[BUG] AWS Bedrock, Calling us-east-2 region instead of the specified region

Resolved 💬 8 comments Opened Mar 19, 2025 by chatii Closed Mar 21, 2025

Environment

  • Platform (select one):
  • [ ] Anthropic API
  • [x] AWS Bedrock
  • [ ] Google Vertex AI
  • [ ] Other: <!-- specify -->
  • Claude CLI version: 0.2.49 (Claude Code)
  • Operating System: macOS 15.2
  • Terminal: iTerm2

Using AWS Control Tower to restrict access to regions other than us-east-1 and ap-northeast-1
Sonnet 3.7 and Haiku 3.5 are available in us-east-1

Bug Description

Regardless of the region specified in AWS environment variables or profiles, Claude Code uses models in the us-east-2 region.

Steps to Reproduce

  1. Block access to us-east-2
  2. Request access to Claude Sonnet 3.7 and Haiku 3.5 in us-east-1
  3. Create an IAM user with the AmazonBedrockFullAccess policy
  4. Create a profile for the IAM user with default region us-east-1
  5. Run claude with the environment variables set
  6. When making any request, a 403 error occurs

Expected Behavior

Claude Code should use models in us-east-1 and execute normally.

Actual Behavior

> test
  ⎿  API Error: 403 {"Message":"User: arn:aws:iam::160885266706:user/test-claude-code-20250319 is not authorized to perform: bedrock:InvokeModelWithResponseStream on

Additional Context

Environment Variables

export AWS_PROFILE={iam-user-profile-name}
export CLAUDE_CODE_USE_BEDROCK=1
export ANTHROPIC_MODEL='us.anthropic.claude-3-7-sonnet-20250219-v1:0'
export ANTHROPIC_SMALL_FAST_MODEL='us.anthropic.claude-3-5-haiku-20241022-v1:0'
export DISABLE_PROMPT_CACHING=1

Error message from AWS CloudTrail event record:

User: arn:aws:iam::XXXXXXXXXX:user/XXXXXXXXXX is not authorized to perform: bedrock:InvokeModelWithResponseStream on resource: arn:aws:bedrock:us-east-2::foundation-model/anthropic.claude-3-5-haiku-20241022-v1:0 with an explicit deny in a service control policy"

View original on GitHub ↗

This issue has 8 comments on GitHub. Read the full discussion on GitHub ↗