Using Claude Code with Amazon Bedrock or Google Cloud's Vertex AI

Who this is for and what you will be able to do

This guide is for teams that want Claude Code to run on their own AWS or Google Cloud account, so that billing, access control and network policy stay on the cloud side. After reading it, you can set up Amazon Bedrock or Google Cloud's Vertex AI, configure credentials and environment variables for either one, pin model versions, and know where to look when something fails.

Which cloud to choose

Claude Code can run through Amazon Bedrock, or through Google Cloud's Agent Platform. The Google option is formerly known as Vertex AI, and the login prompt still labels it Google Vertex AI. Select it under 3rd-party platform^[2]. Both paths need a cloud account, access to the Claude models you want, and the right permissions^[1][2]. Choose whichever cloud already holds your team's billing and access control.

Bedrock: prerequisites and credentials

You need an AWS account with Amazon Bedrock enabled, access to the Claude models you plan to use (for example Claude Sonnet 4.6), and suitable IAM permissions. The AWS CLI is optional^[1]. In the Bedrock console, open the Model catalog, select an Anthropic model and complete the use case form. Access is granted immediately after submission, and you do this once per AWS account^[1].

Claude Code uses the default AWS SDK credential chain. If the machine already supplies credentials, such as an EC2 instance profile or ECS task credentials, you need no extra setup^[1]. AWS warns against IAM user access keys when you build purpose-built software or work with real data^[1].

You have several options^[1]:

• Save an access key with aws configure, or export it as environment variables for the current shell.
• Use an SSO profile, which gets temporary credentials through IAM Identity Center.
• Use an Amazon Bedrock API key. When AWS_BEARER_TOKEN_BEDROCK is set, Claude Code authenticates with that key and skips the credential chain. Short-term keys last up to 12 hours, and AWS recommends long-term keys only for exploration.

Claude Code caches resolved credentials until five minutes before they expire, or for one hour if they have no expiration. Set CLAUDE_CODE_SKIP_AWS_CRED_CACHE=1 to resolve the chain on every request. The resolve times out after 60 seconds; if interactive sign-in needs longer, raise the limit with CLAUDE_CODE_AWS_CHAIN_RESOLVE_TIMEOUT_MS^[1].

Bedrock: the wizard or environment variables

Run claude, choose 3rd-party platform and then Amazon Bedrock. If you are already signed in, run /setup-bedrock to open the wizard. It saves the result to the env block of your user settings file, which is ~/.claude/settings.json, or $CLAUDE_CONFIG_DIR/settings.json when that variable is set^[1].

For CI or a scripted rollout, export the variables directly:

export CLAUDE_CODE_USE_BEDROCK=1
export AWS_REGION=us-east-1  # optional if your AWS profile already sets a region

Claude Code picks the region in this order: AWS_REGION, AWS_DEFAULT_REGION, the region on your active AWS profile, and finally us-east-1. Run /status to see which region it resolved^[1].

On Bedrock, /logout is unavailable because AWS credentials handle authentication, and the WebSearch tool is not available^[1].

Pin model versions

When several people use the same deployment, pin the model versions. Otherwise the aliases sonnet and opus resolve to Claude Code's built-in defaults, which can lag behind the newest release or not yet be enabled in your account. A pin lets you decide when users move to a new model^[1].

export ANTHROPIC_DEFAULT_OPUS_MODEL='us.anthropic.claude-opus-4-8'
export ANTHROPIC_DEFAULT_SONNET_MODEL='us.anthropic.claude-sonnet-4-6'
export ANTHROPIC_DEFAULT_HAIKU_MODEL='us.anthropic.claude-haiku-4-5-20251001-v1:0'

Without pinning variables, the primary model on Bedrock is Opus 5.5, and the small, fast model is Sonnet 4.5^[1]. Opus has a higher per-token price than Sonnet, so an unpinned primary model is billed at the Opus rate. To use Sonnet 4.5 as the primary model, set ANTHROPIC_MODEL to its full model ID^[1]. Background tasks such as session title generation use Sonnet on Bedrock, because Haiku may not be enabled in every account or region. To use Haiku for them, set ANTHROPIC_DEFAULT_HAIKU_MODEL to a model ID that your account can use^[1].

