> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Bedrock

> Connect Amazon Bedrock to Toqan Router's AI Gateway. Configure your AWS access key, secret, and region to route Bedrock model requests with observability.

See [HTTP URLs and authentication](/docs/reference/base-urls.md) and the API reference for complete request and response formats.

* **Name**: Can be anything. Example: `toqan_bedrock`
* **Access key id**: Retrieve this from your IAM in AWS.
* **Secret access key**: Also retrieve this from your IAM in AWS.
* **Region**: Make sure that you select the right region. Example: us-east-1

## Retrieve access keys in AWS

## Policies / Permissions in AWS

In order for the model to work, make sure that the following two permissions are included in the policy which is attached to the user in AWS.

1. Bedrock: InvokeModel
2. Bedrock: InvokeModelWithResponseStream

## IAM role

The **AI Studio** exposes the **Pod Identity (On-Premise)** auth mode on on-premise deployments only. A Bedrock model on such a deployment can authenticate with an IAM role instead of an access key and secret, so no long-lived AWS credentials are stored with the model.

In the **AI Gateway** sidebar, open **Models**, select  **Model**, and choose **AWS Bedrock**. Set **Auth Mode** to **Pod Identity (On-Premise)**, which sends `auth_mode: "pod-identity"` in the API.

Credentials then come from the AWS default credential chain of the deployment: the role attached to the gateway through EKS Pod Identity or IAM Roles for Service Accounts (IRSA), or the instance metadata service.

### Assume a role in another account

Set **Assume Role ARN** to have **Toqan Router** assume a role in a different AWS account. The optional **External ID** acts as a shared secret that the target role's trust policy requires before it grants access.

| Field | Required | Description |
| - | - | - |
| **Auth Mode** (`auth_mode`) | Yes | `pod-identity`. Uses the deployment's own AWS identity instead of a stored AWS integration. |
| **Assume Role ARN** (`assume_role_arn`) | No | ARN of the IAM role to assume in the target account, such as `arn:aws:iam::123456789012:role/bedrock-access-role`. |
| **External ID** (`assume_role_external_id`) | No | Sent as the `ExternalId` of the `sts:AssumeRole` call, with no value added by **Toqan Router**. The target role's trust policy must require the same value. Shown once an Assume Role ARN is set. |

The assumed role needs the Bedrock permissions listed above. Without an Assume Role ARN, requests sign with the credentials the deployment resolves from its environment.

### Trust policy on the target role

The target role's trust policy must allow the identity the deployment runs as, and that identity needs `sts:AssumeRole` permission on the target role.

```json JSON theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<deployment_account_id>:role/<deployment_role_name>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

Replace `<deployment_account_id>` and `<deployment_role_name>` with that identity, which `aws sts get-caller-identity` reports from inside the deployment. When an External ID is set, add `"Condition": { "StringEquals": { "sts:ExternalId": "<external_id>" } }` to the statement.

***

## Custom models via inference profile

A Bedrock custom model is added by inference-profile ARN. Both profile types are accepted:

| Type | ARN |
| - | - |
| System-defined | `arn:aws:bedrock:<region>:<account-id>:inference-profile/<profile-id>` |
| Application | `arn:aws:bedrock:<region>:<account-id>:application-inference-profile/<profile-id>` |

A prefix such as `eu.` in a system-defined profile id is the geography AWS routes requests through. An application profile carries no prefix. The EU Claude Sonnet 4.5 profile, with an example account id:

```text theme={"theme":{"light":"github-light","dark":"github-dark"}}
arn:aws:bedrock:eu-west-3:123456789012:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0
```

Validation asks AWS to resolve the model behind the ARN, so the AWS user needs `bedrock:GetInferenceProfile` alongside the two invoke permissions above.

Without that permission, a chat model still validates and reports its type as chat; the developer and prices stay empty. An embedding profile fails validation.

A cross-region profile sends requests to the other regions in its geography. Allow the invoke actions on the foundation models there too.

### Add the profile in the console

**1. Enter the profile**

In **Models**, click <kbd> Model</kbd> and choose **AWS Bedrock**. Set **Auth Mode** to **AWS Integration**, select the AWS integration, and paste the **Inference Profile ARN**. The **Region** fills from the ARN.

**2. Validate the connection**

Click **Validate Connection**. The gateway resolves the foundation model and fills the model type, developer, capabilities and prices it knows for it.

**3. Name the model**

Set the **Model slug** and a **Display name**. The slug completes the model id the gateway accepts: `<workspace>@aws/<slug>`. See [Referencing Private Models in Code](/docs/ai-gateway/using-the-router.md#referencing-private-models-in-code).

### Add the profile through the API

`model_id` is the slug, and the ARN goes in `configuration.model_id`:

```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl --request POST \
  --url https://router.toqan.ai/eu/v2/models/aws-bedrock \
  --header "Authorization: Bearer $TOQAN_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
  "display_name": "Claude Sonnet 4.5 EU",
  "model_id": "claude-sonnet-4-5-eu",
  "configuration": {
    "model_id": "arn:aws:bedrock:eu-west-3:123456789012:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0"
  },
  "region": "eu-west-3",
  "model_developer": "anthropic",
  "auth_mode": "integration",
  "integration_id": "<integration_id>"
}'
```

The model is then callable as `<workspace>@aws/claude-sonnet-4-5-eu`. Field reference: [Create an AWS Bedrock custom model](/docs/reference/models/create-aws-bedrock-custom-model.md).

This endpoint stores what the body carries: it detects no type, capability or price, so send `model_type`, the capability flags and the per-token `input_cost` / `output_cost`, or run [validation](/docs/reference/models/validate-aws-bedrock-inference-profile.md) first to read the type, developer and capabilities to carry into the body. `region` must be the region in the ARN, and `integration_id` is the id of the AWS integration in the workspace.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.