Claude Code × Amazon Bedrock Backend Setup Guide 2026 — Run Claude Code Securely in Your AWS Environment

By default, Claude Code connects to Anthropic's API directly. But for enterprise teams already operating inside AWS, routing through Amazon Bedrock is often the better choice — it integrates with IAM, VPC, CloudTrail, and AWS billing without adding new procurement or security review processes.

On April 4, 2026 (v2.1.92), Anthropic shipped an interactive Bedrock setup wizard inside Claude Code. What used to require manually piecing together environment variables and credential files can now be completed with a guided dialog in a matter of minutes.

Why Use Amazon Bedrock as Your Claude Code Backend

There are three compelling reasons to route Claude Code through Bedrock instead of calling the Anthropic API directly.

Security and compliance integration IAM lets you control which people and services can invoke which models, at the team or organizational level. With VPC endpoints, traffic never leaves your private network. CloudTrail captures every model invocation automatically, giving you the audit trail that regulated industries require. If your organization has already standardized on AWS security guardrails, Bedrock slots right in.

Unified AWS billing Bedrock charges show up in your existing AWS invoice. That means one procurement process, one set of cost allocation tags, and one place to set budget alerts. Finance teams find this much easier to work with than a separate Anthropic subscription.

Multi-region availability and failover Bedrock spans multiple AWS regions. You can architect automatic failover to a secondary region when the primary experiences degraded service — a useful property for teams that depend on Claude Code for production workflows.

Prerequisites

Before configuring the Bedrock backend, make sure these pieces are in place.

What you need

• AWS CLI v2 or later (confirm with aws --version)
• Claude models enabled in the Amazon Bedrock console under "Model access"
• An IAM user or role with permission to call Bedrock's InvokeModel action
• Claude Code updated to the latest version (claude update)

# Verify AWS CLI version (2.x.x or later required)
aws --version
 
# Verify Claude Code version
claude --version
 
# Confirm your current AWS identity
aws sts get-caller-identity

Minimum IAM Policy

The policy below grants the permissions Claude Code needs to invoke Claude models through Bedrock. Attach it to the IAM user or role your team will use.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockClaudeInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/anthropic.claude-sonnet-4-6-*",
        "arn:aws:bedrock:*::foundation-model/anthropic.claude-opus-4-6-*",
        "arn:aws:bedrock:*::foundation-model/anthropic.claude-haiku-4-5-*"
      ]
    }
  ]
}

To restrict access to a single region, replace the * in the ARN with a specific region identifier such as us-east-1.

Enable Model Access in the Bedrock Console

IAM permissions alone are not enough — you also need to request access to Claude models in the Bedrock console.

1. Open the Amazon Bedrock console
2. Select Model access from the left navigation
3. Click Manage model access
4. Check the boxes for Claude Sonnet 4.6, Opus 4.6, and Haiku 4.5
5. Save the changes

Access is usually granted within a few minutes on first request.

Interactive Bedrock Setup Wizard (Added April 2026)

The interactive wizard introduced in the April 4, 2026 release is the fastest way to get started. Launch Claude Code and open the settings or configuration panel to start the Bedrock setup. The wizard walks you through these steps in sequence.

Step 1 — Choose your AWS region Select the region where your Bedrock endpoint is located (us-east-1, eu-west-1, ap-northeast-1, etc.). Choose the region closest to your users for the best latency.

Step 2 — Select your authentication method Three options are available:

• AWS CLI default credentials (~/.aws/credentials / ~/.aws/config)
• IAM role (EC2 instance profile, ECS task role, etc.)
• Environment variables (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY)

Step 3 — Pick a model The wizard queries your Bedrock endpoint and displays the Claude models available in your selected region. Choose from the list.

Step 4 — Connection test The wizard sends a short test prompt to verify end-to-end connectivity. A successful response confirms your configuration is working.

Step 5 — Save the configuration (optional) You can write the selected settings directly into your project's CLAUDE.md file. This is helpful when you want teammates to pick up the same Bedrock configuration automatically.

