> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deductive.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Bedrock

> Route Deductive AI model calls through your own AWS account using Amazon Bedrock.

Route all Deductive AI model calls through your own AWS account using Amazon Bedrock. This keeps inference traffic within your AWS account, gives you unified cost visibility in AWS Cost Explorer, and lets you enforce your organization's access control policies.

When enabled, every model call Deductive makes is sent to Amazon Bedrock in your chosen AWS region. Deductive's default model providers are bypassed entirely. Depending on the model, Bedrock may process a request in a different AWS Region. See [Where requests are processed](#where-requests-are-processed).

Your AWS credentials are stored encrypted server-side and are only used to invoke models.

## Availability

The AWS Bedrock integration is available for certain Enterprise customers. Because this feature depends on your Deductive billing structure, please reach out to your account team or [support@deductive.ai](mailto:support@deductive.ai) to discuss enabling this integration.

## Prerequisites

Before configuring the gateway:

1. **Enable Amazon Bedrock in your AWS account.** Bedrock is a regional service — enable it in the specific region you plan to use. Visit the [Bedrock console](https://console.aws.amazon.com/bedrock/home) to get started.

2. **Request foundation model access.** Bedrock requires explicit opt-in for each model family. In the Bedrock console, go to **Model access** and request access to the Anthropic and OpenAI model families. See [Models](#models) below.

3. **Create an IAM user with the required permissions.** You will need an Access Key ID and Secret Access Key. See [IAM permissions](#iam-permissions) below.

## Models

Deductive uses models from the **Anthropic (Claude)** and **OpenAI (GPT)** families on Bedrock, and updates them as newer versions become available. To see the exact models Deductive currently uses, click **Validate Credentials** (see [Validating your configuration](#validating-your-configuration)). Each model gets its own **Bedrock: Invoke** check, labeled with the exact Amazon Bedrock model ID.

You must request model access for each provider family (Anthropic and OpenAI) separately in the Bedrock console. If a provider's models are not enabled, validation will flag an error for those models but other enabled models will continue to work.

Not every Bedrock region hosts every model. Check [Bedrock model availability by region](https://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-regions.html) to confirm your chosen region supports the models we need.

## Where requests are processed

Deductive always sends requests to Bedrock in the region you configure. For each model, Deductive uses whichever of the following routes Bedrock offers for it, and the model ID prefix shown in validation tells you which one:

| Route | Model ID prefix | Where Bedrock may process the request |
| - | - | - |
| In-Region | none (e.g. `openai.…`) | Your configured region only |
| Geographic cross-Region inference | `us.`, `eu.`, `apac.` | Any AWS Region within that geography |
| Global cross-Region inference | `global.` | Any supported AWS commercial Region worldwide |

Some models are only offered through global cross-Region inference. If your organization requires model inference to stay within a specific geography, contact your account team before enabling the gateway. See [Amazon Bedrock cross-Region inference](https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html) for details.

