Why Headroom Breaks on AWS Bedrock — and How to Fix All Four Failures

You're on AWS Bedrock because compliance won't let your data leave AWS. Your agent workflow multiplies tokens, the bill climbs, and you found Headroom — the open-source compression proxy that promises 60–95% fewer tokens (their benchmark). You point it at Bedrock, and it silently does almost nothing.

I wrote the full guide with the exact error strings, the fixes, and measured numbers. Here's the TL;DR.

---

The four ways it silently breaks on Bedrock

1. 404 on native routes — the proxy 404s /model/{id}/invoke and /inference-profiles, so Claude Code's auto-mode classifier fails closed (issue #1589).
2. InvalidSignatureException — SigV4 signs a hash of the request body; compression rewrites the body, so the signature no longer matches (PR #1220).
3. Dead prompt cache — in --mode cache it prints prefix_frozen but never injects a cachePoint, so Bedrock reports savings_pct: 0.0 (issue #1345). And Bedrock caps you at 4 cache markers: A maximum of 4 blocks with cache_control may be provided. Found 5.
4. ModuleNotFoundError: botocore — crashes on temporary STS credentials because the image doesn't bundle botocore (issue #1551).

---

The savings math (a formula, not a promise)

Bedrock bills input + 1.25×write + 0.1×read. Caching attacks the read term (0.1× — a 10× discount on the repeated prefix); compression attacks the input term. They stack.

Measured on a 6-turn agentic session (us-east-1, July 2026, Claude Sonnet 4.5):

• No optimization: 619,865 token-equivalents
• Cache only (fixed): 257,250 — −58.5%
• Cache + compression: 183,672 — −70.4%

One trap: compact JSON (the default from json.dumps / JSON.stringify / boto3) compresses 0%. The same data with whitespace compresses 43% — token count tracks whitespace.

---

The full guide covers the step-by-step fix, how to verify the cache actually hits (cacheReadInputTokens > 0 on the second request), and the whole error-string reference.

👉 Read the complete guide →

Caprock is a managed distribution of Headroom that ships all four Bedrock fixes and runs entirely inside your VPC, so nothing leaves your AWS account — caprock.dev.