claude-code - 💡(How to fix) Fix [BUG] Bedrock Application Inference Profile ARN SigV4 signing broken (claude-agent-sdk 0.2.93–0.2.96) [1 comments, 2 participants]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

When using claude-code-action@v1 with AWS Bedrock and an Application Inference Profile ARN as the model, all requests fail with 403. The SDK sends a non-SigV4 Authorization header to the Bedrock endpoint instead of a properly signed AWS4-HMAC-SHA256 header.

What Should Happen?

Requests to Bedrock should be signed with SigV4 using the available AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), matching the behaviour in [email protected].

Error Messages/Logs

Failed to authenticate. API Error: 403 Authorization header requires 'Credential' parameter.                                                              
Authorization header requires 'Signature' parameter.                                                                                                      
Authorization header requires 'SignedHeaders' parameter.                                                                                                  
(Hashed with SHA-256 and encoded with Base64) Authorization=cQ4NvdQimYUQF6TWcmXs0EbxtO23QVJZkqGmqPqAElg=

Steps to Reproduce

1. Use claude-code-action@v1 (SHA 26ddc358 / [email protected]) in a GitHub Actions workflow
2. Set use_bedrock: true with AWS OIDC credentials (configure-aws-credentials@v4)
3. Pass an Application Inference Profile ARN via claude_args: --model arn:aws:bedrock:us-east-1:<account>:application-inference-profile/<id>
4. Run the workflow — pre-flight check (aws bedrock-runtime invoke-model) passes, but Claude Code returns 403 auth failure

Workaround: pin to SHA 6e2bd52842c65e914eba5c8badd17560bd26b5de ([email protected])

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

[email protected] (action SHA 6e2bd52)

Claude Code Version

check claude-code-action@v1 SHA 26ddc358 bundled version

Platform

AWS Bedrock

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Non-interactive/CI environment

Additional Information

Related issues: #27890, #29660
Note: standard cross-region inference profile model IDs (us.anthropic.claude-*) are NOT affected — only Application Inference Profile ARNs trigger this.