Analyzed: March 31, 2026 leak snapshot

​
Provider selection

Claude Code routes to Bedrock when CLAUDE_CODE_USE_BEDROCK is truthy. The main client path is in src/services/api/client.ts. Additional Bedrock-specific helpers live in src/utils/model/bedrock.ts.

​
Region behavior

The code comments in bedrock.ts are explicit: Bedrock region selection follows the Anthropic Bedrock SDK convention:
  • AWS_REGION
  • AWS_DEFAULT_REGION
  • fallback us-east-1
There is also a model-specific override for the small-fast model:
  • ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION

​
Authentication paths

The snapshot supports two auth paths:
  • normal AWS credentials, refreshed through refreshAndGetAwsCredentials()
  • bearer-token mode through AWS_BEARER_TOKEN_BEDROCK
It also exposes a skip-auth path:
  • CLAUDE_CODE_SKIP_BEDROCK_AUTH
When skip-auth is enabled, the Bedrock clients are configured with smithy.api#noAuth and a plain HTTP handler.

​
Custom endpoint support

ANTHROPIC_BEDROCK_BASE_URL can override the endpoint for both the control client and the runtime client. That appears intended for proxying, testing, or private routing scenarios.

​
Inference profiles

src/utils/model/bedrock.ts includes dedicated support for Bedrock inference profiles:
  • getBedrockInferenceProfiles()
  • getInferenceProfileBackingModel()
  • ARN parsing helpers
  • cross-region prefix helpers
This is more than a minimal SDK wrapper. Claude Code actively reasons about profile IDs and backing models for compatibility and cost behavior.

​
Prompt caching note

The API layer references ENABLE_PROMPT_CACHING_1H_BEDROCK, which indicates Bedrock-specific prompt-caching behavior exists in this snapshot.

​
Practical deployment notes from source

At minimum, a Bedrock deployment needs:
  • CLAUDE_CODE_USE_BEDROCK=1
  • valid AWS credentials or AWS_BEARER_TOKEN_BEDROCK
  • a valid region via AWS_REGION or AWS_DEFAULT_REGION
If those are absent, the Bedrock path will not be able to authenticate correctly.