Prerequisites

Before configuring Claude Code with Bedrock, ensure you have:

  • An AWS account with Bedrock access enabled
  • Access to desired Claude models (e.g., Claude Sonnet 4) in Bedrock
  • AWS CLI installed and configured (optional - only needed if you don’t have another mechanism for getting credentials)
  • Appropriate IAM permissions

Setup

1. Enable model access

First, ensure you have access to the required Claude models in your AWS account:

  1. Navigate to the Amazon Bedrock console
  2. Go to Model access in the left navigation
  3. Request access to desired Claude models (e.g., Claude Sonnet 4)
  4. Wait for approval (usually instant for most regions)

2. Configure AWS credentials

Claude Code uses the default AWS SDK credential chain. Set up your credentials using one of these methods:

Option A: AWS CLI configuration

aws configure

Option B: Environment variables (access key)

export AWS_ACCESS_KEY_ID=your-access-key-id
export AWS_SECRET_ACCESS_KEY=your-secret-access-key
export AWS_SESSION_TOKEN=your-session-token

Option C: Environment variables (SSO profile)

aws sso login --profile=<your-profile-name>

export AWS_PROFILE=your-profile-name

Option D: Bedrock API keys

export AWS_BEARER_TOKEN_BEDROCK=your-bedrock-api-key

Bedrock API keys provide a simpler authentication method without needing full AWS credentials. Learn more about Bedrock API keys.

Advanced credential configuration

Claude Code supports two configuration settings for dynamic AWS credential management:

awsAuthRefresh

This setting specifies a command for foreground authentication operations where output is visible to the user. It is typically used for SSO browser flows.

Example:

{
  "awsAuthRefresh": "aws sso login --profile myprofile"
}
awsCredentialExport

This setting specifies a command that outputs AWS credentials in JSON format to stdout. The output is not displayed to the user, but is used by Claude Code for subsequent Bedrock requests.

Required output format is JSON with the following properties:

{
  "Credentials": {
    "AccessKeyId": "value",
    "SecretAccessKey": "value",
    "SessionToken": "value"
  }
}

Example:

{
  "awsCredentialExport": "aws sts get-session-token --profile myprofile --output json"
}

These settings can be used to call scripts that invoke alternative identity systems.

3. Configure Claude Code

Set the following environment variables to enable Bedrock:

# Enable Bedrock integration
export CLAUDE_CODE_USE_BEDROCK=1
export AWS_REGION=us-east-1  # or your preferred region

# Optional: Override the region for the small/fast model (Haiku)
export ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION=us-west-2

When enabling Bedrock for Claude Code, keep the following in mind:

  • AWS_REGION is a required environment variable. Claude Code does not read from the .aws config file for this setting.
  • When using Bedrock, the /login and /logout commands are disabled since authentication is handled through AWS credentials.
  • You can use settings files for environment variables like AWS_PROFILE that you don’t want to leak to other processes. See Settings for more information.

4. Model configuration

Claude Code uses these default models for Bedrock:

Model typeDefault value
Primary modelus.anthropic.claude-3-7-sonnet-20250219-v1:0
Small/fast modelus.anthropic.claude-3-5-haiku-20241022-v1:0

To customize models, use one of these methods:

# Using inference profile ID
export ANTHROPIC_MODEL='us.anthropic.claude-opus-4-20250514-v1:0'
export ANTHROPIC_SMALL_FAST_MODEL='us.anthropic.claude-3-5-haiku-20241022-v1:0'

# Using application inference profile ARN
export ANTHROPIC_MODEL='arn:aws:bedrock:us-east-2:your-account-id:application-inference-profile/your-model-id'

# Optional: Disable prompt caching if needed
export DISABLE_PROMPT_CACHING=1

Prompt caching may not be available in all regions

IAM configuration

Create an IAM policy with the required permissions for Claude Code:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:ListInferenceProfiles"
      ],
      "Resource": [
        "arn:aws:bedrock:*:*:inference-profile/*",
        "arn:aws:bedrock:*:*:application-inference-profile/*"
      ]
    }
  ]
}

For more restrictive permissions, you can limit the Resource to specific inference profile ARNs.

For details, see Bedrock IAM documentation.

We recommend creating a dedicated AWS account for Claude Code to simplify cost tracking and access control.

Troubleshooting

If you encounter region issues:

  • Check model availability: aws bedrock list-inference-profiles --region your-region
  • Switch to a supported region: export AWS_REGION=us-east-1
  • Consider using inference profiles for cross-region access

If you receive an error “on-demand throughput isn’t supported”:

Additional resources