[BUG] Claude using AWS provided inference profiles when application inference profiles are set
Resolved 💬 5 comments Opened Aug 20, 2025 by cwalkatron Closed Aug 23, 2025
Environment
- Platform (select one):
- [ ] Anthropic API
- [x] AWS Bedrock
- [ ] Google Vertex AI
- [ ] Other: <!-- specify -->
- Claude CLI version: 1.0.85
- Operating System: AlmaLinux 9.5
- Terminal: Ghostty
Bug Description
We are using application inference profiles in our account for Claude Code's access to models. This is so we can track costs and have other tagging. We are setting $ANTHROPIC_MODEL and $ANTHROPIC_SMALL_FAST_MODEL to application inference profiles for 4 Sonnet and 3.5 Haiku respectively. However, when /statusline is used (and sometimes at other times), the following error is thrown:
API Error (403 {"Message":"User: arn:aws:sts::XXXXXXXXX:assumed-role/XXXXXXXX/XXX@XXXXX.com is not authorized to perform: bedrock:InvokeModel on resource: arn:aws:bedrock:us-west-2:XXXXXXXXX:inference-profile/us.anthropic.claude-sonnet-4-20250514-v1:0 because no identity-based policy allows the bedrock:InvokeModel action"}) · Retrying in 1 seconds… (attempt 1/10)
Our role doesn't allow direct access to the AWS provided inference profiles. Access to foundation models is conditional. Here is a redacted IAM policy:
{
"PolicyVersion": {
"Document": {
"Statement": [
{
"Action": [
"bedrock:UseInferenceProfile",
"bedrock:InvokeModelWithResponseStream",
"bedrock:InvokeModel"
],
"Effect": "Allow",
"Resource": [
"arn:aws:bedrock:us-west-2:XXXXXXXX:application-inference-profile/abcdef",
# [...]
]
},
{
"Action": [
"bedrock:InvokeModelWithResponseStream",
"bedrock:InvokeModel"
],
"Condition": {
"ArnEquals": {
"bedrock:InferenceProfileArn": [
"arn:aws:bedrock:us-west-2:XXXXX",
# [...]
]
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
},
"VersionId": "vX",
"IsDefaultVersion": true,
"CreateDate": "2025-08-11T21:58:04+00:00"
}
}
Steps to Reproduce
- Set
$CLAUDE_CODE_USE_BEDROCK=1and $ANTHROPIC_MODELand$ANTHROPIC_SMALL_FAST_MODEL - run Claude Code with
/statusline
Expected Behavior
/statusline would throw no errors and use the provided application inference profiles.
Actual Behavior
The API error above.
This issue has 5 comments on GitHub. Read the full discussion on GitHub ↗