> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deductive.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Bedrock

> Route Deductive AI model calls through your own AWS account using Amazon Bedrock.

Route all Deductive AI model calls through your own AWS account using Amazon Bedrock. This keeps inference traffic within your AWS environment, gives you unified cost visibility in AWS Cost Explorer, and lets you enforce your organization's data residency and access control policies.

When enabled, every model call Deductive makes is routed through Amazon Bedrock in your chosen AWS region. Deductive's default model providers are bypassed entirely.

Your AWS credentials are stored encrypted server-side and are only used to invoke models.

## Availability

The AWS Bedrock integration is available for certain Enterprise customers. Because this feature depends on your Deductive billing structure, please reach out to your account team or [support@deductive.ai](mailto:support@deductive.ai) to discuss enabling this integration.

## Prerequisites

Before configuring the gateway:

1. **Enable Amazon Bedrock in your AWS account.** Bedrock is a regional service — enable it in the specific region you plan to use. Visit the [Bedrock console](https://console.aws.amazon.com/bedrock/home) to get started.

2. **Request foundation model access.** Bedrock requires explicit opt-in for each model family. In the Bedrock console, go to **Model access** and request access to the Anthropic and OpenAI model families. See [Supported models](#supported-models) below.

3. **Create an IAM user with the required permissions.** You will need an Access Key ID and Secret Access Key. See [IAM permissions](#iam-permissions) below.

## Supported models

Deductive routes the following models through your Bedrock account:

| Deductive model   | Amazon Bedrock model ID                    |
| ----------------- | ------------------------------------------ |
| Claude 4.6 Sonnet | `anthropic.claude-sonnet-4-6`              |
| Claude 4.5 Haiku  | `anthropic.claude-haiku-4-5-20251001-v1:0` |
| GPT-OSS 120B      | `openai.gpt-oss-120b-1:0`                  |
| GPT-5.4           | `openai.gpt-5.4`                           |

You must request model access for each provider family (Anthropic and OpenAI) separately in the Bedrock console. If a provider's models are not enabled, validation will flag an error for those models but other enabled models will continue to work.

Not every Bedrock region hosts every model. Check [Bedrock model availability by region](https://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-regions.html) to confirm your chosen region supports the models we need.

## IAM permissions

Attach the following policy to the IAM user whose credentials you will enter in Deductive:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "StsVerify",
      "Effect": "Allow",
      "Action": "sts:GetCallerIdentity",
      "Resource": "*"
    },
    {
      "Sid": "BedrockListModels",
      "Effect": "Allow",
      "Action": "bedrock:ListFoundationModels",
      "Resource": "*"
    },
    {
      "Sid": "BedrockInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:Converse",
        "bedrock:ConverseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/*",
        "arn:aws:bedrock:*:*:inference-profile/*"
      ]
    },
    {
      "Sid": "BedrockMantleInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock-mantle:CreateInference",
        "bedrock-mantle:GetProject",
        "bedrock-mantle:ListProjects",
        "bedrock-mantle:GetModel",
        "bedrock-mantle:ListModels"
      ],
      "Resource": "arn:aws:bedrock-mantle:*:*:project/*"
    },
    {
      "Sid": "BedrockMantleBearerToken",
      "Effect": "Allow",
      "Action": "bedrock-mantle:CallWithBearerToken",
      "Resource": "*"
    }
  ]
}
```

Once you attach this policy, generate an **Access Key ID** and **Secret Access Key** for that user. Those are the two credential values you will enter in Deductive.

## Setup

1. In Deductive, open **Settings → Integrations**.
2. Select **Model Gateway** in the left sidebar.
3. Click **AWS Bedrock**.
4. Fill in the three required fields:
   * **AWS Region** — the region where you enabled Bedrock and requested model access (e.g. `us-east-1`, `us-west-2`).
   * **AWS Access Key ID** — the access key ID for your IAM user.
   * **AWS Secret Access Key** — the corresponding secret access key.
5. Click **Save**.

Deductive saves your credentials and immediately runs validation. Results appear below the form.

## Validating your configuration

After saving, or any time you want to confirm the gateway is working, click **Validate Credentials**. Deductive runs the following checks:

| Check                               | What it confirms                                                                 |
| ----------------------------------- | -------------------------------------------------------------------------------- |
| **STS: Verify AWS credentials**     | The access key and secret are valid and can authenticate with AWS.               |
| **Bedrock: List foundation models** | The IAM user has `bedrock:ListFoundationModels` access in the configured region. |
| **Bedrock: Invoke `<model>`**       | Each supported model can be invoked end-to-end from your account.                |

A failed check includes the error message returned by AWS. Use that message to diagnose permission or model-access issues. Failed checks do not remove your saved credentials.

## Removing the gateway

1. Open **Settings → Integrations → AWS Bedrock**.
2. Click **Remove credentials** and confirm.

All Deductive model calls will fall back to the default providers. Your credentials are permanently deleted from Deductive's secrets store. You can re-enable the gateway at any time.

## Troubleshooting

**STS check fails — "InvalidClientTokenId" or "AuthFailure"**

The access key or secret is invalid or belongs to a deactivated IAM user. Double-check the values you entered, or generate a new access key in the [AWS IAM console](https://console.aws.amazon.com/iam/home).

***

**Bedrock: List foundation models fails**

The IAM user is missing the `bedrock:ListFoundationModels` permission, or Bedrock is not enabled in the selected region. Verify both in the AWS console.

***

**Invoke check fails — "AccessDeniedException" for Claude models**

Anthropic model access has not been granted in your Bedrock account. In the Bedrock console, go to **Model access** and request access to the **Anthropic** Claude model family. Approval may take a few minutes to a few hours.

***

**Invoke check fails — "AccessDeniedException" for GPT models**

OpenAI model access has not been granted. In the Bedrock console, go to **Model access** and request access to the **OpenAI** model family.

***

**All checks pass but I need to change regions**

The region in Deductive must match the region where you enabled Bedrock and requested model access. The gateway does not cross regions. To change, save updated credentials with the correct region.

***

**Something else isn't working**

Reach out to [support@deductive.ai](mailto:support@deductive.ai) and include the error message from the validation results — that message comes directly from AWS and is the fastest way to diagnose the issue.

## Field Reference

* **AWS Region** (`region`) — the AWS region for your Bedrock endpoint (e.g. `us-west-2`)
* **AWS Access Key ID** (`accessKeyId`) — the access key ID for the IAM user
* **AWS Secret Access Key** (`secretAccessKey`) — the secret access key for the IAM user