Claude Code for Bedrock or Vertex AI: Which One?

Wetin change when Claude Code dey run for your own cloud account

You fit run Claude Code for Amazon Bedrock or Google Vertex AI. The switch na two or three environment variables plus the cloud credentials wey your team already get. Everything for local side dey behave the same way: the CLI, subagents, hooks, skills, MCP servers, and your CLAUDE.md files. Na only the model call dey move. Four things move with am: the network wey the request pass through, the account wey pay for am, the Claude models wey you get permission to invoke, and the server-side features wey dey available at all.

The question hardly ever be whether e go work. E dey work. The question na which of those four things matter pass to you.

The three routing, and wetin each one go cost you

Anthropic direct with subscription. You go sign in with claude.ai account wey dey for Pro, Max, Team or Enterprise plan. Requests go Anthropic's API. You go pay per seat, and plan limits go cap usage instead of metering am per token. Na only this routing fit reach the surfaces wey dem build on top of the account, like Claude Code on the web, the mobile app, Desktop and Remote Control. For team, the Claude Enterprise plan add single sign-on and managed policy settings on top of that.

Anthropic direct with API key. You go create key for Anthropic Console and pay per token. E use the same infrastructure and same regions as subscription, but no seat dey, and usage go show for Anthropic own dashboard. Which one of the two cheaper depend on how many hours per day the agent actually dey run. Na the main subject of the API against subscription cost comparison and wetin Claude Code dey cost for practice.

Third-party endpoint for Bedrock or Vertex. Your own AWS or Google Cloud account go serve the model. Anthropic no dey inside the request path when inference dey happen. The tokens go enter bill wey you already dey receive, under IAM (identity and access management) policies and audit logs wey you already dey run. Two other third-party options dey: Microsoft Foundry and Claude Platform on AWS. Dem follow the same pattern: one environment variable go select the provider, and the cloud account go pay.

Naming note, as of August 2026: Google rename Vertex AI to Google Cloud's Agent Platform. Anthropic documentation dey use the new name, but Claude Code login prompt still talk Google Vertex AI, and the environment variables still talk VERTEX.

Data residency na the real reason teams dey do this

For Bedrock, request dey go Bedrock endpoint for AWS region wey you choose, inside your own account. Data wey dey at rest dey encrypted with AES-256 under AWS-managed keys, and you fit provide your own key through AWS KMS (key management service). For Vertex, the equivalent na Google-managed encryption keys, with CMEK (customer-managed encryption keys) available. IAM roles wey you already dey use control access, and the calls dey appear for CloudTrail or Cloud Audit Logs like any other API call. For regulated team, na the complete reason, and e strong.

Two details make this less absolute than marketing dey suggest.

A cross-region inference profile no be one region. For Bedrock, Claude Code dey resolve its built-in default models to cross-region inference profile IDs, and the prefix wey e prefer dey come from the region wey e resolve: us. for a us-* region, eu. for a eu-* region, apac. for a ap-* region, and us-gov. for GovCloud. A cross-region profile fit serve request from another region inside that geography, so the guarantee wey you get na geography, no be one city. If your requirement name one region, route through an application inference profile wey you control and set ANTHROPIC_MODEL to its ARN.

Some traffic still dey reach Anthropic, and none of am na your code. Telemetry, error reporting and the /feedback command dey off by default for both Bedrock and Vertex, and /feedback dey write archive under ~/.claude/feedback-bundles/ for your own machine instead of uploading anything. Two exceptions dey run for every provider. Before e fetch URL, the WebFetch tool dey send the hostname, and only the hostname, to api.anthropic.com to check safety blocklist. Session quality surveys still dey show too. Switch the first one off with skipWebFetchPreflight for your settings file and the second one off with CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY=1, or disable all non-essential traffic at once with CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC.

For training: under commercial terms, Anthropic no dey train models with the code or prompts wey dem send through Claude Code, and third-party platform usage na commercial. The Development Partner Program, the opt-in wey dey allow training, no dey available to Bedrock or Vertex users at all. Zero data retention for these endpoints na matter wey your agreement with AWS or Google go determine.

Point Claude Code go Amazon Bedrock

Two things dey happen once for each AWS account before any client config matter. Open Amazon Bedrock console, select one Anthropic model from model catalog, then submit use case form: access go grant immediately after submission. Then attach IAM policy wey allow the calls Claude Code dey make.

