How to Use Claude Code with Amazon Bedrock

Claude Code lets developers write, debug, refactor, and navigate codebases using AI directly from the terminal. For organizations already using AWS, Amazon Bedrock provides a way to access Claude models through their existing AWS environment, with AWS authentication, IAM permissions, and regional configuration.

Connecting Claude Code to Amazon Bedrock lets you use supported Claude models without relying on a direct Anthropic API key. Instead, Claude Code sends requests through Bedrock, and AWS handles authentication and access to the configured model.

The setup involves enabling Anthropic models in your AWS account, configuring AWS credentials, enabling Bedrock mode in Claude Code, pinning the right model identifiers, and verifying that your account has the required permissions.

This guide walks through the setup process, explains how to choose models, covers common errors, and explores when an enterprise AI Gateway such as TrueFoundry can help teams manage Claude Code access, costs, and governance at scale.

What Is Amazon Bedrock for Claude Code?

Amazon Bedrock is an AWS-managed service that provides access to foundation models from Anthropic and other model providers through AWS APIs. It lets organizations use supported models without managing the underlying model-serving infrastructure themselves.

When you configure Claude Code to use Bedrock, requests go through AWS rather than directly to Anthropic's API. This changes how authentication, permissions, and model selection work.

Instead of relying on an Anthropic API key, Claude Code uses AWS credentials and the permissions associated with your AWS identity. Access to a model depends on its availability in your selected AWS Region, the inference profiles enabled in your account, and the permissions granted to your identity.

How does the integration work?

The request flow is straightforward:

1. You launch Claude Code in your terminal.
2. Claude Code resolves your AWS credentials through the default AWS SDK credential chain.
3. Amazon Bedrock checks your permissions and the requested model or inference profile.
4. Bedrock processes the request using the selected model and streams the response back to Claude Code.

The main difference from a direct Anthropic setup is that AWS credentials, IAM permissions, and Bedrock inference profile IDs replace the usual direct API-key configuration. Claude Code calls Bedrock through the Invoke API; it does not support the Converse API.

A few Claude Code features behave differently on Bedrock: the WebSearch tool is not available, and /logout is disabled because authentication is handled by AWS.

For individual developers, this can be a convenient way to use Claude models within an AWS environment. For larger engineering teams, it also raises questions about managing access across developers, tracking costs by team, and applying consistent controls across multiple AI applications. Those requirements may eventually call for an additional gateway layer.

Prerequisites

Before connecting Claude Code to Amazon Bedrock, make sure you have the following:

• Claude Code installed: Follow the official installation guide.
• An AWS account: You need access to Amazon Bedrock in your chosen AWS Region.
• Anthropic model access: Before invoking an Anthropic model for the first time, submit the use case details form once per AWS account. In the Amazon Bedrock console, open the Model catalog, select an Anthropic model, and complete the form. Access is granted immediately after submission. If you use AWS Organizations, you can submit it once from the management account, and approval extends to child accounts.
• AWS credentials: Configure an AWS profile, IAM role, AWS IAM Identity Center (SSO), Amazon Bedrock API key, or another supported credential method. The AWS CLI is optional if you already have another way to supply credentials.
• IAM permissions: Your AWS identity needs permission to invoke Bedrock models and read inference profiles (see the IAM policy below).

For production environments, prefer temporary credentials or IAM roles over long-lived access keys where possible. See the Amazon Bedrock documentation for current access requirements.

Required IAM permissions

Anthropic's Claude Code on Amazon Bedrock documentation recommends a policy along these lines:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowModelAndInferenceProfileAccess",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:ListInferenceProfiles",
        "bedrock:GetInferenceProfile"
      ],
      "Resource": [
        "arn:aws:bedrock:*:*:inference-profile/*",
        "arn:aws:bedrock:*:*:application-inference-profile/*",
        "arn:aws:bedrock:*:*:foundation-model/*"
      ]
    },
    {
      "Sid": "AllowMarketplaceSubscription",
      "Effect": "Allow",
      "Action": [
        "aws-marketplace:ViewSubscriptions",
        "aws-marketplace:Subscribe"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "bedrock.amazonaws.com"
        }
      }
    }
  ]
}

For tighter control, limit the Resource to specific inference profile ARNs. Anthropic also suggests a dedicated AWS account for Claude Code to simplify cost tracking and access control.

