say they are on credits too)
I am not on credits and am having this issue with Sonnet 5, Opus 5, and Fable 5.
i got an answer from the support team after 2 whole months.
<details>
<summary>AWS support response</summary>
</details>
TL;DR: they won't give access to Anthropic models or anything actually powerful to potentially "fraudulent" accounts. From what i can gather this is most likely account age related.
The support ticket was automatically closed 10 days after their response and the link to reopen it leads to a 404 page.
With all of this in mind I don't understand why they don't show this in their UI or specifically state why my account may be "fraudulent", and what I could do to fix this. This is a really bad first impression of AWS, and seeing that I am apparently already a "fraudulent" user just for using their services I will reconsider other options for my cloud infrastructure needs.
Another confirmation, plus two data points I haven't seen reported yet that rule out the "just accept the Marketplace agreement" and "just resubmit the use-case form" theories.
Same state as the OP. Region
us-east-1, admin credentials, and also reproduced with a separate scoped invoke-only key. Denied:claude-sonnet-5,claude-opus-5,claude-fable-5,claude-opus-4-8,claude-opus-4-7,claude-opus-4-5. Working on the same account/credentials:claude-opus-4-6-v1,claude-sonnet-4-6,claude-sonnet-4-5,claude-haiku-4-5. Tested against both the bare model id and theus.inference profile.1. Accepting the Marketplace agreement does not fix it
agreementAvailabilitywasNOT_AVAILABLEfor the denied models, which looked like the smoking gun.list-foundation-model-agreement-offersdid return valid offer tokens, so we accepted them viacreate-foundation-model-agreement(0.00 USD).State progressed
NOT_AVAILABLE→PENDING→AVAILABLEwithin ~2 minutes, and all four fields then read positive — matching the OP exactly:The invoke still fails, same
permission_error ... contact AWS Sales. So the agreement field is necessary-but-not-sufficient, and anyone (like us) who built a watcher pollingagreementAvailabilityto detect the unlock will get a false positive. Only an actual invoke settles it.2.
PutUseCaseForModelAccessappears to be write-once, so the FTU form can't be correctedA suggested workaround going around is to (re)submit the Anthropic first-time-use form from the Bedrock console playground. There is an API for it, and on our account it shows a use-case record that was submitted long ago and contains a malformed
useCasesvalue.Trying to correct it:
put-use-case-for-model-access --form-data fileb://<raw JSON>→ exit 0, no error, andget-use-case-for-model-accessreturns the old record unchanged. Silent no-op.ValidationException: Invalid form data.ValidationException: Invalid form data.So the service rejects the exact shape it hands back, and accepts raw JSON without persisting it. Net effect: if your account has a bad or stale FTU record, there is no API path to fix it, and the write silently reports success.
If this entitlement is keyed off that use-case record on the Anthropic side, that would explain an account being stuck at a model generation while every AWS-side signal reads AUTHORIZED — and it would explain why "contact AWS Sales" goes nowhere, since the AWS rep sees a fully-provisioned account.
Happy to share the account id privately with an Anthropic or AWS engineer to correlate.