claude-agent-sdk rejects AWS Bedrock `au.*` cross-region inference profile ids (ap-southeast-2 AU-only)

[EvoCap]

Summary

The @anthropic-ai/claude-agent-sdk bundled with claude-code-action@v1 rejects AWS Bedrock cross-region inference profile IDs with the au.* prefix (e.g. au.anthropic.claude-sonnet-4-5-20250929-v1:0), even though those profiles are GA on AWS and route to AU-only regions (ap-southeast-2 + ap-southeast-4).

This blocks any GitHub Actions workflow that needs to invoke Sonnet 4.5 (or later) on Bedrock in compliance with an AU-data-residency posture.

Reproduction

Workflow step (relevant bits):

- name: Configure AWS credentials via OIDC
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
    aws-region: ap-southeast-2

- name: Claude review via Bedrock-Sydney
  uses: anthropics/claude-code-action@v1
  env:
    AWS_REGION: ap-southeast-2
  with:
    use_bedrock: "true"
    prompt: "Reply with the word OK"
    claude_args: --model au.anthropic.claude-sonnet-4-5-20250929-v1:0
    show_full_output: "true"

The role's IAM policy grants bedrock:InvokeModel + bedrock:InvokeModelWithResponseStream on:

• arn:aws:bedrock:ap-southeast-2:<account>:inference-profile/au.anthropic.claude-sonnet-4-5-20250929-v1:0
• arn:aws:bedrock:ap-southeast-2::foundation-model/anthropic.claude-sonnet-4-5-20250929-v1:0
• arn:aws:bedrock:ap-southeast-4::foundation-model/anthropic.claude-sonnet-4-5-20250929-v1:0

Observed behaviour

The action initializes correctly (system init reports the right model ID):

{ "type": "system", "subtype": "init",
  "model": "au.anthropic.claude-sonnet-4-5-20250929-v1:0" }

Then fails before reaching Bedrock:

{ "type": "result", "subtype": "success",
  "is_error": true, "duration_api_ms": 0, "num_turns": 1,
  "result": "The model au.anthropic.claude-sonnet-4-5-20250929-v1:0 is not
  available on your bedrock deployment. Try switching to
  apac.anthropic.claude-sonnet-4-20250514-v1:0, or ask your admin to enable
  this model.",
  "total_cost_usd": 0,
  "usage": { "input_tokens": 0, "output_tokens": 0, ... } }

duration_api_ms: 0 and total_cost_usd: 0 confirm no Bedrock call was made — the rejection is client-side in the SDK's model-registry validation.

Expected behaviour

The model au.anthropic.claude-sonnet-4-5-20250929-v1:0 is the canonical AU-region cross-region inference profile id for Claude Sonnet 4.5 in AWS Bedrock today. aws bedrock list-inference-profiles --region ap-southeast-2 returns it as ACTIVE; a direct aws bedrock-runtime invoke-model against it succeeds and returns a normal Claude response.

The SDK should either:

1. Add au.* to its model registry (alongside us.*, eu.*, apac.*), OR
2. Skip the client-side model-id validation and let AWS Bedrock be the source of truth on what's invocable (with proper IAM permission), OR
3. Provide an opt-out flag (e.g. --skip-model-validation) for users on newer cross-region inference profiles

Independent verification

Direct invoke from a local AWS CLI session with the same role's credentials succeeds:

aws bedrock-runtime invoke-model \
  --region ap-southeast-2 \
  --model-id "au.anthropic.claude-sonnet-4-5-20250929-v1:0" \
  --body '{"anthropic_version":"bedrock-2023-05-31","max_tokens":50,"messages":[{"role":"user","content":"reply OK"}]}' \
  --content-type "application/json" \
  --cli-binary-format raw-in-base64-out \
  /tmp/result.json

Response (truncated):

{ "model": "claude-sonnet-4-5-20250929", "type": "message",
  "content": [{"type":"text","text":"OK"}], "stop_reason": "end_turn" }

So the model is invocable; only the SDK's pre-check is blocking it.

Context note on apac.* vs au.*

The SDK's suggestion string mentions apac.anthropic.claude-sonnet-4-20250514-v1:0 — implying apac.* IS in the registry. We checked: apac.* profiles do not exist on our AWS account (verified via aws bedrock list-inference-profiles and aws bedrock get-inference-profile). Only au.* and global.* Sonnet 4.5 profiles exist in ap-southeast-2 for this account. It looks like AWS may have renamed apac.* → au.* at some point and the SDK's registry hasn't kept up.

Workarounds we ruled out

• global.anthropic.claude-sonnet-4-5-20250929-v1:0 — exists on AWS and would likely be accepted by the SDK, but routes cross-region (US/EU included). Breaches our data-residency posture (Australian Privacy Principle 8 + a project ADR pinning AU-only Bedrock inference).
• Direct base model id anthropic.claude-sonnet-4-5-20250929-v1:0 — model's inferenceTypesSupported is ["INFERENCE_PROFILE"] only; cannot invoke directly.

Ask

Add au.* (and any future region-prefixed inference profiles AWS publishes) to the SDK's accepted model-id registry, so AWS-side IAM remains the authoritative gate on what callers can invoke.

Happy to provide more details / a fuller workflow YAML / log dumps if useful. Thanks for the action — it's been otherwise great to work with.