[DOCS] Bedrock setup missing AWS Marketplace subscription requirements causing permission errors

Documentation Type

Incorrect/outdated documentation

Documentation Location

https://docs.claude.com/en/docs/claude-code/amazon-bedrock

Section/Topic

Prerequisites, Setup, IAM Configuration

Current Documentation

The docs currently state:

Prerequisites:

• AWS CLI configured with appropriate credentials
• IAM role/user with Bedrock access permissions
• Model access enabled in AWS Bedrock console

IAM configuration:
Configure AWS credentials to access Bedrock. The following IAM permissions are required:

• bedrock:InvokeModel
• bedrock:InvokeModelWithResponseStream

The documentation focuses entirely on IAM permissions and model access in the Bedrock console, but does not mention AWS Marketplace subscriptions at all.

What's Wrong or Missing?

The documentation is missing critical information about AWS Marketplace subscription requirements, which could cause users to encounter errors even after following all of the setup steps.

Specific gaps:

1. No mention of marketplace subscriptions: AWS recently changed their model access system. Models are now available by default, but access is controlled through AWS Marketplace subscriptions with product IDs. The docs don't explain this shift.
2. Misleading error symptoms: Users correctly configure IAM permissions and enable model access, but still get errors like:

[ERROR] Error streaming: Calling boto3.exceptions.botocore.exceptions.ClientError:
An error occurred (AccessDeniedException) when calling the Converse operation:
API Model access is denied by Marketplace subscription

1. Missing marketplace workflow: No explanation of:

• How to subscribe to models in AWS Marketplace
• Where to verify marketplace subscription status
• Relationship between "model access" in Bedrock console vs marketplace subscriptions
• How to troubleshoot marketplace permission errors

1. Incomplete troubleshooting: The troubleshooting section doesn't cover marketplace-related access denials, only IAM permission issues.

Impact on users:

• Users follow all documented steps but still can't use Bedrock
• Error messages reference marketplace subscriptions not mentioned in docs
• No clear path forward when encountering marketplace permission errors
• Time wasted debugging IAM when the issue is marketplace subscriptions

Suggested Improvement

1. Add AWS Marketplace Subscription Information to Prerequisites

The prerequisites section should clearly state that AWS Marketplace subscriptions are required in addition to IAM permissions and model access. Currently, the docs only mention IAM and model access, which is incomplete.

Suggested addition:
Prerequisites:

• AWS CLI configured with appropriate credentials
• IAM role/user with Bedrock access permissions
• AWS Marketplace subscriptions for the Bedrock model(s) you want to use

1. Add Documentation on How to Obtain Marketplace Subscriptions

Include a section explaining:

• That Bedrock models require marketplace subscriptions (not just "model access")
• Where to subscribe to models (link to AWS Marketplace or Bedrock console)
• How to verify that marketplace subscriptions are active
• That this is a requirement separate from IAM permissions

1. Add Troubleshooting for Marketplace Permission Errors

The troubleshooting section should cover the specific error:
AccessDeniedException: API Model access is denied by Marketplace subscription

And explain:

• What this error means (missing marketplace subscription, not an IAM issue)
• Where to check marketplace subscription status
• How to resolve it (link to subscription process)

1. Clarify the Relationship Between IAM, Model Access, and Marketplace

The docs should explain that three things are required:

1. IAM permissions (documented ✅)
2. Model access enabled in Bedrock console (documented ✅)
3. AWS Marketplace subscriptions for specific models (missing ❌)

Why this matters: Users correctly configure 1, and 2, but still get errors because 3 isn't documented.

Impact

High - Prevents users from using a feature

Additional Context

Related Issues

• Original bug report: #9620 (subagent spawning failures)
• Root cause identified as documentation gap, not code bug

### AWS Documentation References

• AWS Bedrock Model Access Documentation
• AWS recently changed from opt-in model access to default-available-with-marketplace-subscriptions