AWS Guide: Fixing Claude Code Error 002 for Bedrock Access

Select Language:

When you’re using Claude Code with the Pay-As-You-Go Bedrock API, encountering issues can be frustrating. Here’s a simple guide to help you troubleshoot and resolve common problems.

First, double-check the specific model ID that Claude Code is requesting. Sometimes, it asks for a model ID that you haven’t enabled. For example, it might request “anthropic.claude-sonnet-4-20250514-v1:0”, but you only have an older version enabled. To fix this, go to the Bedrock console, look under Model Access, and verify the exact model IDs you have enabled. Don’t just rely on the friendly names—match the actual IDs listed there.

Next, make sure your IAM permissions include the ability to invoke models. The permission needed is “bedrock:InvokeModel”. If your account has “AmazonBedrockFullAccess,” that should be enough, but it’s good to confirm there are no Service Control Policies (SCPs) or boundary rules at the organization level blocking this action. You can test your permissions by running a simple command in your terminal:

bash
aws bedrock-runtime invoke-model \
–model-id anthropic.claude-sonnet-4-20250514-v1:0 \
–region us-east-1 \
–content-type application/json \
–accept application/json \
–body ‘{“anthropic_version”:”bedrock-2023-05-31″,”max_tokens”:100,”messages”:[{“role”:”user”,”content”:”Hello”}]}’ \
output.json

If you see an “AccessDenied” error, then the problem is with your IAM permissions or organization policies, not Claude Code itself.

If you are part of an AWS Organization, check for any SCPs that might block Bedrock access. These policies override user permissions, so ask your organization’s admin to review and adjust them if necessary.

Ensure that the region where you enabled your model access matches the region set in your commands. For example, if you enabled access in us-east-1, your environment variables should match:

bash
export AWS_REGION=us-east-1

Also, confirm which AWS profile your code is using. Run:

bash
aws sts get-caller-identity

This will tell you the profile in use. If you have multiple profiles, make sure you specify the correct one by setting environment variables:

bash
export AWS_PROFILE=your-profile-name
export AWS_REGION=us-east-1
export CLAUDE_CODE_USE_BEDROCK=1

Finally, remember that after enabling model access, it can take a few minutes to propagate. If you’ve just enabled a model, wait about 5 to 10 minutes and then try again.

Most issues come down to either organization SCP restrictions or requesting a model ID that you haven’t explicitly enabled. Starting with a direct AWS command, like the one above, can help you isolate whether the problem lies in your permissions or your Claude Code setup. This way, you’ll be able to identify where the problem is and fix it quickly.