Bedrockアプリケーション推論プロファイル利用時にClaude Codeのbuilt-in subagentが403エラーになる問題と対処法

type Config = {
  teams: {
    name: string;
    members: {
      name: string;
      email: string;
    }[];
  }[];
};

export const config: Config = {
  teams: [
    {
      name: "olympus",
      members: [
        { name: "zeus", email: "zeus@example.com" },
        { name: "athena", email: "athena@example.com" },
        { name: "apollo", email: "apollo@example.com" },
      ],
    },
    {
      name: "asgard",
      members: [
        { name: "thor", email: "thor@example.com" },
        { name: "freyja", email: "freyja@example.com" },
        { name: "baldur", email: "baldur@example.com" },
      ],
    },
  ],
};

import * as bedrock from "@aws-cdk/aws-bedrock-alpha";
import * as cdk from "aws-cdk-lib";
import * as iam from "aws-cdk-lib/aws-iam";
import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
import { pascalCase } from "change-case";
import type { Construct } from "constructs";
import { config } from "./config.js";

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const model = bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_SONNET_4_6;

    const cris = bedrock.CrossRegionInferenceProfile.fromConfig({
      geoRegion: bedrock.CrossRegionInferenceProfileRegion.US,
      model,
    });

    for (const team of config.teams) {
      for (const member of team.members) {
        const prefix = `${team.name}-${member.name}`;
        const idPrefix = pascalCase(prefix);

        const aip = new bedrock.ApplicationInferenceProfile(this, `${idPrefix}Aip`, {
          applicationInferenceProfileName: `sonnet4-${team.name}-${member.name}`,
          modelSource: cris,
          description: `${team.name}-${member.name}`,
          tags: {
            team: team.name,
            name: member.name,
            email: member.email,
          },
        });

        const user = new iam.User(this, `${idPrefix}User`, {
          userName: `${prefix}-bedrock`,
        });
        aip.grantInvoke(user);
        user.addToPolicy(
          new iam.PolicyStatement({
            actions: ["bedrock:InvokeModelWithResponseStream"],
            resources: [aip.inferenceProfileArn],
          }),
        );

        const accessKey = new iam.AccessKey(this, `${idPrefix}Key`, { user });

        new secretsmanager.Secret(this, `${idPrefix}Creds`, {
          description: `Bedrock API creds for ${team.name}/${member.name}`,
          secretObjectValue: {
            AccessKeyId: cdk.SecretValue.unsafePlainText(accessKey.accessKeyId),
            SecretAccessKey: accessKey.secretAccessKey,
          },
        });
      }
    }
  }
}