Request capabilitiesBring your own keys

Amazon Bedrock

Connect your AWS account to serve Bedrock models through Gateway

Connect your AWS account so Gateway serves Amazon Bedrock models (for example Claude, Nova, Llama, and Qwen) on your own account. There are two ways to authenticate. Pick the one that fits your security posture.

API key

A Bedrock bearer token, the quickest to set up

Access keys

An IAM user access key and secret, familiar and long-lived

Whichever method you choose, the IAM identity behind it needs permission to invoke Bedrock models:

1{
2  "Version": "2012-10-17",
3  "Statement": [
4    {
5      "Effect": "Allow",
6      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
7      "Resource": "*"
8    }
9  ]
10}

The AWS-managed AmazonBedrockLimitedAccess policy already grants these actions, so attaching it is enough for either method below. You also need to enable model access for the specific Bedrock models you want in the AWS Region you use.

API key

A Bedrock API key is a bearer token you pass instead of AWS credentials. It is the fastest way to get started.

In AWS: open the Amazon Bedrock console, select API keys in the left navigation, and generate a key. AWS offers two kinds:

  • Short-term keys last up to 12 hours (or the length of your console session) and inherit the permissions of the IAM principal that created them, which suits a quick test
  • Long-term keys last until an expiry date you set and create a backing IAM user, which suits exploration

By default AWS attaches the AmazonBedrockLimitedAccess policy to the key, which covers the invoke permissions above. See Generate an Amazon Bedrock API key for the exact console steps.

In Gateway: add an Amazon Bedrock credential, choose the API key method, paste the key, and set the region. The region must match the AWS Region you generated the key from, because the key can only call that Region.

Short-term keys expire within 12 hours, so a credential built on one stops working after that. Use a long-term key or access keys for anything you expect to keep running.

Access keys

Static IAM user credentials (an access key ID and secret) that Gateway uses to sign each Bedrock request.

In AWS:

  1. Create an IAM user, for example bedrock-gateway
  2. Attach the invoke policy above, or the AmazonBedrockLimitedAccess managed policy
  3. Create an access key for that user and copy the access key ID and secret

The secret access key is shown only once at creation. Copy it before you leave the page.

In Gateway: add an Amazon Bedrock credential, choose the Access keys method, and enter the access key ID, secret access key, and region. Access keys are not tied to a single Region, so choose whichever Region has the models you want enabled.

Reference

Next steps

Provider terms

Review the AWS terms of service and serving region

Cost governance and savings

See how BYOK traffic appears in usage and spend