> This page is for Gateway.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Amazon Bedrock

> Set up Amazon Bedrock BYOK on Gateway with a Bedrock API key, AWS access keys, or an IAM role, including the AWS-side steps and the IAM permissions each method needs.

Connect your AWS account so Gateway serves Amazon Bedrock models on your own account and quota. Choose a method in the Bedrock credential dialog under [**Configure → Vendor credentials**](https://gateway.merge.dev/configuration/vendor-credentials):

| Method          | What you provide                                  | Pick it when                                    |
| --------------- | ------------------------------------------------- | ----------------------------------------------- |
| **API key**     | A Bedrock API key                                 | You want the fastest setup                      |
| **Access keys** | An IAM user's access key ID and secret access key | You already manage IAM users and keys           |
| **IAM role**    | The ARN of a role Gateway assumes                 | You don't want to hand over a long-lived secret |

Every method also needs an **AWS region**, such as `us-east-1`. You can't switch methods on an existing credential; remove it and add a new one.

## Permissions

The credential's identity needs permission to invoke models: the AWS-managed `AmazonBedrockLimitedAccess` policy, or this minimal policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": "*"
    }
  ]
}
```

Also enable model access in the Bedrock console for each model you want, in the Region you set. Gateway doesn't test the credential on save, so send a request to a Bedrock model to confirm it works.

## API key

In the Amazon Bedrock console, select **API keys** and [generate a key](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-generate.html). AWS attaches `AmazonBedrockLimitedAccess` by default. In Gateway, choose **API key**, paste it into **Bedrock API key**, and set **AWS region** to the Region you generated it in, since the key only works there.

> **Warning**
>
> Short-term Bedrock API keys expire within 12 hours, and the credential stops working with them. Use a long-term key, access keys, or an IAM role for anything long-running.

## Access keys

In IAM, create a user (for example `bedrock-gateway`), attach the policy above, and create an access key. AWS shows the secret only once. In Gateway, choose **Access keys** and enter the **Access key ID**, **Secret access key**, and **AWS region**. Access keys aren't tied to a Region, so pick the one where your models are enabled.

## IAM role

Choose **IAM role** in the dialog to see the principal to trust, your organization's external ID, and a ready-made trust policy. In IAM, create a role with that trust policy, attach the invoke policy above, then paste the role's ARN (`arn:aws:iam::<account-id>:role/<name>`) into **Role ARN** and set **AWS region**. Gateway assumes the role with your external ID when it calls Bedrock, so no long-lived secret leaves your account.

## Next steps

#### [Bring your own keys](/merge-gateway/capabilities/byok/overview)

Managed fallback and which credentials requests use

#### [Vendor terms](/merge-gateway/security/provider-terms)

AWS terms of service and serving region