> ## Documentation Index
> Fetch the complete documentation index at: https://docs.4minds.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Bedrock

This guide walks you through connecting your AWS account to 4MINDS so you can use Amazon Bedrock foundation models. There are three connection methods available:

1. **IAM Role Federation** *(recommended)*: no credentials stored; temporary STS credentials minted per request
2. **Bedrock API Key**: simplest setup, generated directly in the Bedrock console
3. **Amazon Cognito**: use if your organization already manages AWS access through Cognito

Methods 1 and 3 share AWS setup with every other 4MINDS AWS integration (S3, SageMaker, Lake Formation). The steps below focus on what's **specific to Bedrock**; for the generic role/Cognito setup, see [AWS Integrations](/aws-integrations).

## Provider prerequisites

Before connecting Bedrock to 4MINDS, complete the following in your AWS account:

* Request access to the foundation models you want to use in **Amazon Bedrock → Model access**.
* Wait for each model's status to show **Access granted**. Some models require AWS approval and may not be available immediately.
* Confirm your IAM role (or Bedrock API key) has `bedrock:InvokeModel` permission for the granted models. This is covered by the [Bedrock IAM Permissions Policy](#bedrock-iam-permissions-policy) below.

See AWS's [Manage access to Amazon Bedrock foundation models](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html) for the full process.

***

## Bedrock IAM Permissions Policy

Whichever IAM-based method you pick (IAM Role Federation or Cognito), you'll attach this policy to the role:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockFoundationModelAccess",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels",
        "bedrock:GetFoundationModel",
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BedrockCustomModelAccess",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListCustomModels",
        "bedrock:GetCustomModel"
      ],
      "Resource": "*"
    },
    {
      "Sid": "IdentityVerification",
      "Effect": "Allow",
      "Action": "sts:GetCallerIdentity",
      "Resource": "*"
    }
  ]
}
```

**What each permission does:**

| Permission | Purpose |
| - | - |
| `bedrock:ListFoundationModels` | Lists available foundation models (Claude, Llama, Mistral, etc.) |
| `bedrock:GetFoundationModel` | Retrieves details about a specific foundation model |
| `bedrock:InvokeModel` | Sends prompts and receives responses from models |
| `bedrock:InvokeModelWithResponseStream` | Enables streaming responses for real-time output |
| `bedrock:ListCustomModels` | Lists custom fine-tuned models in your account |
| `bedrock:GetCustomModel` | Retrieves details about a specific custom model |
| `sts:GetCallerIdentity` | Verifies the connection is authenticated correctly |

Name the policy something memorable like `4MINDS-Bedrock-Access`. You'll reference it when attaching permissions in the role/Cognito setup.

### Least-Privilege: Restricting to Specific Models

The policy above uses `"Resource": "*"` for broad access. To scope to specific regions or models:

**Restrict to a single region:**

```text theme={null}
arn:aws:bedrock:us-east-1::foundation-model/*
```

**Restrict to specific models:**