Manual Configuration with Environment Variables

If you prefer to configure things by hand — or are setting up a CI/CD pipeline — environment variables work just as well.

# Add to ~/.bashrc or ~/.zshrc
export CLAUDE_CODE_USE_BEDROCK="1"
export AWS_REGION="us-east-1"
 
# If your AWS CLI is already configured, the two lines above are enough.
# For explicit key-based auth (development only — avoid in production):
# export AWS_ACCESS_KEY_ID="YOUR_ACCESS_KEY"
# export AWS_SECRET_ACCESS_KEY="YOUR_SECRET_KEY"
 
# Apply immediately
source ~/.bashrc

⚠️ Security note: Hardcoding AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in shell profiles or .env files is acceptable for local development, but use IAM roles or AWS SSO for team and production environments.

Specifying the Model Explicitly

# Sonnet 4.6 — best all-around performance for everyday coding
export ANTHROPIC_MODEL="anthropic.claude-sonnet-4-6-20260301-v1:0"
 
# Opus 4.6 — maximum capability for complex reasoning and large codebases
export ANTHROPIC_MODEL="anthropic.claude-opus-4-6-20260301-v1:0"
 
# Haiku 4.5 — fast and lightweight for simple completions and checks
export ANTHROPIC_MODEL="anthropic.claude-haiku-4-5-20251001-v1:0"

Verifying the Setup

After configuring the environment, start Claude Code and confirm the Bedrock backend is active.

# Start Claude Code
claude
 
# Inside the session — view cost breakdown by model and cache hit rate
/cost

The April 2026 update added a per-model and cache-hit breakdown to /cost. Even when using Bedrock, you get accurate cost tracking broken down by model and whether each request hit the prompt cache.

To verify which Claude models are accessible in your region from the CLI:

aws bedrock list-foundation-models \
  --region us-east-1 \
  --query 'modelSummaries[?contains(modelId, `anthropic.claude`)].[modelId, modelName]' \
  --output table

If the models you need appear in this output, your Bedrock setup is working.

Available Claude Models on Bedrock (April 2026)

Current Bedrock model IDs for Claude:

• Claude Sonnet 4.6: anthropic.claude-sonnet-4-6-20260301-v1:0 — recommended default for most Claude Code workflows
• Claude Opus 4.6: anthropic.claude-opus-4-6-20260301-v1:0 — for complex architecture reviews and deep analysis
• Claude Haiku 4.5: anthropic.claude-haiku-4-5-20251001-v1:0 — for fast, high-volume tasks where latency matters

Model availability varies by region. As of April 2026, ap-northeast-1 (Tokyo) supports Sonnet 4.6 and Haiku 4.5. For Opus 4.6, use us-east-1 or eu-west-1.

Troubleshooting Common Errors

AccessDeniedException

Either the IAM policy is missing the bedrock:InvokeModel permission, or model access hasn't been granted in the Bedrock console.

# Check which Anthropic models are accessible
aws bedrock list-foundation-models --region us-east-1 | grep anthropic

If no models appear, go to the Bedrock console and enable access under Model access.

ValidationException: The model ID is invalid

This usually means a typo in the model ID, or the model isn't yet available in the selected region. Cross-reference the model ID against the list above and confirm the region.

ExpiredTokenException

Your temporary STS credentials have expired. Refresh them with the appropriate command for your setup.

# AWS SSO
aws sso login
 
# Assuming an IAM role directly
aws sts assume-role \
  --role-arn "arn:aws:iam::123456789012:role/BedrockClaudeCodeRole" \
  --role-session-name "claude-code-session"

ThrottlingException

You've exceeded Bedrock's on-demand quota for that model. If throttling is frequent, consider Provisioned Throughput, which reserves capacity and delivers consistent latency under load.

Looking back

Running Claude Code through Amazon Bedrock gives enterprise teams precise access control, consolidated AWS billing, and the ability to keep traffic within private network boundaries — all without changing how Claude Code itself works.

The interactive Bedrock setup wizard added in April 2026 makes the initial configuration faster and more approachable than ever. If your team is already on AWS, this is a natural fit worth setting up today.