[BUG] Claude using AWS provided inference profiles when application inference profiles are set

Status Fixed / completed
Maintainer reply ✓ Yes — dicksontsai
Activity 5 comments · opened Aug 20, 2025 · closed Aug 23, 2025
💡 Likely answer: A maintainer (dicksontsai, collaborator) responded on this thread — see the highlighted reply below.

Environment

  • Platform (select one):
  • [ ] Anthropic API
  • [x] AWS Bedrock
  • [ ] Google Vertex AI
  • [ ] Other: <!-- specify -->
  • Claude CLI version: 1.0.85
  • Operating System: AlmaLinux 9.5
  • Terminal: Ghostty

Bug Description

We are using application inference profiles in our account for Claude Code's access to models. This is so we can track costs and have other tagging. We are setting $ANTHROPIC_MODEL and $ANTHROPIC_SMALL_FAST_MODEL to application inference profiles for 4 Sonnet and 3.5 Haiku respectively. However, when /statusline is used (and sometimes at other times), the following error is thrown:

API Error (403 {"Message":"User: arn:aws:sts::XXXXXXXXX:assumed-role/XXXXXXXX/XXX@XXXXX.com is not authorized to perform: bedrock:InvokeModel on resource: arn:aws:bedrock:us-west-2:XXXXXXXXX:inference-profile/us.anthropic.claude-sonnet-4-20250514-v1:0 because no identity-based policy allows the bedrock:InvokeModel action"}) · Retrying in 1 seconds… (attempt 1/10)

Our role doesn't allow direct access to the AWS provided inference profiles. Access to foundation models is conditional. Here is a redacted IAM policy:

{
  "PolicyVersion": {
    "Document": {
      "Statement": [
        {
          "Action": [
            "bedrock:UseInferenceProfile",
            "bedrock:InvokeModelWithResponseStream",
            "bedrock:InvokeModel"
          ],
          "Effect": "Allow",
          "Resource": [
            "arn:aws:bedrock:us-west-2:XXXXXXXX:application-inference-profile/abcdef",
            # [...]
          ]
        },
        {
          "Action": [
            "bedrock:InvokeModelWithResponseStream",
            "bedrock:InvokeModel"
          ],
          "Condition": {
            "ArnEquals": {
              "bedrock:InferenceProfileArn": [
                "arn:aws:bedrock:us-west-2:XXXXX",
                # [...]
              ]
            }
          },
          "Effect": "Allow",
          "Resource": "*"
        }
      ],
      "Version": "2012-10-17"
    },
    "VersionId": "vX",
    "IsDefaultVersion": true,
    "CreateDate": "2025-08-11T21:58:04+00:00"
  }
}

Steps to Reproduce

  1. Set $CLAUDE_CODE_USE_BEDROCK=1 and $ANTHROPIC_MODEL and $ANTHROPIC_SMALL_FAST_MODEL
  2. run Claude Code with /statusline

Expected Behavior

/statusline would throw no errors and use the provided application inference profiles.

Actual Behavior

The API error above.

View original on GitHub ↗

5 Comments

github-actions[bot] · 1 year ago

Found 2 possible duplicate issues:

  1. https://github.com/anthropics/claude-code/issues/541
  2. https://github.com/anthropics/claude-code/issues/1215

This issue will be automatically closed as a duplicate in 3 days.

  • If your issue is a duplicate, please close it and 👍 the existing issue instead
  • To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

dicksontsai collaborator · 1 year ago

This problem is specific to subagents, assigning @sid374

cwalkatron · 1 year ago

It seems like this may be addressed by setting the $ANTHROPIC_DEFAULT_*_MODEL env vars introduced recently. Initial tests are promising.

cwalkatron · 1 year ago

Looks like that does it!

github-actions[bot] · 1 year ago

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.