[BUG] AWS Bedrock, Calling us-east-2 region instead of the specified region
Resolved 💬 8 comments Opened Mar 19, 2025 by chatii Closed Mar 21, 2025
Environment
- Platform (select one):
- [ ] Anthropic API
- [x] AWS Bedrock
- [ ] Google Vertex AI
- [ ] Other: <!-- specify -->
- Claude CLI version:
0.2.49 (Claude Code) - Operating System: macOS 15.2
- Terminal: iTerm2
Using AWS Control Tower to restrict access to regions other than us-east-1 and ap-northeast-1
Sonnet 3.7 and Haiku 3.5 are available in us-east-1
Bug Description
Regardless of the region specified in AWS environment variables or profiles, Claude Code uses models in the us-east-2 region.
Steps to Reproduce
- Block access to us-east-2
- Request access to Claude Sonnet 3.7 and Haiku 3.5 in us-east-1
- Create an IAM user with the
AmazonBedrockFullAccesspolicy - Create a profile for the IAM user with default region
us-east-1 - Run claude with the environment variables set
- When making any request, a 403 error occurs
Expected Behavior
Claude Code should use models in us-east-1 and execute normally.
Actual Behavior
> test
⎿ API Error: 403 {"Message":"User: arn:aws:iam::160885266706:user/test-claude-code-20250319 is not authorized to perform: bedrock:InvokeModelWithResponseStream on
Additional Context
Environment Variables
export AWS_PROFILE={iam-user-profile-name}
export CLAUDE_CODE_USE_BEDROCK=1
export ANTHROPIC_MODEL='us.anthropic.claude-3-7-sonnet-20250219-v1:0'
export ANTHROPIC_SMALL_FAST_MODEL='us.anthropic.claude-3-5-haiku-20241022-v1:0'
export DISABLE_PROMPT_CACHING=1
Error message from AWS CloudTrail event record:
User: arn:aws:iam::XXXXXXXXXX:user/XXXXXXXXXX is not authorized to perform: bedrock:InvokeModelWithResponseStream on resource: arn:aws:bedrock:us-east-2::foundation-model/anthropic.claude-3-5-haiku-20241022-v1:0 with an explicit deny in a service control policy"
This issue has 8 comments on GitHub. Read the full discussion on GitHub ↗