How to Configure Claude Code with Amazon Bedrock

You can connect Claude Code to Bedrock using its setup wizard or by configuring environment variables manually.

Option 1: Use the setup wizard

Run claude. At the login prompt, select 3rd-party platform, then Amazon Bedrock. If you're already signed in, type /setup-bedrock in full; Claude Code hides it from the command menu until CLAUDE_CODE_USE_BEDROCK=1 is set.

The wizard asks how you authenticate (an AWS profile, a Bedrock API key, an access key and secret, or credentials already in your environment), asks for your Region, checks which Claude models your account can invoke, and lets you pin them. It saves everything to the env block of ~/.claude/settings.json, so you don't need to export variables yourself.

Option 2: Configure it manually

The manual approach is useful for CI and repeatable developer and team setups.

Step 1: Configure AWS credentials

Claude Code uses the default AWS SDK credential chain. If the machine already supplies credentials, such as an EC2 instance profile or ECS task credentials, skip to Step 2.

If you use the AWS CLI, configure a profile with your credentials:

aws configure

The CLI prompts you for your access key, secret key, default Region, and output format. If your organization uses AWS IAM Identity Center (SSO), configure and sign in to your profile instead:

aws configure sso
aws sso login --profile your-profile-name
export AWS_PROFILE="your-profile-name"

Replace your-profile-name with your configured AWS profile.

Other supported options:

• AWS Management Console credentials: aws login (AWS CLI 2.32.0 or later) signs you in through the browser with a session valid for up to 12 hours.
• Amazon Bedrock API key: export AWS_BEARER_TOKEN_BEDROCK=your-bedrock-api-key. When this is set, Claude Code uses the key and ignores other AWS credentials. AWS prefers short-term keys (up to 12 hours) for production.

Verify that AWS can identify your current credentials:

aws sts get-caller-identity

If the command succeeds, it returns information about the AWS identity being used. Use the credential method approved by your organization. You don't need a direct Anthropic API key for this Bedrock setup.

Step 2: Choose your AWS Region and check model access

Set the Region where your Claude models and inference profiles are available:

export AWS_REGION="us-east-1"

This is optional if your AWS profile already sets a Region. Claude Code resolves the Region from AWS_REGION, then AWS_DEFAULT_REGION, then your active AWS profile, and falls back to us-east-1.

Claude Code calls models through inference profiles, so list those rather than raw foundation models:

aws bedrock list-inference-profiles --region "$AWS_REGION"

Look for Anthropic profile IDs such as us.anthropic.claude-sonnet-4-6. The prefix reflects the geography: us., eu., apac., us-gov. for GovCloud, or global.. Using a raw foundation model ID instead of a profile ID is the most common cause of the "on-demand throughput isn't supported" error.

Step 3: Enable Bedrock mode in Claude Code

Set the environment variable that tells Claude Code to use Amazon Bedrock:

export CLAUDE_CODE_USE_BEDROCK=1

Then launch Claude Code:

claude

Claude Code will use Bedrock instead of its default direct Anthropic connection when Bedrock mode is enabled and valid AWS credentials and permissions are available.

Step 4: Pin your models

Pin specific model versions before rolling Claude Code out to multiple users. The next section explains how to choose and pin models.

Step 5: Verify the connection

Start Claude Code from your project directory:

cd /path/to/your/project
  claude

Inside Claude Code, run:

/status

Check that the active provider is Amazon Bedrock, the resolved Region is correct, and the intended model is selected. Then send a small test prompt.

If the connection fails, check the AWS identity with aws sts get-caller-identity, then the Region, model access, and IAM permissions before changing other settings.

Make the configuration persistent

Shell exports apply only to the current terminal session. To reuse them, add them to ~/.zshrc or ~/.bashrc and reload with source ~/.zshrc, or put them in the env block of ~/.claude/settings.json so they apply wherever Claude Code runs:

{
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_REGION": "us-east-1",
    "AWS_PROFILE": "your-profile-name"
  }
}

For SSO users, the awsAuthRefresh setting (for example, "awsAuthRefresh": "aws sso login --profile your-profile-name") lets Claude Code refresh expired credentials automatically.