```json theme={null}
"Resource": [
  "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-sonnet-20240229-v1:0",
  "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-haiku-20240307-v1:0",
  "arn:aws:bedrock:us-east-1::foundation-model/meta.llama3-70b-instruct-v1:0"
]
```

The ARN format is: `arn:aws:bedrock:<region>::foundation-model/<model-id>`

> **Note:** `ListFoundationModels` and `ListCustomModels` still require `"Resource": "*"`. Split these into a separate statement if you scope `InvokeModel` to specific model ARNs.

***

## Connection Methods

### Method 1: IAM Role Federation (Recommended)

Follow the full role federation setup in **[AWS Integrations → IAM Role Federation](/aws-integrations#connection-method-1-iam-role-federation-recommended)**. Attach the `4MINDS-Bedrock-Access` policy (from [above](#bedrock-iam-permissions-policy)) when creating the IAM role.

Then, in 4MINDS:

1. Open **Integrations** from the main navigation bar and select **Amazon Bedrock**
2. Select the **IAM Role** tab
3. Paste your **IAM Role ARN**
4. Leave the **External ID** field blank. It is not supported for IAM Role Federation (see [AWS Integrations → Verify the Trust Policy](/aws-integrations#c-verify-the-trust-policy))
5. Enter your **AWS Region** (must match the region where you've enabled Bedrock model access)
6. Click **Test Connection**, then **Save Credentials**

***

### Method 2: Bedrock API Key

The simplest setup: generate an API key directly from the Bedrock console. No IAM role or Cognito pool needed.

#### AWS Setup

1. Go to **AWS Console → Amazon Bedrock**
2. In the left sidebar, click **API keys**
3. Choose your key type:
   * **Short-term API key** (recommended for production): expires when your console session expires (12 hours). Click **Generate short-term API keys**
   * **Long-term API key**: can last longer than 12 hours. Click **Long-term API keys**, configure expiration, and generate
4. **Copy the API key** once generated

> **Note:** Short-term keys require regenerating and updating your 4MINDS connection when they expire. For a set-it-and-forget-it setup, use IAM Role Federation (Method 1).

#### Connect in 4MINDS

1. Open **Integrations** and select **Amazon Bedrock**
2. Select the **API Key** tab
3. Paste the **Bedrock API key**
4. Enter your **AWS Region**
5. Click **Test Connection**, then **Save Credentials**

> **Security note:** API keys are encrypted at rest. For production environments requiring maximum security, prefer IAM Role Federation (Method 1). It stores nothing long-lived.

***

### Method 3: Amazon Cognito

Follow the full Cognito setup in **[AWS Integrations → Amazon Cognito](/aws-integrations#connection-method-2-amazon-cognito)**. Attach the `4MINDS-Bedrock-Access` policy (from [above](#bedrock-iam-permissions-policy)) to the Cognito authenticated role.

Then, in 4MINDS:

1. Open **Integrations** and select **Amazon Bedrock**
2. Select the **Cognito** tab
3. Fill in the Cognito fields (User Pool ID, App Client ID, App Client Secret if used, Identity Pool ID, Username, Password)
4. Enter your **AWS Region** (must match your User Pool and Identity Pool region)
5. Click **Test Connection**, then **Save Credentials**

***

## After Connecting: Adding Models

Once connected:

1. Open **Integrations** and select **Amazon Bedrock**
2. Browse the list of available foundation models. All supported models appear automatically
3. Click to register models you want to use in your workspace
4. Registered models appear in your model selector for conversations

***

## Supported AWS Regions

Amazon Bedrock is available in select regions. Common options:

* `us-east-1` (N. Virginia)
* `us-east-2` (Ohio)
* `us-west-2` (Oregon)
* `eu-west-1` (Ireland)
* `eu-central-1` (Frankfurt)
* `ap-southeast-1` (Singapore)
* `ap-northeast-1` (Tokyo)

Check the [AWS Regional Services List](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/) for current availability.

***

## Troubleshooting

| Issue | Solution |
| - | - |
| "No models found" | Verify the region is correct and that your IAM policy includes `bedrock:ListFoundationModels` |
| Connection times out | Verify the region is correct and Bedrock is enabled there |
| "Access Denied" | Confirm the [IAM policy](#bedrock-iam-permissions-policy) is attached to the correct identity |
| "Unrecognized client" | Wrong region, or Bedrock isn't enabled in that region |
| API key expired | Generate a new short-term key or use a long-term key / IAM Role Federation |

For method-specific issues (OIDC trust policy, Cognito password states, etc.), see [AWS Integrations → Troubleshooting](/aws-integrations#troubleshooting).

***

## Disconnecting

1. Open **Integrations** and select **Amazon Bedrock**
2. Click **Disconnect**

This removes stored credentials from 4MINDS. Your AWS resources are not affected.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.