Use AWS Bedrock

Connect Amazon Bedrock as a model provider using the server's IAM role, access keys or a Bedrock API key, and the minimum IAM policy it needs.

For: Administrators (the admin ability) · Last updated

Amazon Bedrock lets you run models such as Anthropic Claude inside your own AWS account. You add it in Settings, Administration, Model Providers like any other provider (see Adding a model provider): select Add a provider, choose the type Amazon Bedrock, then fill in Authentication, Region and, if you need it, Custom endpoint. There is no key or base URL field. You need the admin ability.

Choose how to authenticate#

The Authentication field offers three options. The first is selected by default.

Option What you provide Use it when
Use the server's IAM role Nothing is stored. The box runs on EC2 from the CloudFormation template, or otherwise has AWS credentials through the standard AWS credential chain.
Access keys Access key ID and Secret access key, and optionally a Session token (only for temporary credentials). The box has no instance role, or you want a dedicated IAM user for Workforce Intelligence.
Bedrock API key A Bedrock API key (a bearer token). You prefer a single revocable token that Bedrock issues.

Access keys and Bedrock API keys are encrypted at rest like any other provider key (see Provider keys and how they are stored). The IAM role option stores no secret at all, and the Key column shows "IAM role". Secrets are never shown again; to change them, select Edit and leave a secret field blank to keep the stored value.

Requirements for the server's IAM role#

On EC2 the instance role's credentials must be reachable from inside the app container. The template does this with an IMDS hop limit of 2 and attaches the minimum Bedrock policy below by default. If you set ImdsHopLimit=1, this option cannot work. Read Instance role, IMDS hop limit and AWS access before you rely on it: the Coworker workbench containers on the same box can obtain the same credentials, so keep the role least privilege.

Outside EC2, set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_REGION in /opt/wi/.env, then run docker compose up -d in /opt/wi. An in-app update does not re-read .env.

Region and endpoint#

Choose the Region from the dropdown, which lists the AWS regions where Bedrock is offered. Pick the one whose Bedrock endpoint holds your model access. Calls always use the region you choose, never a default, and the region appears under the provider name in the table.

If you reach Bedrock through a VPC interface endpoint, enter its address in Custom endpoint (optional). Model requests go there instead of the regional Bedrock address. It must be an https:// URL without credentials in it (a URL that embeds a user name or password is rejected).

Models and inference-profile ids#

Many current models cannot be called by their plain model id and need an inference profile. A profile id starts with a geography prefix:

  • us., eu. and apac. route across regions inside that geography.
  • global. routes across regions worldwide.

For example, us.anthropic.claude-... instead of anthropic.claude-.... The model list shows only ids you can invoke: a plain model id where Bedrock allows calling it directly, and the profile id for models that require a profile. Image, video and speech models are left out; embedding models appear marked (embed). Select Test to refresh the list. A cross-region profile runs in other regions than the one you picked, so the IAM policy and your model access must allow those destination regions too.

Cost of Bedrock models#

Each Bedrock call is priced from the product's price list, which knows the plain model ids and the us., eu., apac. and global. inference-profile ids of the models it lists. A Bedrock model id the price list does not know, such as an inference-profile ARN or a newly released model, still works, but its calls show as Unpriced in the Usage & cost view instead of a dollar amount. An admin can price such a model under Settings then Model prices (how). See How cost is calculated. Use your AWS bill for the cost of those calls.

Enable model access in AWS#

Bedrock requires you to enable access to each model in your AWS account, in the Bedrock console under model access, in each region you use. A model you have not enabled is listed but fails when called, with an access-denied message.

Minimum IAM policy#

Attach this to the instance role, IAM user or role that Workforce Intelligence authenticates as. The CloudFormation template attaches an equivalent policy to the instance role when EnableBedrockAccess is true.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeBedrockModels",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/*",
        "arn:aws:bedrock:*:<account-id>:inference-profile/*",
        "arn:aws:bedrock:*:<account-id>:application-inference-profile/*"
      ]
    },
    {
      "Sid": "ListBedrockModels",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels",
        "bedrock:ListInferenceProfiles"
      ],
      "Resource": "*"
    }
  ]
}

Replace <account-id> with your AWS account id. To narrow it, list specific model ids and regions in the first statement, keeping every destination region of any cross-region profile you use. Listing actions do not support resource restrictions.

A Bedrock API key carries its own permissions and is not covered by this policy.