For team environments, use your organization's approved method for distributing configuration and credentials. Never commit AWS secrets to a project repository.

How to Choose Claude Models on Amazon Bedrock

Once Claude Code is connected to Amazon Bedrock, you can configure which Claude models it uses for coding tasks. The available options depend on your AWS Region, Bedrock model access, and the inference profiles enabled in your account.

Step 1: Check available Claude models

List the inference profiles in your Region:

aws bedrock list-inference-profiles --region "$AWS_REGION"

Review the returned Anthropic profile IDs and confirm that the model you want is available to your account.

Step 2: Pin your preferred models

Without pinning, Claude Code's sonnet and opus aliases resolve to its built-in Bedrock defaults, which can change between versions and may not be enabled in your account. The default primary model is also an Opus model, which is billed at a higher per-token rate than Sonnet.

Pin each alias to a specific inference profile ID:

export ANTHROPIC_DEFAULT_OPUS_MODEL="us.anthropic.claude-opus-4-8"
export ANTHROPIC_DEFAULT_SONNET_MODEL="us.anthropic.claude-sonnet-4-6"
export ANTHROPIC_DEFAULT_HAIKU_MODEL="us.anthropic.claude-haiku-4-5-20251001-v1:0"

To set the primary model directly:

export ANTHROPIC_MODEL="us.anthropic.claude-sonnet-4-6"

You can also use an application inference profile ARN, which is useful for tracking cost per team or project:

export ANTHROPIC_MODEL="arn:aws:bedrock:us-east-2:your-account-id:application-inference-profile/your-model-id"

Replace these examples with IDs that exist in your account and Region. Don't copy IDs from another Region without checking the prefix.

If you only want to change the geography prefix while keeping Claude Code's default models, set ANTHROPIC_BEDROCK_REGION_PREFIX (for example, eu or global) instead of pinning.

Step 3: Verify the selected model

Restart Claude Code after changing your configuration and run:

/status


Confirm that Claude Code is using Amazon Bedrock and the expected model. If a request fails, check the exact model ID, its Region prefix, and IAM permissions.

Best practice: Start with one supported Claude model, confirm that coding and tool-use workflows work, and then configure additional models. This makes it easier to isolate compatibility or access issues.

Claude Code with Amazon Bedrock vs. TrueFoundry AI Gateway

Connecting Claude Code directly to Amazon Bedrock is a practical option for developers and organizations already using AWS. You can use AWS credentials, IAM permissions, and Bedrock's model infrastructure without adding another gateway to the request path.

However, when multiple teams adopt Claude Code, platform engineers may need to manage access, understand spending across teams, enforce consistent policies, and support multiple model providers through a shared interface.

TrueFoundry AI Gateway can sit between Claude Code and Amazon Bedrock, adding a centralized layer for model access, usage visibility, cost controls, and governance.

Govern Claude Code at Scale With TrueFoundry AI Gateway

TrueFoundry AI Gateway gives you a Claude Code gateway your platform team controls: one control plane for model access, MCP governance, guardrails, and cost attribution, deployed wherever your infrastructure lives.

Pointing Claude Code at TrueFoundry

Pointing Claude Code at our gateway is the same kind of change you just made. In API-key mode, swap the base URL and token in settings.json

{
  "env": {
    "ANTHROPIC_BASE_URL": "{GATEWAY_BASE_URL}",
    "ANTHROPIC_AUTH_TOKEN": "your-truefoundry-api-key",
    "ANTHROPIC_MODEL": "claude-code/claude-sonnet",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-code/claude-opus",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-code/claude-sonnet",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-code/claude-haiku",
    "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS": "1",
    "ANTHROPIC_CUSTOM_HEADERS": "x-tfy-anthropic-beta: context-management-2025-06-27"
  }
}

Here's what each variable does:

• ANTHROPIC_BASE_URL is your gateway base URL, from the Playground's unified code snippet.
• ANTHROPIC_AUTH_TOKEN is your TrueFoundry key, which identifies the user. The Anthropic, Bedrock, or Vertex credential stays on the gateway, never on the laptop.
• ANTHROPIC_MODEL and the ANTHROPIC_DEFAULT_*_MODEL variables map Claude Code's opus, sonnet, and haiku aliases to gateway models in provider-account/model-name format.
• CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS keeps behavior stable across providers, while ANTHROPIC_CUSTOM_HEADERS forwards specific Anthropic betas through x-tfy-anthropic-beta.

