> ## Documentation Index
> Fetch the complete documentation index at: https://docs.4minds.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Bedrock

This guide walks you through connecting your AWS account to 4MINDS so you can use Amazon Bedrock foundation models. There are three connection methods available:

1. **IAM Role Federation** *(recommended)* — no credentials stored; temporary STS credentials minted per request
2. **Bedrock API Key** — simplest setup, generated directly in the Bedrock console
3. **Amazon Cognito** — use if your organization already manages AWS access through Cognito

Methods 1 and 3 share AWS setup with every other 4MINDS AWS integration (S3, SageMaker, Lake Formation). The steps below focus on what's **specific to Bedrock**; for the generic role/Cognito setup, see [AWS Integrations](/aws-integrations).

## Provider prerequisites

Before connecting Bedrock to 4MINDS, complete the following in your AWS account:

* Request access to the foundation models you want to use in **Amazon Bedrock → Model access**.
* Wait for each model's status to show **Access granted**. Some models require AWS approval and may not be available immediately.
* Confirm your IAM role (or Bedrock API key) has `bedrock:InvokeModel` permission for the granted models — this is covered by the [Bedrock IAM Permissions Policy](#bedrock-iam-permissions-policy) below.

See AWS's [Manage access to Amazon Bedrock foundation models](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html) for the full process.

***

## Bedrock IAM Permissions Policy

Whichever IAM-based method you pick (IAM Role Federation or Cognito), you'll attach this policy to the role:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockFoundationModelAccess",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels",
        "bedrock:GetFoundationModel",
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BedrockCustomModelAccess",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListCustomModels",
        "bedrock:GetCustomModel"
      ],
      "Resource": "*"
    },
    {
      "Sid": "IdentityVerification",
      "Effect": "Allow",
      "Action": "sts:GetCallerIdentity",
      "Resource": "*"
    }
  ]
}
```

**What each permission does:**

| Permission                              | Purpose                                                          |
| --------------------------------------- | ---------------------------------------------------------------- |
| `bedrock:ListFoundationModels`          | Lists available foundation models (Claude, Llama, Mistral, etc.) |
| `bedrock:GetFoundationModel`            | Retrieves details about a specific foundation model              |
| `bedrock:InvokeModel`                   | Sends prompts and receives responses from models                 |
| `bedrock:InvokeModelWithResponseStream` | Enables streaming responses for real-time output                 |
| `bedrock:ListCustomModels`              | Lists custom fine-tuned models in your account                   |
| `bedrock:GetCustomModel`                | Retrieves details about a specific custom model                  |
| `sts:GetCallerIdentity`                 | Verifies the connection is authenticated correctly               |

Name the policy something memorable like `4MINDS-Bedrock-Access` — you'll reference it when attaching permissions in the role/Cognito setup.

### Least-Privilege: Restricting to Specific Models

The policy above uses `"Resource": "*"` for broad access. To scope to specific regions or models:

**Restrict to a single region:**

```text theme={null}
arn:aws:bedrock:us-east-1::foundation-model/*
```

**Restrict to specific models:**