## IAM permissions

Attach the following policy to the IAM user whose credentials you will enter in Deductive:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "StsVerify",
      "Effect": "Allow",
      "Action": "sts:GetCallerIdentity",
      "Resource": "*"
    },
    {
      "Sid": "BedrockListModels",
      "Effect": "Allow",
      "Action": "bedrock:ListFoundationModels",
      "Resource": "*"
    },
    {
      "Sid": "BedrockInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:Converse",
        "bedrock:ConverseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/*",
        "arn:aws:bedrock:*:*:inference-profile/*"
      ]
    },
    {
      "Sid": "BedrockMantleInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock-mantle:CreateInference",
        "bedrock-mantle:GetProject",
        "bedrock-mantle:ListProjects",
        "bedrock-mantle:GetModel",
        "bedrock-mantle:ListModels"
      ],
      "Resource": "arn:aws:bedrock-mantle:*:*:project/*"
    },
    {
      "Sid": "BedrockMantleBearerToken",
      "Effect": "Allow",
      "Action": "bedrock-mantle:CallWithBearerToken",
      "Resource": "*"
    }
  ]
}
```

The `*` region wildcard in the `BedrockInvoke` resources also matches the region-less model ARN (`arn:aws:bedrock:::foundation-model/…`) that global cross-Region inference uses. If you scope this policy more tightly, keep both the inference profile and the region-less model ARN allowed, and do not restrict `aws:RequestedRegion` to exclude `unspecified`. See [Global cross-Region inference](https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html) for AWS's reference policy.

Once you attach this policy, generate an **Access Key ID** and **Secret Access Key** for that user. Those are the two credential values you will enter in Deductive.

### Service control policies (SCPs)

If your AWS Organization uses SCPs to deny requests outside approved Regions:

* **Global cross-Region inference** requests are evaluated with `aws:RequestedRegion` set to `unspecified`. Your SCP must not deny that value for Amazon Bedrock, or calls to globally routed models will fail.
* **Geographic cross-Region inference** requests can be processed in any Region in the profile, so every destination Region in that geography must be allowed.

## Setup

1. In Deductive, open **Settings → Integrations**.
2. Select **Model Gateway** in the left sidebar.
3. Click **AWS Bedrock**.
4. Fill in the three required fields:
   * **AWS Region** — the region where you enabled Bedrock and requested model access (e.g. `us-east-1`, `us-west-2`).
   * **AWS Access Key ID** — the access key ID for your IAM user.
   * **AWS Secret Access Key** — the corresponding secret access key.
5. Click **Save**.

Deductive saves your credentials and immediately runs validation. Results appear below the form.

## Validating your configuration

After saving, or any time you want to confirm the gateway is working, click **Validate Credentials**. Deductive runs the following checks:

| Check | What it confirms |
| - | - |
| **STS: Verify AWS credentials** | The access key and secret are valid and can authenticate with AWS. |
| **Bedrock: List foundation models** | The IAM user has `bedrock:ListFoundationModels` access in the configured region. |
| **Bedrock: Invoke `<Bedrock model ID>`** | Each supported model can be invoked end-to-end from your account. |

A failed check includes the error message returned by AWS. Use that message to diagnose permission or model-access issues. Failed checks do not remove your saved credentials.

## Removing the gateway

1. Open **Settings → Integrations → AWS Bedrock**.
2. Click **Remove credentials** and confirm.

All Deductive model calls will fall back to the default providers. Your credentials are permanently deleted from Deductive's secrets store. You can re-enable the gateway at any time.

## Troubleshooting

**STS check fails — "InvalidClientTokenId" or "AuthFailure"**

The access key or secret is invalid or belongs to a deactivated IAM user. Double-check the values you entered, or generate a new access key in the [AWS IAM console](https://console.aws.amazon.com/iam/home).

***

**Bedrock: List foundation models fails**

The IAM user is missing the `bedrock:ListFoundationModels` permission, or Bedrock is not enabled in the selected region. Verify both in the AWS console.

***

**Invoke check fails — "AccessDeniedException" for Claude models**

Anthropic model access has not been granted in your Bedrock account. In the Bedrock console, go to **Model access** and request access to the **Anthropic** Claude model family. Approval may take a few minutes to a few hours.

***

**Invoke check fails — "AccessDeniedException" for GPT models**

OpenAI model access has not been granted. In the Bedrock console, go to **Model access** and request access to the **OpenAI** model family.

***

**Invoke check fails with an explicit deny for a model whose ID starts with `global.`**

An SCP or IAM condition is blocking global cross-Region inference. Allow `aws:RequestedRegion` = `unspecified` for Amazon Bedrock (see [Service control policies](#service-control-policies-scps)), then validate again.

***

**All checks pass but I need to change regions**

The region in Deductive must match the region where you enabled Bedrock and requested model access. Deductive always sends requests to this region, though Bedrock may process some of them elsewhere (see [Where requests are processed](#where-requests-are-processed)). To change, save updated credentials with the correct region.

***

**Something else isn't working**

Reach out to [support@deductive.ai](mailto:support@deductive.ai) and include the error message from the validation results — that message comes directly from AWS and is the fastest way to diagnose the issue.

## Field Reference

* **AWS Region** (`region`) — the AWS region for your Bedrock endpoint (e.g. `us-west-2`)
* **AWS Access Key ID** (`accessKeyId`) — the access key ID for the IAM user
* **AWS Secret Access Key** (`secretAccessKey`) — the secret access key for the IAM user


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.