Claude Code on AWS Bedrock

How to run Claude Code via AWS Bedrock instead of Anthropic's direct API. Covers IAM setup, environment variables, model IDs, and when to use Bedrock vs the Anthropic API.

AWS Bedrock lets you run Claude Code using Claude models hosted in your AWS account — traffic stays within AWS infrastructure, billing consolidates with your existing AWS costs, and you can apply IAM and VPC controls directly.

Prerequisites

• AWS account with Bedrock access enabled in your target region (us-east-1, us-west-2, eu-west-1, ap-southeast-1 supported as of 2026)
• Claude models enabled in the Bedrock console (Model access → Request access → Anthropic → Claude Sonnet / Claude Haiku / Claude Opus)
• AWS CLI configured with credentials that have bedrock:InvokeModel permission
• Claude Code installed: npm install -g @anthropic-ai/claude-code

IAM policy (minimum permissions)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/anthropic.claude-sonnet-4-6-v1:0",
        "arn:aws:bedrock:*::foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0",
        "arn:aws:bedrock:*::foundation-model/anthropic.claude-opus-4-7-v1:0"
      ]
    }
  ]
}

Environment variable configuration

# Required: tell Claude Code to use Bedrock
export ANTHROPIC_BEDROCK=true

# Required: your AWS region (must match where you enabled the models)
export AWS_REGION=us-east-1

# Authentication — choose one:

# Option A: IAM role (recommended for EC2/ECS/Lambda)
# No env vars needed — Claude Code uses the instance's IAM role automatically

# Option B: named profile (~/.aws/credentials)
export AWS_PROFILE=my-bedrock-profile

# Option C: explicit access key (use only for local dev, never in CI)
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...

# Optional: override the default model
export ANTHROPIC_MODEL=anthropic.claude-haiku-4-5-20251001-v1:0

Once set, start Claude Code normally: claude. All model calls route through Bedrock.

Bedrock model IDs for Claude Code

Cross-region inference ARN format: arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-sonnet-4-6-v1:0

VPC endpoint (private traffic)

For air-gapped or fully private deployments, route Bedrock traffic through a VPC endpoint:

# Create the Bedrock VPC interface endpoint
aws ec2 create-vpc-endpoint   --vpc-id vpc-0abc123   --vpc-endpoint-type Interface   --service-name com.amazonaws.us-east-1.bedrock-runtime   --subnet-ids subnet-0def456   --security-group-ids sg-0ghi789   --private-dns-enabled

# Claude Code picks up the private DNS automatically — no env var change needed

With a VPC endpoint, Claude Code traffic never traverses the public internet. Only port 443 outbound to the endpoint ENI is required.

Cost comparison: Bedrock vs direct API

Troubleshooting

# Error: "AccessDeniedException: is not authorized to perform: bedrock:InvokeModel"
# → The IAM role/user lacks bedrock:InvokeModel permission on the model ARN.
# Fix: attach the policy shown in the IAM section above.

# Error: "ValidationException: The requested model is not available"
# → Model not enabled in Bedrock console for this region.
# Fix: Bedrock console → Model access → Request access → Anthropic models.

# Error: "Could not find region"
# → AWS_REGION env var not set.
# Fix: export AWS_REGION=us-east-1

# Verify Bedrock is active:
claude --version  # shows "Bedrock: us-east-1" in the header if configured correctly

For Enterprise team deployments routing through Bedrock, see Claude Code Enterprise. For running Claude Code in containerized environments on AWS ECS or Fargate, see Claude Code with Docker.

Frequently asked questions

Free tools

More examples