Skip to main content
Route all Deductive AI model calls through your own AWS account using Amazon Bedrock. This keeps inference traffic within your AWS account, gives you unified cost visibility in AWS Cost Explorer, and lets you enforce your organization’s access control policies. When enabled, every model call Deductive makes is sent to Amazon Bedrock in your chosen AWS region. Deductive’s default model providers are bypassed entirely. Depending on the model, Bedrock may process a request in a different AWS Region. See Where requests are processed. Your AWS credentials are stored encrypted server-side and are only used to invoke models.

​
Availability

The AWS Bedrock integration is available for certain Enterprise customers. Because this feature depends on your Deductive billing structure, please reach out to your account team or support@deductive.ai to discuss enabling this integration.

​
Prerequisites

Before configuring the gateway:
  1. Enable Amazon Bedrock in your AWS account. Bedrock is a regional service — enable it in the specific region you plan to use. Visit the Bedrock console to get started.
  2. Request foundation model access. Bedrock requires explicit opt-in for each model family. In the Bedrock console, go to Model access and request access to the Anthropic and OpenAI model families. See Models below.
  3. Create an IAM user with the required permissions. You will need an Access Key ID and Secret Access Key. See IAM permissions below.

​
Models

Deductive uses models from the Anthropic (Claude) and OpenAI (GPT) families on Bedrock, and updates them as newer versions become available. To see the exact models Deductive currently uses, click Validate Credentials (see Validating your configuration). Each model gets its own Bedrock: Invoke check, labeled with the exact Amazon Bedrock model ID. You must request model access for each provider family (Anthropic and OpenAI) separately in the Bedrock console. If a provider’s models are not enabled, validation will flag an error for those models but other enabled models will continue to work. Not every Bedrock region hosts every model. Check Bedrock model availability by region to confirm your chosen region supports the models we need.

​
Where requests are processed

Deductive always sends requests to Bedrock in the region you configure. For each model, Deductive uses whichever of the following routes Bedrock offers for it, and the model ID prefix shown in validation tells you which one: Some models are only offered through global cross-Region inference. If your organization requires model inference to stay within a specific geography, contact your account team before enabling the gateway. See Amazon Bedrock cross-Region inference for details.

​
IAM permissions

Attach the following policy to the IAM user whose credentials you will enter in Deductive:
The * region wildcard in the BedrockInvoke resources also matches the region-less model ARN (arn:aws:bedrock:::foundation-model/…) that global cross-Region inference uses. If you scope this policy more tightly, keep both the inference profile and the region-less model ARN allowed, and do not restrict aws:RequestedRegion to exclude unspecified. See Global cross-Region inference for AWS’s reference policy. Once you attach this policy, generate an Access Key ID and Secret Access Key for that user. Those are the two credential values you will enter in Deductive.

​
Service control policies (SCPs)

If your AWS Organization uses SCPs to deny requests outside approved Regions:
  • Global cross-Region inference requests are evaluated with aws:RequestedRegion set to unspecified. Your SCP must not deny that value for Amazon Bedrock, or calls to globally routed models will fail.
  • Geographic cross-Region inference requests can be processed in any Region in the profile, so every destination Region in that geography must be allowed.

​
Setup

  1. In Deductive, open Settings → Integrations.
  2. Select Model Gateway in the left sidebar.
  3. Click AWS Bedrock.
  4. Fill in the three required fields:
    • AWS Region — the region where you enabled Bedrock and requested model access (e.g. us-east-1, us-west-2).
    • AWS Access Key ID — the access key ID for your IAM user.
    • AWS Secret Access Key — the corresponding secret access key.
  5. Click Save.
Deductive saves your credentials and immediately runs validation. Results appear below the form.

​
Validating your configuration

After saving, or any time you want to confirm the gateway is working, click Validate Credentials. Deductive runs the following checks: A failed check includes the error message returned by AWS. Use that message to diagnose permission or model-access issues. Failed checks do not remove your saved credentials.

​
Removing the gateway

  1. Open Settings → Integrations → AWS Bedrock.
  2. Click Remove credentials and confirm.
All Deductive model calls will fall back to the default providers. Your credentials are permanently deleted from Deductive’s secrets store. You can re-enable the gateway at any time.

​
Troubleshooting

STS check fails — “InvalidClientTokenId” or “AuthFailure” The access key or secret is invalid or belongs to a deactivated IAM user. Double-check the values you entered, or generate a new access key in the AWS IAM console.
Bedrock: List foundation models fails The IAM user is missing the bedrock:ListFoundationModels permission, or Bedrock is not enabled in the selected region. Verify both in the AWS console.
Invoke check fails — “AccessDeniedException” for Claude models Anthropic model access has not been granted in your Bedrock account. In the Bedrock console, go to Model access and request access to the Anthropic Claude model family. Approval may take a few minutes to a few hours.
Invoke check fails — “AccessDeniedException” for GPT models OpenAI model access has not been granted. In the Bedrock console, go to Model access and request access to the OpenAI model family.
Invoke check fails with an explicit deny for a model whose ID starts with global. An SCP or IAM condition is blocking global cross-Region inference. Allow aws:RequestedRegion = unspecified for Amazon Bedrock (see Service control policies), then validate again.
All checks pass but I need to change regions The region in Deductive must match the region where you enabled Bedrock and requested model access. Deductive always sends requests to this region, though Bedrock may process some of them elsewhere (see Where requests are processed). To change, save updated credentials with the correct region.
Something else isn’t working Reach out to support@deductive.ai and include the error message from the validation results — that message comes directly from AWS and is the fastest way to diagnose the issue.

​
Field Reference

  • AWS Region (region) — the AWS region for your Bedrock endpoint (e.g. us-west-2)
  • AWS Access Key ID (accessKeyId) — the access key ID for the IAM user
  • AWS Secret Access Key (secretAccessKey) — the secret access key for the IAM user