Skip to main content
Route all Deductive AI model calls through your own AWS account using Amazon Bedrock. This keeps inference traffic within your AWS environment, gives you unified cost visibility in AWS Cost Explorer, and lets you enforce your organization’s data residency and access control policies. When enabled, every model call Deductive makes is routed through Amazon Bedrock in your chosen AWS region. Deductive’s default model providers are bypassed entirely. Your AWS credentials are stored encrypted server-side and are only used to invoke models.

​
Availability

The AWS Bedrock integration is available for certain Enterprise customers. Because this feature depends on your Deductive billing structure, please reach out to your account team or support@deductive.ai to discuss enabling this integration.

​
Prerequisites

Before configuring the gateway:
  1. Enable Amazon Bedrock in your AWS account. Bedrock is a regional service — enable it in the specific region you plan to use. Visit the Bedrock console to get started.
  2. Request foundation model access. Bedrock requires explicit opt-in for each model family. In the Bedrock console, go to Model access and request access to the Anthropic and OpenAI model families. See Supported models below.
  3. Create an IAM user with the required permissions. You will need an Access Key ID and Secret Access Key. See IAM permissions below.

​
Supported models

Deductive routes the following models through your Bedrock account:
Deductive modelAmazon Bedrock model ID
Claude 4.6 Sonnetanthropic.claude-sonnet-4-6
Claude 4.5 Haikuanthropic.claude-haiku-4-5-20251001-v1:0
GPT-OSS 120Bopenai.gpt-oss-120b-1:0
GPT-5.4openai.gpt-5.4
You must request model access for each provider family (Anthropic and OpenAI) separately in the Bedrock console. If a provider’s models are not enabled, validation will flag an error for those models but other enabled models will continue to work. Not every Bedrock region hosts every model. Check Bedrock model availability by region to confirm your chosen region supports the models we need.

​
IAM permissions

Attach the following policy to the IAM user whose credentials you will enter in Deductive: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "StsVerify",
      "Effect": "Allow",
      "Action": "sts:GetCallerIdentity",
      "Resource": "*"
    },
    {
      "Sid": "BedrockListModels",
      "Effect": "Allow",
      "Action": "bedrock:ListFoundationModels",
      "Resource": "*"
    },
    {
      "Sid": "BedrockInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:Converse",
        "bedrock:ConverseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/*",
        "arn:aws:bedrock:*:*:inference-profile/*"
      ]
    },
    {
      "Sid": "BedrockMantleInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock-mantle:CreateInference",
        "bedrock-mantle:GetProject",
        "bedrock-mantle:ListProjects",
        "bedrock-mantle:GetModel",
        "bedrock-mantle:ListModels"
      ],
      "Resource": "arn:aws:bedrock-mantle:*:*:project/*"
    },
    {
      "Sid": "BedrockMantleBearerToken",
      "Effect": "Allow",
      "Action": "bedrock-mantle:CallWithBearerToken",
      "Resource": "*"
    }
  ]
}
Once you attach this policy, generate an Access Key ID and Secret Access Key for that user. Those are the two credential values you will enter in Deductive.

​
Setup

  1. In Deductive, open Settings → Integrations.
  2. Select Model Gateway in the left sidebar.
  3. Click AWS Bedrock.
  4. Fill in the three required fields:
    • AWS Region — the region where you enabled Bedrock and requested model access (e.g. us-east-1, us-west-2).
    • AWS Access Key ID — the access key ID for your IAM user.
    • AWS Secret Access Key — the corresponding secret access key.
  5. Click Save.
Deductive saves your credentials and immediately runs validation. Results appear below the form.

​
Validating your configuration

After saving, or any time you want to confirm the gateway is working, click Validate Credentials. Deductive runs the following checks:
CheckWhat it confirms
STS: Verify AWS credentialsThe access key and secret are valid and can authenticate with AWS.
Bedrock: List foundation modelsThe IAM user has bedrock:ListFoundationModels access in the configured region.
Bedrock: Invoke <model>Each supported model can be invoked end-to-end from your account.
A failed check includes the error message returned by AWS. Use that message to diagnose permission or model-access issues. Failed checks do not remove your saved credentials.

​
Removing the gateway

  1. Open Settings → Integrations → AWS Bedrock.
  2. Click Remove credentials and confirm.
All Deductive model calls will fall back to the default providers. Your credentials are permanently deleted from Deductive’s secrets store. You can re-enable the gateway at any time.

​
Troubleshooting

STS check fails — “InvalidClientTokenId” or “AuthFailure” The access key or secret is invalid or belongs to a deactivated IAM user. Double-check the values you entered, or generate a new access key in the AWS IAM console.
Bedrock: List foundation models fails The IAM user is missing the bedrock:ListFoundationModels permission, or Bedrock is not enabled in the selected region. Verify both in the AWS console.
Invoke check fails — “AccessDeniedException” for Claude models Anthropic model access has not been granted in your Bedrock account. In the Bedrock console, go to Model access and request access to the Anthropic Claude model family. Approval may take a few minutes to a few hours.
Invoke check fails — “AccessDeniedException” for GPT models OpenAI model access has not been granted. In the Bedrock console, go to Model access and request access to the OpenAI model family.
All checks pass but I need to change regions The region in Deductive must match the region where you enabled Bedrock and requested model access. The gateway does not cross regions. To change, save updated credentials with the correct region.
Something else isn’t working Reach out to support@deductive.ai and include the error message from the validation results — that message comes directly from AWS and is the fastest way to diagnose the issue.

​
Field Reference

  • AWS Region (region) — the AWS region for your Bedrock endpoint (e.g. us-west-2)
  • AWS Access Key ID (accessKeyId) — the access key ID for the IAM user
  • AWS Secret Access Key (secretAccessKey) — the secret access key for the IAM user