Global cross-Region inference

Global cross-Region inference extends cross-Region inference beyond geographic boundaries, enabling the routing of inference requests to supported commercial AWS Regions worldwide.

Benefits of global cross-Region inference

With global cross-Region inference for the Anthropic Claude Sonnet 4.5 model, you get the following advantages over a geographic cross-Region inference profile:

Global cross-Region inference considerations

Note the following information about Global cross-Region inference:

IAM policy requirements for global cross-Region inference

To enable global cross-Region inference for your users, you must apply a three-part IAM policy to the role. The following is an example IAM policy to provide granular control. You can replace <REQUESTING REGION> in the example policy with the AWS Region you are operating in.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GrantGlobalCrisInferenceProfileRegionAccess",
            "Effect": "Allow",
            "Action": "bedrock:InvokeModel",
            "Resource": [
                "arn:aws:bedrock:<REQUESTING REGION>:<ACCOUNT>:inference-profile/global.<MODEL NAME>"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": "<REQUESTING REGION>"
                }
            }
        },
        {
            "Sid": "GrantGlobalCrisInferenceProfileInRegionModelAccess",
            "Effect": "Allow",
            "Action": "bedrock:InvokeModel",
            "Resource": [
                "arn:aws:bedrock:<REQUESTING REGION>::foundation-model/<MODEL NAME>"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": "<REQUESTING REGION>",
                    "bedrock:InferenceProfileArn": "arn:aws:bedrock:<REQUESTING REGION>:<ACCOUNT>:inference-profile/global.<MODEL NAME>"
                }
            }
        },
        {
            "Sid": "GrantGlobalCrisInferenceProfileGlobalModelAccess",
            "Effect": "Allow",
            "Action": "bedrock:InvokeModel",
            "Resource": [
                "arn:aws:bedrock:::foundation-model/<MODEL NAME>"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": "unspecified",
                    "bedrock:InferenceProfileArn": "arn:aws:bedrock:<REQUESTING REGION>:<ACCOUNT>:inference-profile/global.<MODEL NAME>"
                }
            }
        }
    ]
}

The first part of the policy grants access to the Regional inference profile in your requesting AWS Region. The second part provides access to the Regional FM resource. The third part grants access to the global FM resource, which enables the cross-Region routing capability.

When implementing these policies, include all three resource Amazon Resource Names (ARNs) in your IAM statements:

The global FM ARN has no AWS Region or account specified, which is intentional and required for the cross-Region functionality.

Disable global cross-Region inference

You can choose from two primary approaches to implement deny policies to global CRIS for specific IAM roles, each with different use cases and implications:

When implementing deny policies, it's crucial to understand that global CRIS changes how the aws:RequestedRegion field behaves. Traditional AWS Region-based deny policies that use StringEquals conditions with specific AWS Region names such as "aws:RequestedRegion": "us-west-2" don't target the Region-agnostic global foundation model resource evaluation. For this evaluation, the service sets aws:RequestedRegion to unspecified rather than the actual destination AWS Region. Therefore, a condition that matches "aws:RequestedRegion": "unspecified" can deny global CRIS.

Service Control Policy requirements for Global cross-Region inference

For Global cross-Region inference, if your organization's security policy uses SCPs to block unused Regions, you can either update your Region-specific SCP conditions to allow access with "aws:RequestedRegion": "unspecified" or add an inference-profile exception as described in the following note. Allowing unspecified ensures that requests can be routed to all supported AWS commercial Regions.

The following example shows the first approach. The SCP blocks all AWS API calls outside of approved Regions while allowing Amazon Bedrock Global cross-Region inference calls that use "unspecified" as the Region for global routing:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyAllOutsideApprovedRegions",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "us-east-1",
                        "us-east-2",
                        "us-west-2",
                        "unspecified"
                    ]
                }
            }
        }
    ]
}

Disable global cross-Region inference

Organizations with data residency or compliance requirements should assess whether Global cross-Region inference fits their compliance framework, since requests may be processed in other supported AWS commercial Regions. To explicitly disable Global cross-Region inference, implement the following SCP policy:

{
    "Effect": "Deny",
    "Action": "bedrock:*",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "aws:RequestedRegion": "unspecified"
        },
        "ArnLike": {
            "bedrock:InferenceProfileArn": "arn:aws:bedrock:*:*:inference-profile/global.*"
        }
    }
}

This SCP explicitly denies Global cross-Region inference because the "aws:RequestedRegion" is "unspecified" and the "ArnLike" condition targets inference profiles with the global prefix in the ARN.

AWS Control Tower implementation

Manually editing SCPs managed by AWS Control Tower is strongly discouraged as it can cause drift. Instead, use the mechanisms provided by Control Tower to manage these exceptions. The core principles involve either extending existing region-deny controls or enabling regions and then applying a custom, conditional blocking policy.

For detailed, step-by-step guidance on implementing cross-Region inference with Control Tower, see the blog post Enable Amazon Bedrock cross-Region inference in multi-account environments. This covers extending existing Region deny SCPs, enabling denied regions with custom SCPs, and using Customizations for AWS Control Tower (CfCT) to deploy custom SCPs as infrastructure as code.

Request limit increases for global cross-Region inference

When using global CRIS inference profiles, you can use global CRIS from over 20 supported source AWS Regions. This is a global limit. To view, manage, or increase quotas for global cross-Region inference profiles, use the Service Quotas console or AWS CLI in the requested source AWS Region.

Complete the following steps to request a limit increase:

When calculating your required quota increase, account for the burndown rate. The burndown rate is the rate at which input and output tokens are converted into token quota usage for the throttling system. The following models have a 5x burn down rate for output tokens (1 output token consumes 5 tokens from your quotas):

For all other models, the burndown rate is 1:1 (1 output token consumes 1 token from your quota). For input tokens, the token to quota ratio is 1:1. The calculation for the total number of tokens per request is as follows:

Input token count + Cache write input tokens + (Output token count x Burndown rate)

Use Global cross-Region inference

To use global cross-Region inference with Anthropic's Claude Sonnet 4.5, developers must complete the following key steps:

Global cross-Region inference is supported for:

Implement global cross-Region inference

Implementing global cross-Region inference with Anthropic's Claude Sonnet 4.5 is straightforward, requiring only a few changes to your existing application code. The following is an example of how to update your code in Python:

import boto3
import json
bedrock = boto3.client('bedrock-runtime', region_name='us-east-1')
model_id = "global.anthropic.claude-sonnet-4-5-20250929-v1:0"  
response = bedrock.converse(
    messages=[{"role": "user", "content": [{"text": "Explain cloud computing in 2 sentences."}]}],
    modelId=model_id,
)

print("Response:", response['output']['message']['content'][0]['text'])
print("Token usage:", response['usage'])
print("Total tokens:", response['usage']['totalTokens'])