How to Properly Deploy Claude Code on AWS Bedrock With IAM and Governance Controls

Claude Code can run on AWS Bedrock by setting a single environment variable, but enterprise deployments require careful IAM policy configuration, region strategy, and governance layers that most teams overlook. Running through Bedrock instead of the direct Anthropic API offers key advantages including consolidated AWS billing, data residency controls, CloudTrail audit logging, and SCP-level guardrails over which accounts and regions can invoke the models. A common day-one error involves mixing model ID formats, since Bedrock uses inference-profile IDs with a regional prefix rather than the shorter identifiers used by the direct API. IAM policies should scope invoke permissions strictly to Anthropic Claude model ARNs rather than granting broad Bedrock access, limiting the blast radius of any credential leak. Teams should also request model access for all Claude tiers upfront in the Bedrock console, as approval per model per region can take several hours and may block rollouts if not done in advance.