Amazon Bedrock

Connect your AWS account so Gateway serves Amazon Bedrock models on your own account and quota. Choose a method in the Bedrock credential dialog under Configure → Vendor credentials:

Every method also needs an AWS region, such as us-east-1. You can’t switch methods on an existing credential; remove it and add a new one.

Permissions

The credential’s identity needs permission to invoke models: the AWS-managed AmazonBedrockLimitedAccess policy, or this minimal policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": "*"
    }
  ]
}

Also enable model access in the Bedrock console for each model you want, in the Region you set. Gateway doesn’t test the credential on save, so send a request to a Bedrock model to confirm it works.

API key

In the Amazon Bedrock console, select API keys and generate a key. AWS attaches AmazonBedrockLimitedAccess by default. In Gateway, choose API key, paste it into Bedrock API key, and set AWS region to the Region you generated it in, since the key only works there.

Access keys

In IAM, create a user (for example bedrock-gateway), attach the policy above, and create an access key. AWS shows the secret only once. In Gateway, choose Access keys and enter the Access key ID, Secret access key, and AWS region. Access keys aren’t tied to a Region, so pick the one where your models are enabled.

IAM role

Choose IAM role in the dialog to see the principal to trust, your organization’s external ID, and a ready-made trust policy. In IAM, create a role with that trust policy, attach the invoke policy above, then paste the role’s ARN (arn:aws:iam::<account-id>:role/<name>) into Role ARN and set AWS region. Gateway assumes the role with your external ID when it calls Bedrock, so no long-lived secret leaves your account.

Next steps