AWS Bedrock
AWS Bedrock is Amazon’s managed inference platform. It hosts Anthropic’s Claude family, Meta’s Llama, Mistral, and Amazon’s own Nova models — all behind a unified Bedrock Runtime API. Use this vendor when your organization is AWS-heavy or needs the BAA / data-residency story Bedrock provides.
Get credentials
Bedrock supports two auth modes. Pick based on what your organization already uses.
Option A — API Key (newer, simpler)
- Sign in to the AWS Console, go to Amazon Bedrock.
- Open API keys in the sidebar.
- Click Generate API key, copy the bearer token.
This is the easiest path — one secret, no IAM dance.
Option B — IAM credentials (legacy, more flexible)
If your organization issues IAM credentials per-team or per-environment:
- Create an IAM user (or use an existing one) with the policy
AmazonBedrockFullAccess(or a tighter custom policy that grantsbedrock:InvokeModelandbedrock:InvokeModelWithResponseStream). - From IAM → Security credentials → Create access key, save the Access Key ID and Secret Access Key.
- If you’re using STS / temporary credentials, you’ll also have a Session Token.
For most jambonz deployments, Option A (API key) is enough and simpler to rotate. Use IAM credentials when you have organizational policy reasons (centralized IAM management, federated logins, STS rotation).
Configure in jambonz
In the portal: Account → LLM Services → + Add LLM Service → AWS Bedrock.
The form lets you pick API Key or IAM Credentials auth.
API Key fields
The bearer token from Bedrock → API keys.
AWS region where Bedrock is enabled (us-east-1, us-west-2, etc.). Region affects which models are available.
IAM fields
The AKIA... string.
The 40-character secret.
Only needed for STS / temporary credentials.
Same as above.
Click Test to verify. The probe issues ListFoundationModels against the control plane.
Use in an agent verb
Available Models
See AWS’s Bedrock model cards for the authoritative current list — each card has model id, supported regions, modalities, and pricing. Common picks:
Quirks & errors
Cross-region inference profile prefix (us., eu., apac.) is required for Claude 4.x family on Bedrock. The plain anthropic.claude-*-4-* ids no longer accept on-demand invocations in most regions. Use the us. (or appropriate regional) prefix. Operators outside the US should change to eu. or apac. accordingly.
ResourceNotFoundException: This Model is marked by provider as Legacy — AWS may revoke “legacy” model access on accounts that haven’t called the model in the last 30 days. Models like anthropic.claude-3-5-sonnet-20240620-v1:0 are flagged in the jambonz manifest as deprecated: true and may stop working without warning on dormant accounts. Switch to a current model.
Model availability differs by region. Some models are exclusive to specific AWS regions, and not all regions have Bedrock at all. Check the Bedrock model availability matrix before picking a region.
You must explicitly request model access in the AWS console (Bedrock → Model access → Request access) before invoking Anthropic, Meta, or Mistral models. Amazon-published models (Nova) are usually accessible by default. The Test button passes regardless of model access since it only verifies auth — first inference call against an un-requested model returns AccessDeniedException.