• bedrock:InvokeModel
• bedrock:InvokeModelWithResponseStream
• bedrock:ListInferenceProfiles
• bedrock:GetInferenceProfile

ListInferenceProfiles na wetin dey allow Claude Code check for startup which models your account fit really invoke. GetInferenceProfile dey allow am resolve application inference profile ARN back to the foundation model behind am, so e fit choose the correct request shape. Without that one, requests still dey succeed, because Claude Code go retry once with the other shape. The symptom na one extra round trip for each new model, no be error.

The fastest client path na the wizard. Run claude, choose 3rd-party platform and then Amazon Bedrock, or type /setup-bedrock for session wey don already sign in. E dey read the profiles inside your ~/.aws directory, verify which models you fit invoke, and write the result inside the env block of ~/.claude/settings.json, so nothing depend on your shell profile.

For scripted rollout, set the variables by yourself.

export CLAUDE_CODE_USE_BEDROCK=1
export AWS_REGION=us-east-1

Credentials dey come from the standard AWS SDK credential chain, so anything wey already dey work for the aws CLI go work here too: aws configure, an SSO profile, an assumed role, or a Bedrock API key.

aws sso login --profile=your-profile-name
export AWS_PROFILE=your-profile-name

export AWS_BEARER_TOKEN_BEDROCK=your-bedrock-api-key

The bearer token na the simplest option, and na the one wey you need handle carefully, because na long-lived secret e be wey dey sit inside environment variable. For shared build box, prefer role wey dey expire. The same reasoning apply to every other credential wey the agent fit read, and na that one how to keep secrets away from AI agent dey discuss.

The region trap. Claude Code dey resolve the region for this order: AWS_REGION, then AWS_DEFAULT_REGION, then the region for your active AWS profile, then us-east-1. That last step na default, no be error, so team wey no set region anywhere and assume say routing go Europe go send requests to US region without any warning. Run /status inside Claude Code to see the resolved region and where e come from. To confirm wetin your account fit call for one region, run aws bedrock list-inference-profiles --region your-region.

Run Claude Code for Google Vertex AI

Enable the API and collect your credentials.

gcloud config set project YOUR-PROJECT-ID
gcloud services enable aiplatform.googleapis.com
gcloud auth application-default login

Request access to the Claude models wey you want for Model Garden. Approval no dey happen immediately, so allow 24 to 48 hours. Grant roles/aiplatform.user, wey carry the aiplatform.endpoints.predict permission used for both model invocation and token counting.

Then select the provider.

export CLAUDE_CODE_USE_VERTEX=1
export CLOUD_ML_REGION=global
export ANTHROPIC_VERTEX_PROJECT_ID=YOUR-PROJECT-ID

CLOUD_ML_REGION dey accept global, a multi-region location like eu or us, or one region. The global endpoint get the best availability, but you get the least control over where dem serve request. So if residency na requirement, you normally need name a location instead. Model coverage dey differ across the three options. If one model wey you need no dey available through the global endpoint, pin only that model to a location with its VERTEX_REGION_CLAUDE_* variable and leave everything else global. Check the current Vertex AI locations page instead of trusting a list wey fit don old.

The project trap. ANTHROPIC_VERTEX_PROJECT_ID na the lowest-priority source for the project ID. GCLOUD_PROJECT, GOOGLE_CLOUD_PROJECT and the credential file named by GOOGLE_APPLICATION_CREDENTIALS all get priority over am. For a machine where one of dem don already dey exported, the charges go enter that other project, and nothing for the session go tell you.

Verify after any provider change. Run /status: the API provider line dey show Google Vertex AI, while the GCP project, Default region and Model lines show wetin Claude Code actually resolve. If the provider line no dey, the variables no reach the process because dem export am for another shell from the one wey launch claude. Move dem into the env block of the settings file. Na so you fit keep a value like AWS_PROFILE away from every other process wey you start.

Wetin models you get, and how late dem dey arrive

Aliases like sonnet and opus no mean say dem be the newest. For a third-party endpoint, dem resolve to Claude Code built-in default for that provider. This default fit dey behind the current release, and your account fit no even get access to am. When the default no dey available, Claude Code go fall back to an older or lower-tier model for that session and print a notice. The fallback no dey save, so the next session go try again and print the notice again.

If na rollout for team, pin the versions.

