claude-code - 💡(How to fix) Fix [BUG] Bedrock: Claude Opus 4.7 returns permission_error despite AUTHORIZED entitlement status

aws bedrock get-foundation-model-availability \
  --model-id anthropic.claude-opus-4-7 \
  --region us-east-1

{
    "modelId": "anthropic.claude-opus-4-7",
    "agreementAvailability": { "status": "AVAILABLE" },
    "authorizationStatus": "AUTHORIZED",
    "entitlementAvailability": "AVAILABLE",
    "regionAvailability": "AVAILABLE"
}
Inference profiles also show ACTIVE:


aws bedrock list-inference-profiles --region us-east-1 \
  --query "inferenceProfileSummaries[?contains(inferenceProfileId, 'opus-4-7')].{id:inferenceProfileId, status:status}"

[
    { "id": "us.anthropic.claude-opus-4-7", "status": "ACTIVE" },
    { "id": "global.anthropic.claude-opus-4-7", "status": "ACTIVE" }
]

### What Should Happen?

Invoking `us.anthropic.claude-opus-4-7` via Bedrock should return a model response, consistent with the account's entitlement status (AUTHORIZED, AVAILABLE) as reported by `get-foundation-model-availability`. The same invocation pattern works for Claude Opus 4.6 on the same account.

### Error Messages/Logs

```shell
Both invoke-model and converse APIs fail:

aws bedrock-runtime converse \
  --model-id us.anthropic.claude-opus-4-7 \
  --messages '[{"role":"user","content":[{"text":"hi"}]}]' \
  --inference-config '{"maxTokens":10}' \
  --region us-east-1

{
  "type": "error",
  "error": {
    "type": "permission_error",
    "message": "anthropic.claude-opus-4-7 is not available for this account. You can explore other available models on Amazon Bedrock. For additional access options, contact AWS Sales at https://aws.amazon.com/contact-us/sales-support/"
  }
}

aws bedrock get-foundation-model-availability \
  --model-id anthropic.claude-opus-4-7 \
  --region us-east-1
Expected output:


{
    "modelId": "anthropic.claude-opus-4-7",
    "agreementAvailability": { "status": "AVAILABLE" },
    "authorizationStatus": "AUTHORIZED",
    "entitlementAvailability": "AVAILABLE",
    "regionAvailability": "AVAILABLE"
}
Confirm inference profile is ACTIVE:

aws bedrock list-inference-profiles --region us-east-1 \
  --query "inferenceProfileSummaries[?contains(inferenceProfileId, 'opus-4-7')].{id:inferenceProfileId, status:status}"
Attempt to invoke the model:

aws bedrock-runtime converse \
  --model-id us.anthropic.claude-opus-4-7 \
  --messages '[{"role":"user","content":[{"text":"hi"}]}]' \
  --inference-config '{"maxTokens":10}' \
  --region us-east-1
Observe permission_error despite step 1 and 2 confirming access:

{
  "type": "error",
  "error": {
    "type": "permission_error",
    "message": "anthropic.claude-opus-4-7 is not available for this account."
  }
}

### Claude Model

Opus

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

Claude Opus 4.6 (us.anthropic.claude-opus-4-6-v1)

### Claude Code Version

2.1.113

### Platform

AWS Bedrock

### Operating System

Windows

### Terminal/Shell

VS Code integrated terminal

### Additional Information

The same permission_error occurs in the AWS Bedrock Console Model Playground when selecting Claude Opus 4.7, confirming this is not a CLI or SDK issue but an account-level entitlement problem.

Additionally, `get-foundation-model-availability` returns all green (AUTHORIZED, AVAILABLE) which contradicts the runtime behavior. This suggests a sync issue between the AWS entitlement control plane and Anthropic's runtime access layer.

Tested with:
- AWS CLI v2.34.32 (invoke-model + converse APIs)
- AWS Bedrock Console Playground
- Inference profiles: us.anthropic.claude-opus-4-7, global.anthropic.claude-opus-4-7
- Regions: us-east-1, us-east-2, us-west-2
- Last working model: Claude Opus 4.6 (us.anthropic.claude-opus-4-6-v1)