[BUG] AWS Bedrock, Calling us-east-2 region instead of the specified region

Status Fixed / completed
Maintainer reply ✓ Yes — 8enmann
Activity 8 comments · opened Mar 19, 2025 · closed Mar 21, 2025
💡 Likely answer: A maintainer (8enmann, collaborator) responded on this thread — see the highlighted reply below.

Environment

  • Platform (select one):
  • [ ] Anthropic API
  • [x] AWS Bedrock
  • [ ] Google Vertex AI
  • [ ] Other: <!-- specify -->
  • Claude CLI version: 0.2.49 (Claude Code)
  • Operating System: macOS 15.2
  • Terminal: iTerm2

Using AWS Control Tower to restrict access to regions other than us-east-1 and ap-northeast-1
Sonnet 3.7 and Haiku 3.5 are available in us-east-1

Bug Description

Regardless of the region specified in AWS environment variables or profiles, Claude Code uses models in the us-east-2 region.

Steps to Reproduce

  1. Block access to us-east-2
  2. Request access to Claude Sonnet 3.7 and Haiku 3.5 in us-east-1
  3. Create an IAM user with the AmazonBedrockFullAccess policy
  4. Create a profile for the IAM user with default region us-east-1
  5. Run claude with the environment variables set
  6. When making any request, a 403 error occurs

Expected Behavior

Claude Code should use models in us-east-1 and execute normally.

Actual Behavior

> test
  ⎿  API Error: 403 {"Message":"User: arn:aws:iam::160885266706:user/test-claude-code-20250319 is not authorized to perform: bedrock:InvokeModelWithResponseStream on

Additional Context

Environment Variables

export AWS_PROFILE={iam-user-profile-name}
export CLAUDE_CODE_USE_BEDROCK=1
export ANTHROPIC_MODEL='us.anthropic.claude-3-7-sonnet-20250219-v1:0'
export ANTHROPIC_SMALL_FAST_MODEL='us.anthropic.claude-3-5-haiku-20241022-v1:0'
export DISABLE_PROMPT_CACHING=1

Error message from AWS CloudTrail event record:

User: arn:aws:iam::XXXXXXXXXX:user/XXXXXXXXXX is not authorized to perform: bedrock:InvokeModelWithResponseStream on resource: arn:aws:bedrock:us-east-2::foundation-model/anthropic.claude-3-5-haiku-20241022-v1:0 with an explicit deny in a service control policy"

View original on GitHub ↗

8 Comments

8enmann collaborator · 1 year ago

You're setting AWS_REGION=us-east-1 ? Can you try it without a profile, ie set AWS_PROFILE= and use AWS_ACCESS_KEY_ID etc?

chatii · 1 year ago

Yes, I actually tried that as well. Even when setting the environment variables as shown below, I get exactly the same error message and logs.

export AWS_PROFILE=''
export AWS_ACCESS_KEY_ID='MY_AWS_ACCESS_KEY'
export AWS_SECRET_ACCESS_KEY='MY_AWS_SECRET_ACCESS_KEY'
export AWS_REGION=us-east-1
export AWS_DEFAULT_REGION=us-east-1

export CLAUDE_CODE_USE_BEDROCK=1
export ANTHROPIC_MODEL='us.anthropic.claude-3-7-sonnet-20250219-v1:0'
export ANTHROPIC_SMALL_FAST_MODEL='us.anthropic.claude-3-5-haiku-20241022-v1:0'
export DISABLE_PROMPT_CACHING=1

Here's a summary of what I think might be causing the issue:

The problem may be that an inference profile is needed, and AWS Bedrock only provides cross-region inference.

I suspect that Bedrock doesn't account for scenarios like mine where regions are restricted for security reasons.

Therefore, I imagine that regardless of the Credentials or AWS_REGION specified, when us.anthropic.claude-3-7-sonnet-20250219-v1:0 is requested, AWS internally routes to use the model in us-east-2.

!Image

If this assumption is correct, then the issue isn't with Claude Code itself...

8enmann collaborator · 1 year ago

Yes, that sounds right. What happens if you use the us-east-1 arn for the model instead of us...

chatii · 1 year ago

I tried the following:
First, I got the Sonnet and Haiku ARNs:

aws bedrock list-foundation-models --region us-east-1 --by-provider anthropic --query "modelSummaries[?contains(modelArn, '3-7-sonnet') || contains(modelArn, '3-5-haiku')].modelArn" 

Then, after setting these ARNs as environment variables, I ran claude and tried "hello", but received:

> hello

  ⎿  API Error: Truncated event message received.
8enmann collaborator · 1 year ago

I got

    "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-7-sonnet-20250219-v1:0",
    "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-5-haiku-20241022-v1:0"

Confusingly, need to escape the inference profile like https://github.com/anthropics/claude-code/issues/297#issuecomment-2715511132

    "arn:aws:bedrock:us-east-1::foundation-model%2Fanthropic.claude-3-7-sonnet-20250219-v1:0",
    "arn:aws:bedrock:us-east-1::foundation-model%2Fanthropic.claude-3-5-haiku-20241022-v1:0"
chatii · 1 year ago

As you suggested, I tried escaping the slashes, and it seems the ARN was recognized correctly. However, I received an error indicating it wasn't an inference profile.

Invocation of model ID anthropic.claude-3-7-sonnet-20250219-v1:0 with on-demand throughput isn’t supported

I think we can state that one requirement for using AWS Bedrock with Claude Code is:

  • Access to Bedrock in each region is necessary because inference profiles require cross-region capability

This may be outside the scope of Claude Code, so it doesn't need to be included in the documentation,
but it might be helpful to add as a troubleshooting tip.

Also, in my current environment, enabling us-east-2 and us-west-2 requires security review.
I would have liked to test with these regions enabled and share the results, but that's not possible for me.

This issue can be closed as it's related to AWS specifications.
Thank you for your help!

8enmann collaborator · 1 year ago

Thanks for looking into it! We'll get the docs updated 🙏

github-actions[bot] · 1 year ago

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.