How to Run Claude Code with EU Residency

Development organizations that want to use Claude Code but need to keep data in the EU face a concrete question: how do you route the agent so the code and prompts stay within the EU’s borders? The answer is to point Claude Code to AWS Bedrock – but that comes with a clear trade-off worth understanding before you roll it out.

The principle: point the agent to Bedrock

Claude Code can be pointed at AWS Bedrock instead of Anthropic’s own API. This is done with environment variables that specify an EU region and EU profile IDs for the models. The effect is that authentication happens against AWS, and data processing happens in the chosen EU region.

For a single developer, it’s enough to set the variables locally. For a team rollout, the model-specific DEFAULT variables are used instead, so every developer automatically lands on the right region and profile without individual configuration. That makes the setup scalable across an entire organization.

The difference between the two setups is worth dwelling on, because that’s where the pitfalls lie. If every developer sets the variables themselves, there’s a real risk someone misses one, points at the wrong region, or falls back to the default path against Anthropic’s API without noticing – and then individual calls leak out of the EU without anyone seeing it. The point of the central DEFAULT variables is that the residency choice gets made once, by the organization, instead of depending on every single machine being configured correctly. Authentication then happens against AWS with your usual permissions, which also means access can be governed and revoked with the same tools as the rest of your cloud environment.

The trade-off: what you get and what you give up

Running through Bedrock instead of directly against Anthropic is an active choice with clear pros and cons.

You get:

• EU data under the AWS DPA – processing happens in your chosen EU region under Amazon’s Data Processing Agreement.
• Your own KMS keys for encryption, where you hold control.
• CloudTrail auditing – audit logs within the AWS environment.
• Usage on the cloud bill instead of a separate Anthropic invoice.

You give up:

• Anthropic’s ZDR flag – zero data retention on that path.
• Anthropic’s Compliance and Admin API.
• Anthropic’s own subprocessor list – the subprocessor chain looks different once AWS is in the loop.

So it’s a trade-off between EU residency and cloud governance on one side, and Anthropic’s own enterprise features on the other. Which side weighs heavier is decided by your actual requirements.

The governance that comes with it

One advantage of the Bedrock path in an organization is that it comes with tools for central governance of what the agent may do:

1. Managed settings via MDM – settings are distributed to developers’ machines centrally, not manually per person.
2. Tool permissions where deny wins – when one rule allows and another denies the same thing, the denial always wins. That gives a safe default.
3. MCP allowlist – a list that limits which external tools (MCP servers) the agent may connect to.

Together, that keeps a team rollout within clear boundaries, rather than each developer configuring the agent their own way.

A concrete setup

Picture a development department that wants to give every team Claude Code but is subject to EU data residency requirements. They set the DEFAULT variables against Bedrock in an EU region, connect their own KMS keys, enable CloudTrail, and distribute managed settings via their MDM. Developers get the agent without having to configure regions themselves, and the security team gets logs and a deny-based permission model.

The price they pay is that Anthropic’s ZDR flag and Compliance API aren’t available on this path – something they have to weigh against the EU residency and cloud governance they gain. For that particular organization, it’s a reasonable trade-off.

One last important point: profile IDs and which regions are supported change over time. Always verify current documentation at the time of rollout instead of relying on values from an article. Want to see how this setup connects to residency, retention, and government access in a broader AI project? Find more on our AI page. Need help rolling out Claude Code securely in the EU? Get in touch.