Amazon Bedrock¶

Editions: OSS, Cloud, Enterprise. Unless stated otherwise, everything on this page ships in OSS.

This guide connects an Amazon Bedrock model to Preloop, sends one request through the gateway, and checks that the request shows up on the Cost page. It covers foundation model ids (amazon.nova-micro-v1:0), cross-region inference profiles (us.anthropic.claude-haiku-4-5-20251001-v1:0), and application inference profile ARNs.

What the gateway supports¶

Area	Support
Auth	Bedrock API keys generated in the AWS Bedrock console, or IAM access key id and secret, with an optional session token for temporary credentials. Instance profile or task role credentials are available through the API (see Ambient credentials).
Regions	Any Bedrock region. Set it per model; it defaults to `us-east-1`.
Model ids	Foundation model ids, system inference profiles (`us.`, `eu.`, `apac.`, `global.` and other geo prefixes), and inference profile ARNs. All are sent through the Bedrock Converse API.
Chat	`/openai/v1/chat/completions`, streaming and non-streaming, including tool calls.
Usage	Token counts come from the Bedrock response. Streaming requests also record usage, because the gateway always asks for the final usage chunk.
Pricing	Foundation model ids and system inference profiles are priced from the catalog (the geo prefix is ignored for the lookup). Application inference profile ARNs need a price override or a base model, see Cost page.

The provider value is bedrock. The older spellings aws and amazon-bedrock are accepted by the API and route the same way.

Minimum IAM policy¶

The gateway calls Converse and ConverseStream. Both are authorized by the InvokeModel actions. Fetch Models in the console also lists foundation models and inference profiles.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreloopInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/*",
        "arn:aws:bedrock:*:<account-id>:inference-profile/*",
        "arn:aws:bedrock:*:<account-id>:application-inference-profile/*"
      ]
    },
    {
      "Sid": "PreloopDiscovery",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels",
        "bedrock:ListInferenceProfiles"
      ],
      "Resource": "*"
    }
  ]
}

Narrow the Resource list to the models you plan to use. A cross-region inference profile needs InvokeModel on the profile ARN and on the foundation model ARN in every region the profile can route to, which is why the example uses * for the region. The discovery statement is optional: you can type the model id by hand instead of using Fetch Models. Without bedrock:ListInferenceProfiles, Fetch Models warns that inference profiles could not be listed and offers only eligible foundation models. A foundation model that requires a profile is not offered as a directly invocable model.

Add the model in the console¶

Open Models in the console sidebar and click Add model.
Name: a label for your team, for example Bedrock Nova Micro.
Type: LLM.
Provider: AWS Bedrock.
Authentication: choose Bedrock API key to paste a key generated in the AWS Bedrock console Quickstart into Bedrock API Key. Choose IAM access keys to enter AWS Access Key ID and AWS Secret Access Key from the policy above.
AWS Session Token: optional for IAM temporary credentials (for example from aws sts assume-role or SSO). Short-term Bedrock API keys and temporary IAM credentials expire. Replace the saved credentials before they expire.
AWS Region: the region where the model or inference profile is available, for example us-east-1 or eu-west-1.
Model ID or inference profile ID / ARN: click Fetch models from provider and select a model ID or inference profile. An inference profile is an AWS identifier that routes a request to the model in its supported regions. Some models require one because AWS does not support invoking their bare foundation model ID on demand. The list includes active profiles and eligible foundation models. It does not verify invocation permissions. To find a profile manually, open AWS Bedrock > Cross-region inference in the same AWS region, select the profile for your model, and copy its Inference profile ID or ARN into this field. Check its destination regions before choosing it. Use the exact value AWS shows; do not guess a geographic prefix. Application inference profile ARNs can also be pasted. If discovery warns that profiles could not be listed, check credentials and grant bedrock:ListInferenceProfiles, then refresh. If no matching profile is found, check availability in AWS for the configured region.
Leave Route inference through the Preloop gateway checked. The form shows the Gateway alias, for example bedrock/amazon.nova-micro-v1:0. Clients send that alias as model.
Save.

The credentials are stored as one encrypted secret. They are never returned by the API and are not shown again when you edit the model; leave the key fields blank on edit to keep them. Changing authentication methods requires a replacement credential. Use the region where the Bedrock API key was generated. API keys authenticate both Fetch Models and gateway inference; listing permissions are still required. See AWS API key usage.

Create an API-key model through the API¶

Set api_key to the JSON-encoded bearer credential blob. API callers must include meta_data.provider_runtime.auth_method: "api_key" so the edit dialog selects the matching authentication method. The gateway authenticates from the encrypted blob; auth_method is a console hint, not a server authentication switch. Include the region where the key was generated:

{
  "name": "Bedrock Nova Micro",
  "provider_name": "bedrock",
  "model_identifier": "amazon.nova-micro-v1:0",
  "api_key": "{\"aws_bearer_token_bedrock\":\"<bedrock-api-key>\"}",
  "meta_data": {
    "provider_runtime": { "region": "us-east-1", "auth_method": "api_key" },
    "gateway": { "enabled": true, "model_alias": "bedrock/amazon.nova-micro-v1:0" }
  }
}

Send this body to POST /api/v1/ai-models. For IAM credential blobs, use auth_method: "iam". When preserving a stored secret with no auth metadata, the console leaves the metadata absent on save rather than guessing its credential type.

