Run Claude in Your Own AWS Account: Cody CLI Now Supports Amazon Bedrock

# Run Claude in Your Own AWS Account: Cody CLI Now Supports Amazon Bedrock Starting with **v0.12.40**, [Cody CLI](https://www.npmjs.com/package/@ainative/cody-cli) can run Claude models directly through **Amazon Bedrock**. If your team already has Claude access in AWS, you can now point Cody at Bedrock and keep every request inside your own AWS account — no traffic through the AINative API. This is built for enterprise and platform teams who need Claude to stay within their AWS boundary for compliance, cost governance, or network isolation. Below is everything you need to get running, from three environment variables to advanced cross-region configuration. ## Why Bedrock? Running Cody through Bedrock instead of the default AINative API gives you: - **Your account, your bill.** Claude usage flows through your existing AWS billing and Bedrock model access — no separate provider to provision or reconcile. - **Stay inside your VPC.** Requests never leave your AWS environment. Pair it with a Bedrock VPC endpoint and inference stays entirely on your network. - **Reuse your IAM policies.** Access is governed by the same IAM users, roles, and SSO you already run. No new credential model to audit. - **Region control.** Choose exactly which region (and cross-region inference profile) serves your requests. If those constraints sound familiar, Bedrock support is for you. If you just want the fastest path to Claude, the default AINative API is still the simplest option. ## Quick Start Three environment variables get you running: ```bash # 1. Enable the Bedrock provider export CODY_USE_BEDROCK=1 # 2. Set your AWS region export AWS_REGION=us-east-1 # 3. Provide credentials (pick ONE method) # Method A: IAM credentials (most common) export AWS_ACCESS_KEY_ID=AKIA... export AWS_SECRET_ACCESS_KEY=wJal... export AWS_SESSION_TOKEN=FwoG... # optional, for temporary credentials # Method B: Bedrock Bearer token export AWS_BEARER_TOKEN_BEDROCK=your-bearer-token # Method C: AWS SSO — run `aws sso login` first; credentials # are picked up automatically from ~/.aws # 4. Launch Cody cody ``` Before this works, make sure the Claude models you want are **enabled in your Bedrock console**: open the [AWS Bedrock Console](https://console.aws.amazon.com/bedrock) → **Model access** → **Modify model access** → enable the Claude models (e.g. Claude Sonnet 4.5, Claude Opus 4) → **Save changes** and wait for access to be granted. ## Authentication Deep Dive Cody supports every common way to authenticate to Bedrock. Pick the one that matches how your org manages AWS access. ### IAM user credentials Create an IAM user (or role) with Bedrock invoke permissions: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListFoundationModels", "bedrock:ListInferenceProfiles" ], "Resource": "*" } ] } ``` Then export the credentials: ```bash export AWS_ACCESS_KEY_ID=AKIA... export AWS_SECRET_ACCESS_KEY=wJal... ``` ### AWS SSO / IAM Identity Center ```bash # Configure SSO once aws configure sso # Log in before using Cody aws sso login --profile your-profile export AWS_PROFILE=your-profile ``` ### Bedrock Bearer token If your organization uses API-key authentication for Bedrock: ```bash export AWS_BEARER_TOKEN_BEDROCK=your-bearer-token ``` ### Proxy / testing setups Running behind a proxy that handles authentication for you? Skip Cody's own auth: ```bash export CODY_SKIP_BEDROCK_AUTH=1 ``` ## Choosing Models ### Aliases (the easy way) The simplest way to pick a model is an alias. Cody ships three: - **`sonnet`** — Claude Sonnet 4.5 · `us.anthropic.claude-sonnet-4-5-20250929-v1:0` - **`opus`** — Claude Opus 4.6 · `us.anthropic.claude-opus-4-6-v1` - **`haiku`** — Claude Haiku 4.5 · `us.anthropic.claude-haiku-4-5-20251001-v1:0` ```bash export ANTHROPIC_MODEL=opus cody ``` ### Canonical or full