# Copy the exact IDs from your provider's own model catalog.
export ANTHROPIC_DEFAULT_OPUS_MODEL='<provider model id>'
export ANTHROPIC_DEFAULT_SONNET_MODEL='<provider model id>'
export ANTHROPIC_DEFAULT_HAIKU_MODEL='<provider model id>'

Take the IDs from the models overview and from your provider catalog, because the format dey differ by provider: Bedrock expects an inference profile ID or an ARN, while Vertex expects a plain model name. No copy dem from any article, including this one. Pinning also help control cost, because the default primary model na an Opus-class model, and Opus cost more per token than Sonnet. So, deployment wey no pin anything go bill for the higher rate. To set one model as the session default instead, set ANTHROPIC_MODEL to the model full ID.

Model arrival na the clearest trade-off for this comparison. For Anthropic own API, model go work the same day e launch. For Bedrock and Vertex, e go work after your cloud provider enable am for your region and grant your account access. This fit happen after some days at best, and sometimes e fit take much longer. If some work must run for the newest model, keep one routing wey fit reach am. Na this be the practical reason for routing different models to different jobs.

Wetin you give up for Bedrock and Vertex

Everything wey dey work locally still dey work for every provider: subagents, hooks, slash commands, skills, plugins, checkpoints, sandboxing, the managed settings file and OpenTelemetry metrics. The gaps dey only for server side.

These ones no dey available for both endpoints: fast mode, Advisor, Channels, cross-session messaging, the analytics dashboard and server-managed settings. Anything wey need claude.ai account no dey available too. This one include Claude Code on the web, the mobile app, Desktop, Remote Control, routines and artifacts.

Bedrock only: WebSearch tool no dey there, so Claude no fit run search from session wey route through Bedrock. E still fit read page with WebFetch when you give am URL. For Vertex, web search dey work for Claude 4 generation models and later.

Partial for both: auto mode dey run only for restricted set of newer models, and /loop need explicit interval because e no fit choose one by itself. Check Anthropic's feature availability page before you promise any feature to your team, because this list fit change.

Na whose bill e go enter

Subscription and third-party endpoint na separate purchases. One no replace the other.

Make we talk am plain, because this mistake fit happen without any warning. If you set CLAUDE_CODE_USE_BEDROCK=1 for machine wey you also sign in with Max seat, AWS go meter every token according to Bedrock rates. The seat still dey charge monthly, but e no pay for any of that traffic. No combined view dey too: spending go show for AWS Cost Explorer or Google Cloud Billing, and Anthropic analytics dashboard no dey available for either provider. The /logout command go disappear too, because no Anthropic session dey to end. Na the cloud credential dey control am.

Rates dey for the provider own page and dem fit change, so read Amazon Bedrock pricing or Vertex AI pricing, instead of trusting any figure wey article mention. One important thing no change: for these endpoints, na per-token inference you dey pay for. So if agent dey run all day, cost go continue according to usage. No plan cap dey to stop am.

Rate limits and quotas dey work differently for each routing

For subscription, limits belong to the account, dem reset according to schedule, and if you reach one, you must wait. how usage limits dey work explain this behaviour.

For Anthropic API key, limits belong to the organization. Dem dey expressed as requests and tokens per minute, and dem increase as your usage tier go up.

For Bedrock and Vertex, limits na cloud quotas. Dem dey scoped per account or project, per model, and per region. Dem no get any connection with Anthropic plan. 429 mean say that account don reach its quota for that model for that region. So, you go fix am from the provider's console: request increase, or move go location wey get available capacity. Bedrock charge quota based on token burndown rule instead of fixed request count, and you buy reserved capacity as provisioned throughput. For Vertex, 429s often mean say your single-region endpoint no dey serve both the primary model and the small fast model. Na why CLOUD_ML_REGION=global be the documented starting point. Google's quotas page explain how to request increase.

Failure modes, and the strings wey you go see

Could not load the default credentials, for Vertex. Application Default Credentials no dey, or dem don expire. Run gcloud auth application-default login, or point GOOGLE_APPLICATION_CREDENTIALS to a service account key file.

A 404 wey name the model, for Vertex. Model no enable for Model Garden for that project, or dem no offer am for the location wey you set. Dem dey serve some models only for the global endpoint or multi-region location like eu, never for one specific region.

on-demand throughput isn't supported, for Bedrock. You pass bare foundation model ID for model wey dem dey serve only through inference profile. Use the inference profile ID instead.

