> ## Documentation Index
> Fetch the complete documentation index at: https://gomodel-docs-benchmark-writeup-and-tooling.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Bedrock

> Configure Amazon Bedrock in GoModel using AWS credentials and the Bedrock Runtime Converse API.

GoModel routes Bedrock requests through the Bedrock Runtime Converse and
ConverseStream APIs, normalizing responses across model families (Anthropic,
Amazon Nova, Meta Llama, Mistral, Cohere, AI21, and others) into
OpenAI-compatible chat completions.

Bedrock has no API key of its own — GoModel resolves AWS credentials at runtime
through the standard AWS credential chain (env, `AWS_PROFILE`, IAM Identity
Center, instance/container roles).

## Configure

```bash theme={null}
BEDROCK_BASE_URL=us-east-1   # region (recommended) or full Bedrock endpoint URL
AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...
# AWS_SESSION_TOKEN=...      # only for temporary credentials
GOMODEL_MASTER_KEY=change-me
```

In production, prefer instance roles, IRSA, or IAM Identity Center over
long-lived access keys. When `BEDROCK_BASE_URL` is empty, GoModel falls back to
`AWS_REGION` / `AWS_DEFAULT_REGION`.

## Run GoModel

<CodeGroup>
  ```bash Docker (.env file) theme={null}
  docker run --rm -p 8080:8080 --env-file .env enterpilot/gomodel
  ```

  ```bash Docker (inline -e) theme={null}
  docker run --rm -p 8080:8080 \
    -e GOMODEL_MASTER_KEY="change-me" \
    -e BEDROCK_BASE_URL="us-east-1" \
    -e AWS_ACCESS_KEY_ID="..." \
    -e AWS_SECRET_ACCESS_KEY="..." \
    enterpilot/gomodel
  ```

  ```bash Binary (make build) theme={null}
  make build
  ./bin/gomodel
  ```
</CodeGroup>

## Verify

```bash theme={null}
curl -s http://localhost:8080/v1/chat/completions \
  -H "Authorization: Bearer $GOMODEL_MASTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "anthropic.claude-3-5-haiku-20241022-v1:0",
    "messages": [{"role": "user", "content": "Reply with the single word ok."}],
    "max_tokens": 80
  }'
```

`GET /v1/models` returns Bedrock models with `owned_by` set to the originating
vendor (e.g. `anthropic`, `amazon`). Streaming (`stream: true`) and the
Responses API are bridged onto Converse internally.

## Restrict or extend the model list

By default GoModel queries Bedrock's control plane and lists all on-demand
text models the account has access to. To pin inference profile IDs or custom
model ARNs:

```bash theme={null}
BEDROCK_MODELS=anthropic.claude-3-5-haiku-20241022-v1:0,amazon.nova-lite-v1:0
```

Or in `config.yaml`:

```yaml theme={null}
providers:
  bedrock:
    type: bedrock
    base_url: "us-east-1"
    models:
      - anthropic.claude-3-5-haiku-20241022-v1:0
      - amazon.nova-lite-v1:0
```

Behavior follows the global `CONFIGURED_PROVIDER_MODELS_MODE` — `fallback`
(default) uses the list only when `ListFoundationModels` is unavailable or
empty; `allowlist` exposes only configured models and skips the upstream call.

## Multiple Bedrock providers

Use suffixed env vars to register separate Bedrock instances:

```bash theme={null}
BEDROCK_US_BASE_URL=us-east-1
BEDROCK_US_MODELS=anthropic.claude-3-5-haiku-20241022-v1:0

BEDROCK_EU_BASE_URL=eu-west-1
BEDROCK_EU_MODELS=amazon.nova-lite-v1:0
```

This registers providers `bedrock-us` and `bedrock-eu`. Bedrock credentials
still come from the standard AWS credential chain.

## Not yet integrated

* Bedrock embeddings — the `InvokeModel` embedding path is model-specific and
  not wired up.

## Troubleshooting

* **`AccessDeniedException` / `403`** — the AWS principal lacks Bedrock
  permissions, or model access has not been granted in the Bedrock console.
* **`on-demand throughput isn't supported`** — the model requires an inference
  profile or provisioned throughput. Set `BEDROCK_MODELS` to the inference
  profile ID.
* **`model registry has no models`** — region has no on-demand text models, or
  the control-plane call failed. Set `BEDROCK_MODELS` or check IAM.
* **Wrong region inferred** — pass `BEDROCK_BASE_URL` explicitly. With a full
  endpoint URL, GoModel only extracts the region segment when the host ends in
  `.amazonaws.com`; custom endpoints should pair with `AWS_REGION`.

## References

* [Bedrock Runtime Converse API](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Converse.html)
* [Model access in the Bedrock console](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html)
* [AWS credential chain](https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html)