Skip to main content

Provision AWS Bedrock models

This guide covers configuring AWS Bedrock as an AI model provider in Tetrate Agent Router.

The procedure covers:

  • Configuring the AWS Bedrock API endpoint
  • Setting authentication credentials
  • Defining the AWS region
  • Enabling or disabling the provider
  • Marking the provider as a first-party provider

Plan for 5--10 minutes, plus any AWS IAM setup if credentials do not already exist.

Bedrock supports two authentication modes:

  • Static keys — an AWS access key pair stored as the provider secret.
  • Workload identity (no static keys) — for a self-hosted data plane on AWS EKS whose pod IAM identity has been bound with tare dataplane identity bind; the provider is created credential-less. See Bedrock access with workload identity.

Prerequisites​

  • Administrator access to the Admin Dashboard, typically the super_admin or billing_admin role.
  • One of:
    • Static keys: a valid AWS access key pair (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) with permission to access AWS Bedrock, or
    • Workload identity: a data plane on EKS already bound to an IAM role per Bedrock access with workload identity.

Configuration guide​

Step 1: Add provider​

  1. Log in to the Admin Dashboard.
  2. In the left-hand navigation panel, select Catalog → Providers.
  3. Click + Add provider.

Step 2: Configure provider details​

  • Provider identifier (required): must be all lower-case and start with a letter. Example: my-aws-bedrock.
  • Display name (optional): a recognizable label. Example: AWS Bedrock BYOK.

Step 3: Configure authentication method​

  • Auth method (required): select AWS from the drop-down.
  • API base URL (required): https://bedrock-runtime.<region>.amazonaws.com. The form pre-fills this from the selected region and keeps it in sync when the region changes; only edit it deliberately. It must not be left empty.

Step 4: Set the AWS region​

  • Region (required): set to the AWS region used in the base URL. The region must match both the Bedrock deployment region and the region in the base URL.

Step 5: Provide authentication credentials​

Choose one of the two authentication modes:

Static keys:

  • Provider secret: provide AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the corresponding fields. Both values are required together.
  • The credentials must have permission to access AWS Bedrock.
  • Use the Rotate button to update credentials later.

Workload identity (no static keys):

  • Turn on Use IRSA / EKS Pod Identity (no static keys). The AWS key fields are hidden and the provider is created without a secret; the data plane authenticates to Bedrock with its pod IAM role.
  • This mode requires the data plane's identity to be bound first — see Bedrock access with workload identity.
  • The toggle is available when creating a provider. To switch an existing static-key provider to workload identity, create a new provider with the toggle on.

Step 6: Enable the provider​

  • First-party provider (optional): toggle on to give the provider first-party visibility in dashboard listings and search results.
  • Enable provider (required to use the configuration): toggle on. This controls whether the provider is available for use.

Step 7: Save the configuration​

  • Click Add provider.

Example configuration​

With static keys:

Display Name: AWS Bedrock

API Base URL:
https://bedrock-runtime.us-east-1.amazonaws.com

Auth Method:
AWS

Region:
us-east-1

AWS_ACCESS_KEY_ID:
<your-access-key>

AWS_SECRET_ACCESS_KEY:
<your-secret-key>

First-Party Provider:
Enabled

Enable Provider:
Enabled

With workload identity:

Display Name: AWS Bedrock

API Base URL:
https://bedrock-runtime.us-east-1.amazonaws.com

Auth Method:
AWS

Region:
us-east-1

Use IRSA / EKS Pod Identity (no static keys):
Enabled

First-Party Provider:
Enabled

Enable Provider:
Enabled

AWS account requirements​

Before the configuration is saved, confirm the following:

  • AWS Bedrock is enabled in the AWS account.
  • The selected region supports the required Bedrock models.
  • The IAM identity used — the static-key credentials, or the IAM role bound to the data plane — carries permissions such as:
{
 "Effect": "Allow",
 "Action": [
   "bedrock:InvokeModel",
   "bedrock:InvokeModelWithResponseStream"
 ],
 "Resource": "*"
}
  • The API base URL and region match.

Conclusion​

Once configured and saved, Agent Router can authenticate with AWS Bedrock and route model requests through the specified endpoint.

Where to go next

Bedrock access with workload identity

Bind the EKS data plane's pod IAM identity so Bedrock needs no static keys.

Connect provider subscriptions across clouds

Represent Bedrock subscriptions in several regions as independent provider entries.