Ambient credentials¶

When Preloop runs on AWS with an instance profile or task role that has the policy above, a model can use those credentials instead of stored keys. The console form always asks for keys, so create this kind of model through the API with no api_key and this metadata:

{
  "name": "Bedrock Nova Micro",
  "provider_name": "bedrock",
  "model_identifier": "amazon.nova-micro-v1:0",
  "meta_data": {
    "provider_runtime": {"ambient_credentials": true, "region": "us-east-1"}
  }
}

The gateway then uses the standard AWS credential chain of the process that serves the request. Assuming a different role per model (aws_role_name) is not supported.

Agent onboarding¶

Native Bedrock configuration import is supported for Claude Code, OpenClaw, and OpenCode. When onboarding one of these harnesses with preloop agents onboard, Preloop preserves its explicit Bedrock model identifier, including inference profile IDs and ARNs. The gateway also needs the AWS region and credentials. A bare foundation ID that AWS requires an inference profile for still needs to be corrected; do not assume onboarding will choose a routing geography for you.

This behavior requires updated CLI and control plane versions containing the Bedrock onboarding fixes. The fixes are pending release; an updated console alone does not update the CLI installed on your machine.

Supported static IAM credentials, shared credential files, temporary session credentials, and Bedrock bearer API keys can be imported from supported harness configuration. Temporary credentials expire and need replacement. A local IAM role or SSO refresh chain cannot be copied into a remote gateway as a renewable credential; configure suitable credentials on the gateway or keep that harness using its local AWS authentication.

Send one request¶

Create a Preloop API key under Settings > API Keys, then:

export PRELOOP_URL=https://preloop.example.com
export PRELOOP_API_KEY=<your Preloop API key>

curl -sS "$PRELOOP_URL/openai/v1/chat/completions" \
  -H "Authorization: Bearer $PRELOOP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "model": "bedrock/amazon.nova-micro-v1:0",
        "messages": [{"role": "user", "content": "Reply with the single word: ok"}],
        "max_tokens": 32
      }' -D -

-D - prints the response headers. The body is an OpenAI chat completion with a usage block. The X-Preloop-Usage-Id response header is the id of the usage row the request wrote. It is set on non-streaming responses.

The CLI does the same check and prints the result:

preloop models smoke bedrock/amazon.nova-micro-v1:0

Model:      bedrock/amazon.nova-micro-v1:0
Status:     200 OK
Latency:    812 ms
Tokens:     14 prompt, 2 completion, 16 total
Usage row:  6a0e2c1d-...
Reply:      ok
✓ Smoke check passed

It uses your preloop login session (or --token), exits non-zero on an error status, and accepts --prompt, --max-tokens, --timeout and --json.

Cost page¶

Open Cost in the sidebar. The request counts toward the spend, request and token totals for the selected window, and appears on the agent, session and user tabs.

Foundation models and system inference profiles are priced from the model catalog. A us. or eu. profile uses the price of the underlying model.
Application inference profile ARNs have no catalog price. The Cost page shows a warning that some requests have no cost estimate, with Set price override and Reprice now. Set an override for the model, then reprice so earlier requests pick it up. Alternatively, set meta_data.provider_runtime.base_model to the catalog id behind the profile (for example amazon.nova-micro-v1:0) through the API; pricing then uses that model's rates.
Dollar values are estimates from list prices. Your AWS bill, including discounts, provisioned throughput, and cross-region routing, is the source of truth.

Pitfalls¶

AccessDeniedException on the first request. Check the IAM policy first. For a cross-region profile, the foundation model ARN must be allowed in every destination region, not only the one you configured. Some third-party models also need a one-time access request or use-case form in the Bedrock console before any account can invoke them.
ValidationException: Invocation of model ID ... with on-demand throughput isn't supported. The model is only offered through an inference profile. Edit the model and replace its identifier with the exact profile ID or ARN from AWS Bedrock > Cross-region inference in the configured region. Leave the credential fields blank to keep the saved key.
Wrong region. Model availability is regional. A model that works in us-east-1 can return a not-found error in another region. The region set on the model is used for every request to it.
Expired session token. Temporary credentials stop working silently at expiry. Edit the model and paste fresh credentials, or switch to long-lived keys or ambient credentials.
Fetch Models shows no us. ids. The credentials lack bedrock:ListInferenceProfiles, or no active profile is available in the selected region. Check the discovery warning, grant the permission if needed, or paste the exact ID/ARN from the AWS console.
Unpriced requests on the Cost page. Expected for application inference profile ARNs. Set a price override or a base model as described above.

See also Azure OpenAI and Model price refresh.