Bedrock IDs You can pass a standard model ID — Cody translates it to Bedrock format automatically — or the full Bedrock model ID directly: ```bash # These are equivalent: export ANTHROPIC_MODEL=claude-sonnet-4-5-20250929 export ANTHROPIC_MODEL=us.anthropic.claude-sonnet-4-5-20250929-v1:0 ``` ### All available models Every supported model and its Bedrock ID: ```text Claude Sonnet 4.5 us.anthropic.claude-sonnet-4-5-20250929-v1:0 Claude Sonnet 4 us.anthropic.claude-sonnet-4-20250514-v1:0 Claude Sonnet 3.7 us.anthropic.claude-3-7-sonnet-20250219-v1:0 Claude Sonnet 3.5 v2 anthropic.claude-3-5-sonnet-20241022-v2:0 Claude Opus 4.6 us.anthropic.claude-opus-4-6-v1 Claude Opus 4.5 us.anthropic.claude-opus-4-5-20251101-v1:0 Claude Opus 4.1 us.anthropic.claude-opus-4-1-20250805-v1:0 Claude Opus 4 us.anthropic.claude-opus-4-20250514-v1:0 Claude Haiku 4.5 us.anthropic.claude-haiku-4-5-20251001-v1:0 Claude Haiku 3.5 us.anthropic.claude-3-5-haiku-20241022-v1:0 ``` ## Enterprise Features ### Cross-region inference Most models use cross-region inference profiles, prefixed with `us.`. Switch the prefix to route through a different geography: ```bash # EU cross-region profile export ANTHROPIC_MODEL=eu.anthropic.claude-sonnet-4-5-20250929-v1:0 ``` Available prefixes: `us`, `eu`, `apac`, `global`. ### Custom / VPC Bedrock endpoint For VPC endpoints or custom deployments, point Cody at your own base URL so inference never leaves your network: ```bash export ANTHROPIC_BEDROCK_BASE_URL=https://your-custom-endpoint.amazonaws.com ``` ### Region override for the background model Cody uses a smaller, fast model (Haiku) for background tasks. You can run it in a separate region: ```bash export ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION=us-west-2 ``` ### Per-family default overrides Pin the default model for each family: ```bash export ANTHROPIC_DEFAULT_SONNET_MODEL=claude-sonnet-4-20250514 export ANTHROPIC_DEFAULT_OPUS_MODEL=claude-opus-4-5-20251101 export ANTHROPIC_DEFAULT_HAIKU_MODEL=claude-3-5-haiku-20241022 ``` ## Environment Variables Reference **Required** - **`CODY_USE_BEDROCK`** — set to `1` to enable Bedrock. **Credentials** (provide one method's set) - **`AWS_ACCESS_KEY_ID`** — IAM access key. - **`AWS_SECRET_ACCESS_KEY`** — IAM secret key. - **`AWS_SESSION_TOKEN`** — temporary session token (optional). - **`AWS_BEARER_TOKEN_BEDROCK`** — Bearer token auth. - **`AWS_PROFILE`** — AWS CLI profile name. - **`CODY_SKIP_BEDROCK_AUTH`** — skip auth for proxy setups. **Configuration** (all optional) - **`AWS_REGION`** — AWS region (default: `us-east-1`). - **`ANTHROPIC_MODEL`** — model alias or ID. - **`ANTHROPIC_BEDROCK_BASE_URL`** — custom endpoint URL. - **`ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION`** — region for the background model. ## Verify Your Setup ```bash # Quick test cody -p "say pong" # Confirm which model is serving requests cody -p "what model are you?" ``` ## Troubleshooting **"The provided model identifier is invalid"** — The model isn't enabled in your Bedrock account, or the ID format is wrong. Check that (1) model access is enabled in the Bedrock console, (2) you're using a supported ID from the list above, and (3) the model is available in your selected region. **"Access denied" / 403** — Your IAM credentials lack the required permissions. Make sure your policy includes `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream`. ## Get Started Update to the latest Cody CLI and point it at Bedrock: ```bash npm i -g @ainative/cody-cli@latest ``` The full reference lives in the [Bedrock setup guide](https://github.com/AINative-Studio/cody-cli/blob/main/docs/guides/BEDROCK_SETUP_GUIDE.md). Bring your own AWS account, keep Cody inside your VPC, and let your existing IAM policies do the gatekeeping.

Run Claude in Your Own AWS Account: Cody CLI Now Supports Amazon Bedrock

Check your site's AX Score