```json theme={null}
"Resource": [
  "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-sonnet-20240229-v1:0",
  "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-haiku-20240307-v1:0",
  "arn:aws:bedrock:us-east-1::foundation-model/meta.llama3-70b-instruct-v1:0"
]
```

The ARN format is: `arn:aws:bedrock:<region>::foundation-model/<model-id>`

> **Note:** `ListFoundationModels` and `ListCustomModels` still require `"Resource": "*"`. Split these into a separate statement if you scope `InvokeModel` to specific model ARNs.

***

## Connection Methods

### Method 1: IAM Role Federation (Recommended)

Follow the full role federation setup in **[AWS Integrations → IAM Role Federation](/aws-integrations#connection-method-1-iam-role-federation-recommended)**. Attach the `4MINDS-Bedrock-Access` policy (from [above](#bedrock-iam-permissions-policy)) when creating the IAM role.

Then, in 4MINDS:

1. Open **Integrations** from the main navigation bar and select **Amazon Bedrock**
2. Select the **IAM Role** tab
3. Paste your **IAM Role ARN**
4. Leave the **External ID** field blank — it is not supported for IAM Role Federation (see [AWS Integrations → Verify the Trust Policy](/aws-integrations#c-verify-the-trust-policy))
5. Enter your **AWS Region** (must match the region where you've enabled Bedrock model access)
6. Click **Test Connection**, then **Save Credentials**

***

### Method 2: Bedrock API Key

The simplest setup — generate an API key directly from the Bedrock console. No IAM role or Cognito pool needed.

#### AWS Setup

1. Go to **AWS Console → Amazon Bedrock**
2. In the left sidebar, click **API keys**
3. Choose your key type:
   * **Short-term API key** (recommended for production) — expires when your console session expires (12 hours). Click **Generate short-term API keys**
   * **Long-term API key** — can last longer than 12 hours. Click **Long-term API keys**, configure expiration, and generate
4. **Copy the API key** once generated

> **Note:** Short-term keys require regenerating and updating your 4MINDS connection when they expire. For a set-it-and-forget-it setup, use IAM Role Federation (Method 1).

#### Connect in 4MINDS

1. Open **Integrations** and select **Amazon Bedrock**
2. Select the **API Key** tab
3. Paste the **Bedrock API key**
4. Enter your **AWS Region**
5. Click **Test Connection**, then **Save Credentials**

> **Security note:** API keys are encrypted at rest. For production environments requiring maximum security, prefer IAM Role Federation (Method 1) — it stores nothing long-lived.

***

### Method 3: Amazon Cognito

Follow the full Cognito setup in **[AWS Integrations → Amazon Cognito](/aws-integrations#connection-method-2-amazon-cognito)**. Attach the `4MINDS-Bedrock-Access` policy (from [above](#bedrock-iam-permissions-policy)) to the Cognito authenticated role.

Then, in 4MINDS:

1. Open **Integrations** and select **Amazon Bedrock**
2. Select the **Cognito** tab
3. Fill in the Cognito fields (User Pool ID, App Client ID, App Client Secret if used, Identity Pool ID, Username, Password)
4. Enter your **AWS Region** (must match your User Pool and Identity Pool region)
5. Click **Test Connection**, then **Save Credentials**

***

## After Connecting: Adding Models

Once connected:

1. Open **Integrations** and select **Amazon Bedrock**
2. Browse the list of available foundation models — all supported models appear automatically
3. Click to register models you want to use in your workspace
4. Registered models appear in your model selector for conversations

***

## Supported AWS Regions

Amazon Bedrock is available in select regions. Common options:

* `us-east-1` (N. Virginia)
* `us-east-2` (Ohio)
* `us-west-2` (Oregon)
* `eu-west-1` (Ireland)
* `eu-central-1` (Frankfurt)
* `ap-southeast-1` (Singapore)
* `ap-northeast-1` (Tokyo)

Check the [AWS Regional Services List](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/) for current availability.

***

## Troubleshooting

| Issue                 | Solution                                                                                      |
| --------------------- | --------------------------------------------------------------------------------------------- |
| "No models found"     | Verify the region is correct and that your IAM policy includes `bedrock:ListFoundationModels` |
| Connection times out  | Verify the region is correct and Bedrock is enabled there                                     |
| "Access Denied"       | Confirm the [IAM policy](#bedrock-iam-permissions-policy) is attached to the correct identity |
| "Unrecognized client" | Wrong region, or Bedrock isn't enabled in that region                                         |
| API key expired       | Generate a new short-term key or use a long-term key / IAM Role Federation                    |

For method-specific issues (OIDC trust policy, Cognito password states, etc.), see [AWS Integrations → Troubleshooting](/aws-integrations#troubleshooting).

***

## Disconnecting

1. Open **Integrations** and select **Amazon Bedrock**
2. Click **Disconnect**

This removes stored credentials from 4MINDS. Your AWS resources are not affected.