Claude Code Bedrock: EU Data Residency Setup 2026

TL;DR

To run Claude Code on Bedrock with EU data residency, set CLAUDE_CODE_USE_BEDROCK=1, an EU member state region such as eu-central-1, and pin every model alias to an eu. inference profile. Then block global routing in IAM. Without pins and the Deny statement, Claude Code can quietly fall back to us-east-1 or a global. profile.

What does Claude Code need to talk to Amazon Bedrock?

Claude Code needs three things: the switch CLAUDE_CODE_USE_BEDROCK=1, valid AWS credentials from the standard SDK credential chain, and a region. The Claude Code Bedrock docs resolve the region from AWS_REGION, then AWS_DEFAULT_REGION, then your AWS profile, and finally fall back to us-east-1. You do not need a Claude API key from Anthropic on this route; AWS credentials replace it. If Bedrock is new to your team, our Amazon Bedrock guide explains the platform and its EU profiles.

That last fallback is the first EU trap. A developer whose shell has no region and whose profile has no region either sends every prompt to Virginia, and nothing warns them. Run /status inside Claude Code: it prints the resolved region and, if it came from a config file or the default, says so.

The minimum for a single developer looks like this:

export CLAUDE_CODE_USE_BEDROCK=1
export AWS_REGION=eu-central-1
export AWS_PROFILE=claude-code-eu
aws sso login --profile claude-code-eu
claude

You can also skip the exports. Start claude, pick 3rd-party platform and then Amazon Bedrock at the login prompt, or run /setup-bedrock later. The wizard detects profiles in ~/.aws, asks for the region, checks which Claude models your account can invoke and writes the result into the env block of ~/.claude/settings.json. For a single laptop that is the fastest path. For a team, write the configuration yourself, because the wizard’s choices are per user and nobody reviews them.

Before the first call, someone has to submit the Anthropic use case form once per AWS account in the Bedrock console. With AWS Organizations, the management account can do it once through the PutUseCaseForModelAccess API and child accounts inherit the approval.

Which environment variables pin Claude Code to EU inference profiles?

Pin all three aliases with ANTHROPIC_DEFAULT_OPUS_MODEL, ANTHROPIC_DEFAULT_SONNET_MODEL and ANTHROPIC_DEFAULT_HAIKU_MODEL, each set to an eu. inference profile ID. Anthropic’s own docs warn that unpinned aliases resolve to built-in defaults that change with Claude Code releases. For EU residency, pinning is not optional: it is the only setting that fixes the exact profile.

Claude Code does derive an eu. prefix from any eu-* region, and ANTHROPIC_BEDROCK_REGION_PREFIX=eu (Claude Code v2.1.224 or later) sets it explicitly. But the docs are blunt: the prefix is “a preference, not a guarantee”. If Claude Code finds no profile with your prefix for a model, it falls back to any matching profile, which can be a global. one that routes worldwide.

Two more defaults matter. Without pins, the primary model on Bedrock is Opus 5 and background tasks such as session titles run on Sonnet 4.5. We could not confirm an EU profile for that Sonnet 4.5 default, so pin it away.

Variable	EU value we recommend	What it controls
CLAUDE_CODE_USE_BEDROCK	1	Routes Claude Code to Bedrock instead of the Anthropic API
AWS_REGION	eu-central-1 (or eu-west-3, eu-north-1)	Source region; avoid eu-west-2 London and eu-central-2 Zurich
ANTHROPIC_BEDROCK_REGION_PREFIX	eu	Preferred prefix for unpinned models
ANTHROPIC_DEFAULT_OPUS_MODEL	eu.anthropic.claude-opus-5	What the opus alias resolves to
ANTHROPIC_DEFAULT_SONNET_MODEL	eu.anthropic.claude-sonnet-5	What the sonnet alias resolves to
ANTHROPIC_DEFAULT_HAIKU_MODEL	eu.anthropic.claude-haiku-4-5-20251001-v1:0	Background tasks and the haiku alias
ANTHROPIC_MODEL	eu.anthropic.claude-sonnet-5	Primary model for the session
CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC	1	Turns off surveys and other non-essential calls

The profile IDs come from the AWS model cards, and the Sonnet 5 card states that the EU geo profile “keeps data within EU regions”. Why avoid London and Zurich as source regions? For Haiku 4.5, AWS documents that calling the EU profile from those regions adds London or Zurich as destinations, and neither is in the EU. We explain the routing in detail in our guide to Claude on AWS Bedrock in the EU.

