claude-code icon indicating copy to clipboard operation
claude-code copied to clipboard

[BUG] Claude Code no longer respecting ANTHROPIC_MODEL variables

Open clayallsopp opened this issue 7 months ago • 14 comments

Environment

  • Platform (select one):
    • [ ] Anthropic API
    • [x] AWS Bedrock
    • [ ] Google Vertex AI
    • [ ] Other:
  • Claude CLI version:
  • Operating System:
  • Terminal:

Bug Description

  • In the past 24-48 hours, we've seen many engineers run into this issue upon starting Claude Code and entering a prompt:
API Error: 403 {"Message":"User: xxx is not authorized to perform: bedrock:InvokeModel on resource:
     arn:aws:bedrock:us-east-1:xxx:inference-profile/us.anthropic.claude-3-7-sonnet-20250219-v1:0 because no session policy allows the bedrock:InvokeModel action"}

This is the default Bedrock inference profile/model ID.

In our setup, we only allow per-user access to their own profiles/model IDs, which we configure via the combination of ANTHROPIC_MODEL, ANTHROPIC_SMALL_FAST_MODEL, and CLAUDE_CODE_USE_BEDROCK environment variables.

But, at the top of Claude Code, it still seems to show the environment variable correctly:

╭───────────────────────────────────────────────────╮
│ ✻ Welcome to Claude Code research preview!        │
│                                                   │
│   /help for help, /status for your current setup  │
│                                                   │
│   cwd: /Users/callsopp/xxx               │
│                                                   │
│   ─────────────────────────────────────────────── │
│                                                   │
│   Overrides (via env):                            │
│                                                   │
│   • Model: arn:aws:bedrock:us-east-1:xxx │
│   :application-inference-profile%xxx  │
╰───────────────────────────────────────────────────╯

So I think a recent release has regressed respecting these environment variables at some level of abstraction.

Steps to Reproduce

Expected Behavior

Actual Behavior

Additional Context

clayallsopp avatar May 21 '25 18:05 clayallsopp

This seems to be specifically an issue with 0.2.125 - downgrading to 0.2.124 resolves it

clayallsopp avatar May 21 '25 19:05 clayallsopp

@clayallsopp in your ANTHROPIC_MODEL env var, can you replace the escaped slash (%2F) with a slash (/)? There were some recent changes to how Claude Code expects ARNs.

ant-kurt avatar May 21 '25 21:05 ant-kurt

@ant-kurt This sadly did not work for me, downgrading does resolve the issue

alatom10 avatar May 21 '25 21:05 alatom10

I found I suffered this problem only when running claude from the home (~) folder. Running it from another folder works fine.

mark-richardson-ncino avatar May 22 '25 00:05 mark-richardson-ncino

@clayallsopp would you mind providing some more information about the environment to aid in debugging this? Thanks!

  • How are you specifying the env vars (global or project-level settings.json, etc)?
  • Any network / permissions limitations that would prevent listing Bedrock inference profiles?
  • Can you confirm the above info about un-escaping slashes + running from another directory than ~ do not resolve this?

ant-kurt avatar May 22 '25 05:05 ant-kurt

It also breaks my working setup. In my case the enterprise layer over bedrock does not have endpoints enabled for listing profiles

Any network / permissions limitations that would prevent listing Bedrock inference profiles?

@ant-kurt

  • What purpose listing inference profiles serve,
  • Can it be overridden by the MODEL env variable like before.

Having a configuration may help everyone.

szihs avatar May 22 '25 17:05 szihs

Struggling to get repro on this one - @szihs @alatom10 can you share some of the information listed above ^^, as well as confirm this is working in v0.2.124, broken in v0.2.125 through v1.0.1?

What purpose listing inference profiles serve,

This may be used in some flows to confirm model access, but likely isn't the issue.

Can it be overridden by the MODEL env variable like before.

