AWS Bedrock access key

Use models on Amazon Bedrock through a dedicated AWS user that can do nothing else.

⏱ About 15 minutes

Amazon Bedrock offers many AI models inside your AWS account. Because AWS keys can be very powerful, this guide creates a separate user for Claspine that is only allowed to call Bedrock models. Please never use your main (root) AWS login keys for this or any other service.

Words you’ll see

IAM user: In AWS, a separate login made for one purpose, with only the permissions you give it. Your own (root) login can do everything, so it should never be handed to any service.
Policy: A short list of what a user or key is allowed to do, written as JSON. You paste the one from the guide; it allows only what Claspine needs.
Access key ID and secret access key: A pair of values that works like a username and password for programs. The ID can be shown; the secret is shown once when you create it.
Region: The part of the world where the provider runs your service, such as us-east-1 (Virginia) or europe-west4 (Netherlands). Use the region where you set things up.
Model: The specific AI you call (for example a fast, cheap one or a larger, smarter one). Claspine’s AI Gateway lets you choose models and fall back to another if one fails.

Before you start

An AWS account.
In the Amazon Bedrock console, open Model access and request access to the models you want. Some are approved instantly, others take a little while.

Steps

Open the IAM console and go to Users → Create user. Name it spine-bedrock and leave “Provide user access to the AWS Management Console” unticked.
On the permissions step choose Attach policies directly, then Create policy. A new tab opens.
In the new tab switch to JSON, delete what is there, paste the policy below, click Next, name it SpineBedrockInvoke and create it.
Back in the first tab, refresh the policy list, tick SpineBedrockInvoke and finish creating the user.
Open the new user, go to Security credentials → Create access key, choose Application running outside AWS and create it.
Copy the Access key ID and the Secret access key. The secret is shown only once.
In Claspine, open AI Gateway → Your AI provider keys → AWS Bedrock → Add key, paste both keys, type the region where you enabled models (for example us-east-1) and save.
In AI Gateway, add a step with this provider and pick one of the models listed for your region.

Permissions for the Claspine user: call Bedrock models and list them for the model picker. Nothing else in your AWS account. To narrow it further, replace "*" with the specific model ARNs you use.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels"
      ],
      "Resource": "*"
    }
  ]
}

What goes where in Claspine

Console field	Value
ACCESS KEY ID	From step 6 (starts with AKIA).
SECRET ACCESS KEY	From step 6 (shown only once).
REGION	Where you enabled model access, e.g. us-east-1.

Keep it safe

If this key ever leaks, it can only call Bedrock. Deactivate it in IAM and create a new one.
Set an AWS Budget with an email alert; Bedrock charges for every word processed.

Claspine stores the values encrypted, never shows them again in full, and never sends them to your app or SDK.

If something goes wrong

“Access denied” or the model list is empty.: Request model access in the Bedrock console for that region, and check the region in Claspine matches.

Provider documentation

Amazon Bedrock: model access

← All setup guides