One more model to watch: Fable 5.1. The fable alias resolves to Fable 5.1 unless you set ANTHROPIC_DEFAULT_FABLE_MODEL, and Fable 5.1 has no EU profile on Bedrock. Keep it out of the allowlist in the next section.

How do you roll out one settings.json for the whole team?

Put the configuration in a managed settings file, not in each developer’s shell. Claude Code reads managed-settings.json from /Library/Application Support/ClaudeCode/ on macOS, /etc/claude-code/ on Linux and WSL, and C:\Program Files\ClaudeCode\ on Windows. Nothing a user sets overrides these keys, which is exactly what a data residency commitment needs.

Server-managed settings from the claude.ai admin console do not reach Bedrock or Google Cloud sessions, so on Bedrock you ship this file through MDM or your configuration management. A working example:

{
  "awsAuthRefresh": "aws sso login --profile claude-code-eu",
  "model": "sonnet",
  "availableModels": ["sonnet", "opus", "haiku"],
  "enforceAvailableModels": true,
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_REGION": "eu-central-1",
    "AWS_PROFILE": "claude-code-eu",
    "ANTHROPIC_BEDROCK_REGION_PREFIX": "eu",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "eu.anthropic.claude-opus-5",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "eu.anthropic.claude-sonnet-5",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "eu.anthropic.claude-haiku-4-5-20251001-v1:0",
    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1"
  }
}

What each block does:

1. awsAuthRefresh runs aws sso login when Claude Code detects expired credentials, so IAM Identity Center users do not hit cryptic credential errors once their SSO session expires. Behind a TLS inspecting proxy that breaks the browser flow, remove it and let people run aws sso login by hand.
2. model starts every session on Sonnet 5 instead of the Opus 5 default, which is the single biggest cost lever.
3. availableModels with enforceAvailableModels: true (v2.1.175 or later) limits the /model picker to the three pinned aliases. fable is not on the list, so nobody can select a model without an EU profile.
4. The env block carries the pins from the previous section. A shared AWS_PROFILE name only works if your SSO config uses the same profile name on every machine, so distribute ~/.aws/config with it.

On Bedrock, Claude Code already disables metrics, error reports and /feedback uploads by default, according to the Claude Code data usage page. Two things still run: session quality surveys, which the nonessential traffic flag disables, and the WebFetch domain check, which sends the hostname only to api.anthropic.com. Set skipWebFetchPreflight: true if even hostnames must not leave your network. Also note that Claude Code keeps transcripts in plaintext under ~/.claude/projects/ for 30 days on each laptop.

Which IAM policy keeps Claude Code on EU profiles?

Give the developer role invoke rights only on eu. inference profiles, allow the underlying foundation models only when called through those profiles, and add an explicit Deny for global routing. The Deny uses the condition aws:RequestedRegion equals unspecified, which the AWS inference profile docs describe as the way to block global cross-region inference.

The Claude Code docs ship a broad policy with wildcards on every region. It works, but it also permits global. and us. profiles. This tightened version keeps the four actions Claude Code needs and closes the escape routes:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeEuProfilesOnly",
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": "arn:aws:bedrock:eu-central-1:*:inference-profile/eu.anthropic.*"
    },
    {
      "Sid": "FoundationModelsBehindEuProfiles",
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": "arn:aws:bedrock:*::foundation-model/anthropic.claude-*",
      "Condition": {
        "StringLike": {
          "bedrock:InferenceProfileArn": "arn:aws:bedrock:eu-central-1:*:inference-profile/eu.anthropic.*"
        }
      }
    },
    {
      "Sid": "ProfileDiscovery",
      "Effect": "Allow",
      "Action": ["bedrock:ListInferenceProfiles", "bedrock:GetInferenceProfile"],
      "Resource": [
        "arn:aws:bedrock:*:*:inference-profile/*",
        "arn:aws:bedrock:*:*:application-inference-profile/*"
      ]
    },
    {
      "Sid": "MarketplaceViaBedrock",
      "Effect": "Allow",
      "Action": ["aws-marketplace:ViewSubscriptions", "aws-marketplace:Subscribe"],
      "Resource": "*",
      "Condition": { "StringEquals": { "aws:CalledViaLast": "bedrock.amazonaws.com" } }
    },
    {
      "Sid": "DenyGlobalRouting",
      "Effect": "Deny",
      "Action": "bedrock:InvokeModel*",
      "Resource": "*",
      "Condition": { "StringEquals": { "aws:RequestedRegion": "unspecified" } }
    }
  ]
}

