Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [Bug] [email protected] Bedrock SigV4 regression: 403 auth failure with standard AWS instance profile credentials [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#45128•Fetched 2026-04-09 08:12:36
View on GitHub
Comments
1
Participants
2
Timeline
11
Reactions
3
Author
Bruno-dos-SantosBruno-dos-Santos
Participants
Bruno-dos-SantosBruno-dos-Santosgithub-actions[bot]github-actions[bot]
Timeline (top)
labeled ×6cross-referenced ×2closed ×1commented ×1

[email protected] (shipped with claude-code-action@v1 on 2026-04-08) broke Bedrock authentication for setups using standard AWS instance profile credentials (SigV4). All requests to Bedrock fail with 403 authentication_failed.

The release notes for v2.1.96 mention a fix for this regression, but it only covers AWS_BEARER_TOKEN_BEDROCK and CLAUDE_CODE_SKIP_BEDROCK_AUTH auth paths — the standard SigV4 path remains broken.

Error Message

Failed to authenticate. API Error: 403 Authorization header requires 'Credential' parameter.
Authorization header requires 'Signature' parameter.
Authorization header requires 'SignedHeaders' parameter.
(Hashed with SHA-256 and encoded with Base64) Authorization=cQ4NvdQimYUQF6TWcmXs0EbxtO23QVJZkqGmqPqAElg=

Root Cause

  • Related to #44944 (same root cause, different auth path)

Fix Action

Workaround

Pinning claude-code-action to commit 1eddb334 ([email protected]) restores correct behavior.

Code Example

Failed to authenticate. API Error: 403 Authorization header requires 'Credential' parameter.
Authorization header requires 'Signature' parameter.
Authorization header requires 'SignedHeaders' parameter.
(Hashed with SHA-256 and encoded with Base64) Authorization=cQ4NvdQimYUQF6TWcmXs0EbxtO23QVJZkqGmqPqAElg=
RAW_BUFFERClick to expand / collapse

Description

[email protected] (shipped with claude-code-action@v1 on 2026-04-08) broke Bedrock authentication for setups using standard AWS instance profile credentials (SigV4). All requests to Bedrock fail with 403 authentication_failed.

The release notes for v2.1.96 mention a fix for this regression, but it only covers AWS_BEARER_TOKEN_BEDROCK and CLAUDE_CODE_SKIP_BEDROCK_AUTH auth paths — the standard SigV4 path remains broken.

Error

Failed to authenticate. API Error: 403 Authorization header requires 'Credential' parameter.
Authorization header requires 'Signature' parameter.
Authorization header requires 'SignedHeaders' parameter.
(Hashed with SHA-256 and encoded with Base64) Authorization=cQ4NvdQimYUQF6TWcmXs0EbxtO23QVJZkqGmqPqAElg=

Environment

  • claude-agent-sdk: 0.2.96
  • claude-code-action: @v1 (commit 26ddc358)
  • Auth method: AWS instance profile (SigV4) via CLAUDE_CODE_USE_BEDROCK=1
  • Runner: self-hosted on EC2 with instance profile attached
  • AWS region: us-west-2

Steps to reproduce

  1. Use claude-code-action@v1 with use_bedrock: true
  2. Authenticate via EC2 instance profile (no AWS_BEARER_TOKEN_BEDROCK, no CLAUDE_CODE_SKIP_BEDROCK_AUTH)
  3. Run any prompt — all requests fail with the 403 above

Expected behavior

Requests are signed with AWS Signature V4 using the instance profile credentials, as they were in [email protected].

Regression history

VersionBehavior
[email protected]✅ Works
[email protected]❌ Broken — regression introduced alongside Mantle support
[email protected]❌ Still broken — fix only covers Bearer/skip-auth paths

Workaround

Pinning claude-code-action to commit 1eddb334 ([email protected]) restores correct behavior.

Related

  • Related to #44944 (same root cause, different auth path)

extent analysis

TL;DR

Pinning claude-code-action to a version prior to the introduction of the regression, such as commit 1eddb334 ([email protected]), is a likely workaround for the broken Bedrock authentication issue.

Guidance

  • The issue is caused by a regression in [email protected] that breaks AWS instance profile credentials (SigV4) authentication for Bedrock.
  • To verify the issue, check the authentication method used and the version of claude-agent-sdk.
  • As a temporary workaround, pin claude-code-action to commit 1eddb334 ([email protected]) to restore correct behavior.
  • Monitor the release notes for claude-agent-sdk for a fix that covers the standard SigV4 path.

Notes

The provided workaround may not be a permanent solution, and it is recommended to wait for an official fix that addresses the standard SigV4 path.

Recommendation

Apply the workaround by pinning claude-code-action to commit 1eddb334 ([email protected]) because it is a known stable version that does not exhibit the broken authentication issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Requests are signed with AWS Signature V4 using the instance profile credentials, as they were in [email protected].

#api#model loading#dependency error#configuration error#environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING