---
title: AWS Bedrock
url: https://arcana.otnelhq.com/docs/providers/amazon-bedrock
---

# AWS Bedrock



AWS Bedrock provides access to Claude, Llama, Mistral, and other models through AWS infrastructure. Uses IAM authentication (SigV4) — no API key required. Ideal for enterprise environments where data cannot leave AWS.




## Setup



```bash
# 1. Configure AWS credentials (standard AWS SDK auth)
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...
export AWS_DEFAULT_REGION=us-east-1

# 2. Verify detection
arcana doctor

# 3. Run
arcana run "hello"
```




## Available Models



| Model | Provider | Best For |
| --- | --- | --- |
| `anthropic.claude-sonnet-4-20250514-v1:0` | Anthropic | Best balance of speed and quality |
| `anthropic.claude-opus-4-20250514-v1:0` | Anthropic | Highest quality reasoning |
| `meta.llama-3.1-405b-instruct` | Meta | Large open-weight model |
| `meta.llama-3.1-70b-instruct` | Meta | Good balance of cost and quality |
| `mistral.mistral-large-2407-v1:0` | Mistral | Fast, European compliance |




## Config File



```json
{
  "provider": "bedrock",
  "model": "anthropic.claude-sonnet-4-20250514-v1:0"
}
```




## Environment Variables



| Variable | Description |
| --- | --- |
| `AWS_ACCESS_KEY_ID` | IAM access key (required) |
| `AWS_SECRET_ACCESS_KEY` | IAM secret key (required) |
| `AWS_SESSION_TOKEN` | Session token for temporary credentials (optional) |
| `AWS_DEFAULT_REGION` | AWS region (default: `us-east-1`) |
| `AWS_PROFILE` | Named AWS profile from `~/.aws/credentials` |




## IAM Authentication



Bedrock uses AWS IAM SigV4 signing — no API keys to manage. Arcana signs requests using your AWS credentials. This means:



- No data leaves AWS infrastructure
- Audit trails via CloudTrail
- Fine-grained IAM policies for model access
- VPC endpoints for private connectivity




## Required IAM Permissions



```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:*::foundation-model/*"
    }
  ]
}
```




## Tips



- Use `AWS_PROFILE` for local development with named profiles
- Set `AWS_SESSION_TOKEN` for temporary credentials (e.g., from STS AssumeRole)
- Bedrock models have the same capabilities as their direct API counterparts
- Check the [AWS Bedrock model IDs](https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html) for the latest model identifiers