Replace eu-central-1 with your source region. The foundation model statement uses a region wildcard on purpose: an EU profile fans out to several EU regions, and AWS requires the model to be allowed in every destination. The InferenceProfileArn condition keeps that wildcard harmless. If your organization uses service control policies, they must allow all EU destination regions, or requests fail. To prove where requests ran, check CloudTrail: each call carries additionalEventData.inferenceRegion, logged in the source region.

What does Claude Code on Bedrock cost, and how do you cap it?

Anthropic reports that enterprise Claude Code usage averages about 13 USD per developer per active day and 150 to 250 USD per developer per month, with 90% of users under 30 USD per active day. On Bedrock you pay per token, and the EU profile costs 10% more than global. The biggest lever is the default model, not the region.

Model	EU geo profile (input / output per 1M tokens)	Global profile (input / output per 1M tokens)
Claude Opus 5	5.50 / 27.50 USD	5 / 25 USD
Claude Sonnet 5	2.20 / 11 USD	2 / 10 USD
Claude Haiku 4.5	1.10 / 5.50 USD	1 / 5 USD

Prices from the Amazon Bedrock pricing page, Frankfurt selector, read 18 September 2026. Opus 5 costs 2.5 times Sonnet 5 per token. The Claude Code docs warn that a deployment without a pinned primary model is billed at the Opus rate from v2.1.207 onward. That alone can cost you more than every EU premium combined. Rates on the other platforms are in our Claude API pricing EU comparison.

Controls that work on Bedrock:

1. Default to Sonnet 5 through model in managed settings, and let people pick opus deliberately.
2. Use a dedicated AWS account for Claude Code, as the docs recommend, so Cost Explorer and your budget alerts show only coding spend.
3. Attribute per user with OpenTelemetry export or a gateway. Anthropic’s usage dashboards do not see Bedrock traffic at all.
4. Keep prompt caching on. It is enabled by default; DISABLE_PROMPT_CACHING=1 exists but raises your bill.
5. Test service tiers. ANTHROPIC_BEDROCK_SERVICE_TIER accepts default, flex or priority, but tier availability varies by model and region.

Google Cloud or Claude Enterprise: when is Bedrock the wrong choice?

Bedrock fits teams already on AWS. On Google Cloud, the equivalent is CLAUDE_CODE_USE_VERTEX=1 with CLOUD_ML_REGION=eu, which targets the EU multi-region endpoint. Claude Enterprise is simpler to run but, based on Anthropic’s published data residency options, does not give you EU-only inference today. Choose by where your cloud contract and your residency requirement already sit.

The Google setup, with the same pinning logic:

export CLAUDE_CODE_USE_VERTEX=1
export CLOUD_ML_REGION=eu
export ANTHROPIC_VERTEX_PROJECT_ID=your-project-id
export ANTHROPIC_MODEL=claude-sonnet-5
export ANTHROPIC_DEFAULT_OPUS_MODEL=claude-opus-5
export ANTHROPIC_DEFAULT_SONNET_MODEL=claude-sonnet-5

Watch the fallback here too: if CLOUD_ML_REGION is unset or malformed, Claude Code uses us-east5. The developer role needs roles/aiplatform.user. The org policy constraints/gcp.restrictEndpointUsage can block the global endpoint entirely. Google’s EU multi-region covers EU member states only and prices Sonnet 5 at the same 2.20 / 11 USD as Bedrock’s EU profile. Details are in our Claude on Vertex AI Europe guide.

