If your Python services already talk to S3 or DynamoDB, they already carry everything needed to talk to Claude on Amazon Bedrock's runtime surface. Boto3 handles AWS Signature Version 4 signing, credential discovery, and region selection the same way for Bedrock as for every other AWS service. This guide takes you from installation to a first Claude response, with the configuration details that matter in production.
Install and pick the right client name
Install or upgrade the SDK with pip install -U boto3. Bedrock splits its API across service endpoints, and boto3 mirrors that split: the "bedrock" client covers control-plane operations (listing models, configuring logging), while the "bedrock-runtime" client is the one you use for inference — InvokeModel, InvokeModelWithResponseStream, Converse, and ConverseStream. A common first stumble is calling an inference method on the control-plane client; if a method seems missing, check which client you constructed.
How credentials are found
You should almost never paste keys into code. AWS SDKs resolve credentials through a standard precedence chain: explicit constructor arguments first, then environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_REGION), then the AWS config and credentials files, and finally ambient providers such as SSO sessions, assumed roles, ECS task roles, and EC2 instance metadata (IMDS). In practice that means: on a developer laptop, configure a profile or SSO; in production, attach an IAM role to the compute and pass nothing at all. The role needs bedrock:InvokeModel (and the streaming/Converse actions you use) on the model ARNs you allow — see the Bedrock IAM setup guide for policy patterns.
Region, timeouts, and a first call
Bedrock is a regional service, so the client needs a region — via region_name, the AWS_REGION environment variable, or your config file. One production-critical setting: Claude 4-generation models have an inference timeout of up to 60 minutes, but AWS SDK clients default to roughly a 1-minute read timeout. AWS recommends raising it (botocore read_timeout of 3600 or more) so long generations aren't cut off mid-response.
import boto3, json
from botocore.config import Config
client = boto3.client("bedrock-runtime", region_name="us-east-1",
config=Config(read_timeout=3600))
resp = client.invoke_model(
modelId="global.anthropic.claude-opus-4-6-v1",
body=json.dumps({
"anthropic_version": "bedrock-2023-05-31",
"max_tokens": 512,
"messages": [{"role": "user", "content": "Say hello in one sentence."}],
}),
)
print(json.loads(resp["body"].read())["content"][0]["text"])Note the model ID format: the legacy runtime surface uses ARN-versioned IDs with a routing prefix (global. for global routing, us./eu. and similar for geographic routing). The newest models — Claude Fable 5, Opus 4.8, Sonnet 5 — are not served on this surface; they live on the newer "Claude in Amazon Bedrock" endpoint, discussed below.
If the first call fails
An AccessDeniedException on first invocation usually means a model-access prerequisite is missing rather than a plain IAM problem. Bedrock enables foundation models by default given the right AWS Marketplace permissions (aws-marketplace:Subscribe and related actions), and the first invocation of a third-party model auto-initiates the Marketplace subscription — which can take up to 15 minutes to complete. Anthropic models on this surface additionally require a one-time First Time Use form per account or AWS Organization. See the model access guide for the full walkthrough.
pip install -U "anthropic[bedrock]" gives you AnthropicBedrock for this legacy surface and AnthropicBedrockMantle for the current Claude in Amazon Bedrock surface — both riding the same AWS credential chain. Choose it when you want code that mirrors Anthropic's first-party Messages API; choose boto3 when you want uniform AWS tooling.Production checklist
Before this leaves a notebook: pin your boto3 version like any other dependency; put the region and model ID in configuration, not code; make sure your service role carries only the Bedrock actions and model ARNs it needs; and remember that request payloads are capped at 20 MB. CloudTrail records every invocation as a management event by default, so your audit trail starts working the moment you do.
Where to go next
Make your first structured request with InvokeModel in depth, add incremental output via response streaming, or start from the quickstart if you're still choosing a platform.