The intention is that the ANTHROPIC_MODEL and ANTHROPIC_SMALL_FAST_MODEL flag allow passing model name or ARN - but looks like that's not working quite right for some cases.

ant-kurt avatar May 22 '25 20:05 ant-kurt

@ant-kurt

  • One of our issues was indeed the escaping change
  • Why is running claude in the home directory different/not respecting the environment variables? I can confirm that at least the model: info is missing in the output when running in the home directory, and then running any prompt gives an unhelpful AWS error (so it seems to be trying to use Bedrock, but then not using the specified models)

clayallsopp avatar May 23 '25 16:05 clayallsopp

It was a setup issue at my end. Did clean installation and it works again

szihs avatar May 23 '25 16:05 szihs

I have tried all afternoon trying to make Claude Code work with Bedrock, I cannot get it to work. Below are the configs that I have tried that do not work, with error

Claude Code version: 1.0.3

[!NOTE] Using the AWS cli works perfectly fine

aws bedrock-runtime converse --model-id arn:aws:bedrock:eu-west-1:<redacted>:application-inference-profile/6z8a19dq488l --messages '[{"role":"user","content":[{"text":"hello"}]}]' --region eu-west-1
aws bedrock-runtime converse --model-id arn:aws:bedrock:eu-west-1:<redacted>:inference-profile/eu.anthropic.claude-3-7-sonnet-20250219-v1:0 --messages '[{"role":"user","content":[{"text":"hello"}]}]' --region eu-west-1

application-inference-profile with /

{
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_DEFAULT_REGION": "eu-west-1",
    "ANTHROPIC_MODEL": "arn:aws:bedrock:eu-west-1:<redacted>:application-inference-profile/6z8a19dq488l"
  }
}

Error: API Error (arn:aws:bedrock:eu-west-1:<redacted>:application-inference-profile/6z8a19dq488l): 400 The provided model identifier is invalid.

application-inference-profile with %2F

{
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_DEFAULT_REGION": "eu-west-1",
    "ANTHROPIC_MODEL": "arn:aws:bedrock:eu-west-1:<redacted>:application-inference-profile%2F6z8a19dq488l"
  }
}

Error: API Error: 400 The provided ARN is invalid for the service region

Default system inference provfile with /

{
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_DEFAULT_REGION": "eu-west-1",
    "ANTHROPIC_MODEL": "arn:aws:bedrock:eu-west-1:<redacted>:inference-profile/eu.anthropic.claude-3-7-sonnet-20250219-v1:0"
  }
}

Error: API Error (arn:aws:bedrock:eu-west-1:<redacted>:inference-profile/eu.anthropic.claude-3-7-sonnet-20250219-v1:0): 400 The provided model identifier is invalid.

Direct Inference profile id

{
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_DEFAULT_REGION": "eu-west-1",
    "ANTHROPIC_MODEL": "eu.anthropic.claude-3-7-sonnet-20250219-v1:0"
  }
}

Error: API Error (eu.anthropic.claude-3-7-sonnet-20250219-v1:0): 400 The provided model identifier is invalid.

Moulick avatar May 24 '25 15:05 Moulick

Damn, this finally worked

{
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_DEFAULT_REGION": "eu-west-1",
    "AWS_REGION": "eu-west-1",
    "ANTHROPIC_MODEL": "arn:aws:bedrock:eu-west-1:<redacted>:inference-profile/eu.anthropic.claude-3-7-sonnet-20250219-v1:0"
  }
}

The key was defining AWS_REGION and not AWS_DEFAULT_REGION


Edit:

To remove the overrides warning from Welcome to Claude Code!

{
  "model": "arn:aws:bedrock:eu-west-1:<redacted>:inference-profile/eu.anthropic.claude-3-7-sonnet-20250219-v1:0",
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_DEFAULT_REGION": "eu-west-1",
    "AWS_REGION": "eu-west-1"
  }
}

Moulick avatar May 24 '25 16:05 Moulick

@Moulick we've added support for AWS_DEFAULT_REGION as a fallback - sorry for the confusion here

@clayallsopp are you still running into your original issue?

ant-kurt avatar May 29 '25 18:05 ant-kurt

@ant-kurt the original issue is fixed (I suspect it was the ARN escaping issue), but the home directory issue remains - do you want me to open a separate issue about that?

clayallsopp avatar May 29 '25 19:05 clayallsopp

Would be great to add this to the documentation!

Update: also missing here https://docs.anthropic.com/en/docs/claude-code/settings#environment-variables

benjaminbauer avatar May 30 '25 11:05 benjaminbauer

@clayallsopp feel free to open a new issue with the home directory problem - this is a known issue on our side and it would be helpful to gauge how many folks are running into it (we do generally discourage running claude from the home dir, as the UI warning indicates).

We added AWS_REGION to the first documentation link, and have a further rework upcoming that should clarify this.

ant-kurt avatar Jun 04 '25 16:06 ant-kurt

@ant-kurt opened https://github.com/anthropics/claude-code/issues/1576 to track that

clayallsopp avatar Jun 04 '25 17:06 clayallsopp

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.

github-actions[bot] avatar Aug 13 '25 14:08 github-actions[bot]