AWS default-chain credential resolve timed out. One step for the AWS credential chain hang, most times na credential_process helper wey dey wait for input wey e no fit ever receive. Every chain resolve dey time out after 60 seconds. If your chain genuinely need more time, like browser SSO flow with MFA (multi-factor authentication) behind wrapper, increase the limit in milliseconds with CLAUDE_CODE_AWS_CHAIN_RESOLVE_TIMEOUT_MS.

Error wey happen when Bedrock streaming response has content-type dey start. Something between Claude Code and Bedrock dey rewrite the stream. Bedrock dey stream with binary event-stream format and content type application/vnd.amazon.eventstream, so gateway wey re-emit am as server-sent events go return body wey Claude Code no fit decode. Fix the gateway make e pass response body and its Content-Type header through unchanged.

Browser tabs wey dey open repeatedly during AWS SSO. Corporate VPN or TLS-inspecting proxy dey interrupt the sign-in. Claude Code read the broken connection as authentication failure, run the awsAuthRefresh command again, and repeat forever. Remove awsAuthRefresh from your settings file and run aws sso login by hand before you start Claude Code.

How to choose routing

Choose Anthropic direct if you want new models immediately when dem launch, plus the complete feature set. Choose API key if you want pay per token without buying seats. Choose Bedrock or Vertex if inference must happen inside cloud account wey you already dey govern. But you gree say model pipeline go slower and feature list go shorter as the trade-off. The setup pages wey worth bookmarking na Anthropic own pages for Amazon Bedrock and Google Vertex AI, plus AWS list of models by region.

None of the three options change where the agent itself dey execute. Claude Code na local process wey dey read your files and run your commands, no matter which endpoint answer am. Na why teams wey want am run somewhere wey no be laptop dey put the coding agent for VPS and export these same variables there.

FAQ

My Claude subscription dey pay for Claude Code on Bedrock or Vertex?

No. Pro, Max, Team or Enterprise seat and third-party endpoint na separate purchases, and one no cover the other. If CLAUDE_CODE_USE_BEDROCK=1 or CLAUDE_CODE_USE_VERTEX=1 dey set, AWS or Google Cloud go meter every token with their own rates, and charge am for that cloud bill. The seat still dey charge monthly for the surfaces wey e cover. Spend tracking dey move go AWS Cost Explorer or Google Cloud Billing, because Anthropic analytics dashboard no dey available for either provider.

Which region Claude Code dey send my requests to for Amazon Bedrock?

Na the region wey e resolve, and /status go show you. Claude Code first check AWS_REGION, then AWS_DEFAULT_REGION, then region for your active AWS profile. If none dey set, e go fall back to us-east-1. The built-in default models then resolve to cross-region inference profiles whose prefix follow that region, like us. or eu.. Cross-region profile fit serve request from another region inside the same geography. If one named region na hard requirement, use application inference profile wey you control and set ANTHROPIC_MODEL to its ARN.

Why newest Claude model no dey show for my Bedrock or Vertex account?

Na because each cloud provider dey enable models according to its own schedule, and your account still need access grant on top of that. For Vertex, request access inside Model Garden. Approval fit take 24 to 48 hours. Until then, aliases like sonnet and opus go resolve to Claude Code built-in default for that provider. If that default no dey available for your account, Claude Code go fall back to earlier or lower-tier model for the session and show notice. Pin ANTHROPIC_DEFAULT_SONNET_MODEL and its siblings to IDs wey you confirm say dem dey enabled.

Web search dey available for Claude Code on Amazon Bedrock?

No. WebSearch tool no dey available on Bedrock, so Claude no fit run search from session wey route there. E still fit read specific page with WebFetch when you provide the URL. For Google Vertex AI, web search dey work for Claude 4 generation models and later. Na one of the few capability differences wey dey favour Vertex.

I need Anthropic account to run Claude Code on Bedrock or Vertex?

No. Your AWS or Google Cloud credential na the authentication, and na why /logout no dey available for either provider. But one connection to Anthropic still remain, no matter which provider you use. Before WebFetch fetch URL, the tool send the hostname, and only the hostname, to api.anthropic.com to check am against safety blocklist. Set skipWebFetchPreflight inside your settings file to turn this off. If you still want limit the domains Claude fit reach, use am together with WebFetch permission rules.