The IAM policy needs bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, bedrock:ListInferenceProfiles and bedrock:GetInferenceProfile. It also needs AWS Marketplace subscription actions, which apply only when the call comes through bedrock.amazonaws.com. To tighten access, limit the resource to specific inference profile ARNs^[1].

Fable models, Sonnet 5 and later, and Opus 4.7 and later run with the 1M token context window on Bedrock by default. Set CLAUDE_CODE_DISABLE_1M_CONTEXT=1 to keep a 200K window^[1].

Wizard or environment variables

For a first setup on a personal machine, the wizard is the quickest route. It saves its result to the env block of your user settings file, so you do not have to export a series of variables yourself^[1]. For CI or a scripted enterprise rollout, setting the environment variables directly fits better, because the configuration can live in a pipeline or script^[1]. To change credentials or model pins later, run /setup-bedrock to open the wizard again^[1].

Bedrock: common problems

• "on-demand throughput isn't supported". Specify the model as an inference profile ID^[1].
• **Bedrock streaming response has content-type.** A gateway rewrote the Content-Type header. It must forward the InvokeModelWithResponseStream response body and its headers unmodified^[1].
• Browser sign-in tabs keep opening with AWS SSO. Remove the awsAuthRefresh setting, then run aws sso login yourself before you start Claude Code^[1].

Google Cloud: prerequisites and enabling the API

You need a GCP account with billing enabled, a project with the Agent Platform API enabled, access to the Claude models you want, the gcloud SDK installed and configured, and quota in the region you choose^[2]. Enable the API from the command line:

# Set your project ID
gcloud config set project YOUR-PROJECT-ID

# Enable Agent Platform API
gcloud services enable aiplatform.googleapis.com

Then request access to the Claude models in the Model Garden. Approval may take 24 to 48 hours^[2].

Google Cloud: regions and environment variables

CLOUD_ML_REGION can be global, a multi-region location such as eu or us, or a specific region such as us-east5^[2]. Set the environment variables like this:

# Enable Agent Platform integration
export CLAUDE_CODE_USE_VERTEX=1
export CLOUD_ML_REGION=global
export ANTHROPIC_VERTEX_PROJECT_ID=YOUR-PROJECT-ID

Claude Code sends requests to the project named in ANTHROPIC_VERTEX_PROJECT_ID, even when GOOGLE_CLOUD_PROJECT or the credential file names a different project. If a model does not support global endpoints, set its VERTEX_REGION_CLAUDE_* variable to give it a region. Unset variables fall back to CLOUD_ML_REGION^[2].

Google Cloud: refreshing credentials and pinning models

The gcpAuthRefresh setting runs a command when your GCP credentials have expired or cannot be loaded. Before it runs, Claude Code requests an access token with your current credentials to confirm they really are expired. The command cannot take interactive input, and it times out after three minutes^[2].

{
  "gcpAuthRefresh": "gcloud auth application-default login",
  "env": {
    "ANTHROPIC_VERTEX_PROJECT_ID": "your-project-id"
  }
}

If no pinning variables are set, the primary model defaults to claude-opus-5-5 and the small, fast model defaults to claude-sonnet-4-5@20250929. This example pins the aliases to specific versions^[2]:

export ANTHROPIC_DEFAULT_OPUS_MODEL='claude-opus-4-8'
export ANTHROPIC_DEFAULT_SONNET_MODEL='claude-sonnet-5'
export ANTHROPIC_DEFAULT_HAIKU_MODEL='claude-haiku-4-5@20251001'

Google Cloud: verifying and common errors

Run /status to check the setup. The API provider line should show Google Vertex AI, and the GCP project, default region and model lines show your project, region and the model that was resolved^[2].

• "Could not load the default credentials". Run gcloud auth application-default login, or set GOOGLE_APPLICATION_CREDENTIALS to the path of a service account key file^[2].
• 404 "model not found". Confirm the model is enabled in Model Garden and available in your location. Some models are offered only on global or multi-region endpoints^[2].
• 429 errors. For regional endpoints, check that the primary and small, fast models are supported in your region. Switching to CLOUD_ML_REGION=global can also help^[2].

Where to go next

For every environment variable, read the environment variables reference. For the full list of variables that pin models in third-party deployments, read the model configuration page. Both are in the official Claude Code documentation^[1][2].