Send a prompt, and it shows up in AI Gateway → Analytics under that user, with model, tokens, and cost. Full setup is in our Claude Code documentation.

What TrueFoundry Adds on Top of Bedrock

• Per-user and per-team cost attribution: Every request is tied to a developer and team, so you see Claude Code spend by person, not as one Bedrock line item.
• Budgets and rate limits: Cap spend or request rates per user, team, or model before a runaway agent loop shows up on your AWS bill.
• Fallbacks across providers: A virtual model can fail over from Bedrock to Anthropic or Vertex AI when you hit throttling or an outage.
• MCP governance in the same platform: Route Claude Code's MCP servers through the TrueFoundry MCP Gateway, with allowlists, authentication, and audit.
• Guardrails on prompts and tool calls: Gateway guardrails cover PII, prompt injection, and moderation. Claude Code hooks extend that to shell commands, file edits, and MCP tool calls.
• Fleet-wide enforcement: tfy-local-ai-setup writes a locked managed-settings.json with a per-user token, distributed through MDM.
• Enterprise identity and access: SSO and RBAC, so access follows the identity provider your company already uses, with audit logging on every request.
• Deployment inside your AWS environment: Run the gateway in your own VPC alongside Bedrock, or on-prem, hybrid, or air-gapped, with SOC 2, HIPAA, and GDPR compliance.
• Broad model access with minimal overhead: 1,600+ models through one gateway, with sub-3 ms internal latency.

Use Claude Code directly with Amazon Bedrock when a small team needs Claude inside AWS and IAM is enough control. Add TrueFoundry AI Gateway in front of Bedrock when you need per-developer cost tracking, budgets, MCP governance, guardrails on tool calls, and one rollout across your whole engineering organization. For the full architecture, read our guide to Claude Code governance with an AI gateway.

Conclusion

Amazon Bedrock provides a way to use Claude models through AWS, with AWS-native authentication, IAM permissions, and model infrastructure. By configuring the right credentials, Region, and model identifiers, you can connect Claude Code to Bedrock and use it from your terminal.

For individual developers and teams already operating within AWS, direct Bedrock access may be sufficient. As adoption grows, however, organizations may need a shared approach to model access, cost attribution, observability, and governance across applications and providers.

TrueFoundry AI Gateway adds that centralized control layer while allowing supported Claude Code requests to use configured Bedrock models.

Explore TrueFoundry AI Gateway to see how it can help your organization manage Claude Code and other AI workloads.

Frequently Asked Questions

1. Can I use Claude Code with Amazon Bedrock?

Yes. Claude Code supports Amazon Bedrock as a model provider. You need compatible Claude Code configuration, AWS credentials, the correct Region, and permission to invoke the selected model or inference profile.

2. Do I need an Anthropic API key to use Claude Code with Bedrock?

No. When Claude Code is configured to use Bedrock, it authenticates through supported AWS credential mechanisms rather than a direct Anthropic API key.

3. Why is Claude Code returning an access-denied error with Bedrock?

Your AWS identity may lack permission to invoke the selected model or inference profile. Check your IAM policies, AWS credentials, model access requirements, and Region configuration.

4. Can I use different Claude models through Amazon Bedrock?

Yes, provided the models are available to your account and Region and are compatible with your Claude Code version. You can configure model-related environment variables using the appropriate Bedrock model or inference-profile identifiers.

5. Can TrueFoundry AI Gateway work with Amazon Bedrock?

Yes. TrueFoundry supports configured Bedrock model integrations, allowing supported requests to pass through the gateway to Bedrock. This can add centralized access policies, usage attribution, observability, and supported governance controls.

See the TrueFoundry AWS integration overview for more information.

6. What is the difference between direct Bedrock access and TrueFoundry AI Gateway?

Direct Bedrock access uses AWS-native credentials, IAM permissions, and service controls. TrueFoundry AI Gateway adds a centralized layer for managing supported model traffic, access policies, cost attribution, observability, and governance across teams and configured providers.