Option	EU-only inference	Billing	Best for
Claude Code on Bedrock (eu. profiles)	Yes, EU geo profile	Per token via AWS	AWS shops with residency clauses
Claude Code on Google Cloud (eu)	Yes, EU multi-region	Per token via GCP	GCP shops
Claude Enterprise	Not offered in published options	20 USD per seat per month plus API rates, annual	Teams that also want Claude on the web

Claude Enterprise adds SSO, domain capture, managed policies and Claude on the web, none of which Bedrock provides. Anthropic’s data residency controls for its own API currently offer only global and us for inference. Our provider comparison for GDPR covers the contractual side, and our Claude Enterprise vs Bedrock comparison puts the seat fee next to Bedrock token costs. Seat prices for Pro, Max and Team are in our Claude pricing plans overview. The same Bedrock route also works for the desktop agent, as our Claude Cowork enterprise guide shows.

FAQ

Which environment variables does Claude Code need for Bedrock?

At minimum CLAUDE_CODE_USE_BEDROCK=1 and AWS credentials, for example AWS_PROFILE. Set AWS_REGION to an EU member state region, because Claude Code otherwise falls back to us-east-1. For EU residency, also pin ANTHROPIC_DEFAULT_OPUS_MODEL, ANTHROPIC_DEFAULT_SONNET_MODEL and ANTHROPIC_DEFAULT_HAIKU_MODEL to eu. profile IDs.

How much does Claude Code on Bedrock cost per developer?

Anthropic reports an enterprise average of about 13 USD per developer per active day and 150 to 250 USD per month. On Bedrock’s EU profile, Sonnet 5 costs 2.20 USD input and 11 USD output per 1M tokens, Opus 5 5.50 and 27.50 USD. Defaulting to Sonnet 5 matters more than the 10% EU premium.

Claude Code on Bedrock vs Claude Enterprise: which one for EU data?

For EU-only processing, Bedrock with eu. profiles or Google Cloud with the eu multi-region. Claude Enterprise costs 20 USD per seat per month plus API rates and includes Claude on the web, but Anthropic’s published inference geography options are global and us only.

Does Anthropic see my code when Claude Code runs on Bedrock?

Prompts go to AWS, not Anthropic. AWS states that model providers have no access to Bedrock logs, prompts or completions, and Claude Code disables metrics, error reports and /feedback uploads on Bedrock by default. The WebFetch safety check still sends hostnames to api.anthropic.com unless you set skipWebFetchPreflight: true.

Does Claude Code work with AWS SSO?

Yes. Run aws sso login --profile your-profile, set AWS_PROFILE, and add awsAuthRefresh to settings so Claude Code re-runs the login when credentials expire. Behind TLS inspecting proxies this can loop, in which case remove awsAuthRefresh and log in manually.

Can I use Claude Fable 5.1 in Claude Code with EU residency on Bedrock?

No. Fable 5.1 has no EU inference profile on Bedrock; in Europe it is reachable only through the global endpoint. Leave fable out of availableModels so developers cannot select it.

Sources

1. Claude Code docs: Claude Code on Amazon Bedrock (19 September 2026)
2. Claude Code docs: Claude Code on Google Cloud's Agent Platform (19 September 2026)
3. Claude Code docs: Enterprise deployment overview (19 September 2026)
4. Claude Code docs: Data usage (19 September 2026)
5. Claude Code docs: Model configuration (19 September 2026)
6. Claude Code docs: Managed settings (19 September 2026)
7. Claude Code docs: Manage costs effectively (19 September 2026)
8. AWS Bedrock docs: Inference profile prerequisites (IAM) (19 September 2026)
9. AWS Bedrock docs: Claude Sonnet 5 model card (18 September 2026)
10. AWS Bedrock docs: Cross-Region inference (18 September 2026)
11. Amazon Bedrock pricing (18 September 2026)
12. Claude pricing (Team and Enterprise plans) (19 September 2026)