[BUG] AWS Bedrock, Calling us-east-2 region instead of the specified region
Status Fixed / completed
Maintainer reply ✓ Yes — 8enmann
Activity 8 comments · opened Mar 19, 2025 · closed Mar 21, 2025
💡 Likely answer: A maintainer (8enmann, collaborator)
responded on this thread — see the highlighted reply below.
Environment
- Platform (select one):
- [ ] Anthropic API
- [x] AWS Bedrock
- [ ] Google Vertex AI
- [ ] Other: <!-- specify -->
- Claude CLI version:
0.2.49 (Claude Code) - Operating System: macOS 15.2
- Terminal: iTerm2
Using AWS Control Tower to restrict access to regions other than us-east-1 and ap-northeast-1
Sonnet 3.7 and Haiku 3.5 are available in us-east-1
Bug Description
Regardless of the region specified in AWS environment variables or profiles, Claude Code uses models in the us-east-2 region.
Steps to Reproduce
- Block access to us-east-2
- Request access to Claude Sonnet 3.7 and Haiku 3.5 in us-east-1
- Create an IAM user with the
AmazonBedrockFullAccesspolicy - Create a profile for the IAM user with default region
us-east-1 - Run claude with the environment variables set
- When making any request, a 403 error occurs
Expected Behavior
Claude Code should use models in us-east-1 and execute normally.
Actual Behavior
> test
⎿ API Error: 403 {"Message":"User: arn:aws:iam::160885266706:user/test-claude-code-20250319 is not authorized to perform: bedrock:InvokeModelWithResponseStream on
Additional Context
Environment Variables
export AWS_PROFILE={iam-user-profile-name}
export CLAUDE_CODE_USE_BEDROCK=1
export ANTHROPIC_MODEL='us.anthropic.claude-3-7-sonnet-20250219-v1:0'
export ANTHROPIC_SMALL_FAST_MODEL='us.anthropic.claude-3-5-haiku-20241022-v1:0'
export DISABLE_PROMPT_CACHING=1
Error message from AWS CloudTrail event record:
User: arn:aws:iam::XXXXXXXXXX:user/XXXXXXXXXX is not authorized to perform: bedrock:InvokeModelWithResponseStream on resource: arn:aws:bedrock:us-east-2::foundation-model/anthropic.claude-3-5-haiku-20241022-v1:0 with an explicit deny in a service control policy"
8 Comments
You're setting
AWS_REGION=us-east-1? Can you try it without a profile, ie setAWS_PROFILE=and useAWS_ACCESS_KEY_IDetc?Yes, I actually tried that as well. Even when setting the environment variables as shown below, I get exactly the same error message and logs.
Here's a summary of what I think might be causing the issue:
The problem may be that an inference profile is needed, and AWS Bedrock only provides cross-region inference.
I suspect that Bedrock doesn't account for scenarios like mine where regions are restricted for security reasons.
Therefore, I imagine that regardless of the Credentials or
AWS_REGIONspecified, whenus.anthropic.claude-3-7-sonnet-20250219-v1:0is requested, AWS internally routes to use the model inus-east-2.!Image
If this assumption is correct, then the issue isn't with Claude Code itself...
Yes, that sounds right. What happens if you use the us-east-1 arn for the model instead of
us...I tried the following:
First, I got the Sonnet and Haiku ARNs:
Then, after setting these ARNs as environment variables, I ran claude and tried "hello", but received:
I got
Confusingly, need to escape the inference profile like https://github.com/anthropics/claude-code/issues/297#issuecomment-2715511132
As you suggested, I tried escaping the slashes, and it seems the ARN was recognized correctly. However, I received an error indicating it wasn't an inference profile.
I think we can state that one requirement for using AWS Bedrock with Claude Code is:
This may be outside the scope of Claude Code, so it doesn't need to be included in the documentation,
but it might be helpful to add as a troubleshooting tip.
Also, in my current environment, enabling us-east-2 and us-west-2 requires security review.
I would have liked to test with these regions enabled and share the results, but that's not possible for me.
This issue can be closed as it's related to AWS specifications.
Thank you for your help!
Thanks for looking into it! We'll get the docs updated 🙏
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.