[BUG] Subagent spawning fails with marketplace permission error for Amazon Bedrock Haiku 4.5 despite automatic model access

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When Claude Code attempts to spawn subagents (e.g., the Explore subagent) that use Haiku models via AWS Bedrock, it fails with:

403 Model access is denied due to User:
arn:aws:sts::602028460818:assumed-role/AWSReservedSSO_aws-coding-tools-claude_67b12196c3cce3e7/xxx is not authorized to perform: aws-marketplace:ViewSubscriptions on resource: *

This occurs despite:

1. AWS Bedrock now providing automatic access to all serverless foundation models (no marketplace subscription required)
2. The same IAM credentials successfully using Sonnet 4.5 in the main conversation
3. Having properly configured ANTHROPIC_DEFAULT_HAIKU_MODEL=us.anthropic.claude-haiku-4-5-20251001-v1:0

The error occurs for ANY operation that might spawn a Haiku instance, including:

• Task tool (subagent spawning)
• WebFetch tool (when it might use Haiku for processing)

What Should Happen?

Subagents using Haiku should work with the same IAM permissions that allow the main Sonnet agent to function. Since AWS Bedrock foundation models no longer require marketplace subscriptions or manual access requests, the aws-marketplace:ViewSubscriptions permission check should not be required.

The main conversation agent and subagents should use consistent permission requirements.

Error Messages/Logs

[ERROR] Error streaming, falling back to non-streaming mode: 403 Model access is denied due to User:
  arn:aws:sts::602028460818:assumed-role/AWSReservedSSO_aws-coding-tools-claude_67b12196c3cce3e7/xxx@xxx.com is not authorized to perform:
  aws-marketplace:ViewSubscriptions on resource: * because no identity-based policy allows the aws-marketplace:ViewSubscriptions action. Your AWS 
  Marketplace subscription for this model cannot be completed at this time. If you recently fixed this issue, try again after 15 minutes.

  [ERROR] Error in non-streaming fallback: 403 Model access is denied due to User: 
  arn:aws:sts::602028460818:assumed-role/AWSReservedSSO_aws-coding-tools-claude_67b12196c3cce3e7/xxx.xxx@chime.com is not authorized to perform: 
  aws-marketplace:ViewSubscriptions on resource: * because no identity-based policy allows the aws-marketplace:ViewSubscriptions action. Your AWS
  Marketplace subscription for this model cannot be completed at this time. If you recently fixed this issue, try again after 15 minutes.

  Debug log context:
  [DEBUG] executePreToolHooks called for tool: Task
  [DEBUG] Getting matching hook commands for PreToolUse with query: Task
  [ERROR] Error streaming, falling back to non-streaming mode: 403 Model access is denied...

Steps to Reproduce

1. Configure Claude Code to use AWS Bedrock with these environment variables:

{
"CLAUDE_CODE_USE_BEDROCK": "true",
"AWS_PROFILE": "coding-tools-aws-coding-tools-claude",
"ANTHROPIC_DEFAULT_SONNET_MODEL": "us.anthropic.claude-sonnet-4-5-20250929-v1:0",
"ANTHROPIC_DEFAULT_HAIKU_MODEL": "us.anthropic.claude-haiku-4-5-20251001-v1:0"
}

1. Ensure IAM role has Bedrock access but NOT aws-marketplace:ViewSubscriptions (as it shouldn't be needed per AWS documentation)
2. Start Claude Code - main conversation with Sonnet works fine
3. Attempt to use the Task tool to spawn an Explore subagent: Use the Explore subagent to analyze the codebase structure

Claude Model

Other

Is this a regression?

No, this never worked

Last Working Version

N/A

Claude Code Version

2.0.19 (Claude Code)

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

AWS Documentation Reference:
AWS Bedrock's model access page states: "Access to all serverless foundation models are now automatically enabled for your AWS account. You no longer
need to manually request or enable model access through this page."

Verification:

• aws bedrock list-foundation-models successfully lists anthropic.claude-haiku-4-5-20251001-v1:0 as ACTIVE
• aws sts get-caller-identity confirms valid authentication
• Main Sonnet conversation works perfectly with same credentials
• Only Haiku-based operations (subagents, background tasks) fail

Root Cause Hypothesis:
Claude Code appears to have legacy validation code that checks marketplace subscriptions when initializing Haiku operations. This check is:

• Outdated (based on old Bedrock access patterns)
• Inconsistently applied (main agent bypasses it, subagents don't)
• Unnecessary per current AWS Bedrock architecture

Impact:
Bedrock users cannot utilize Haiku-based features like the Explore subagent without adding unnecessary IAM permissions that AWS documentation indicates are not required for foundation models.