AWS Bedrock

This guide shows you how to configure AWS Bedrock as an external model provider in AI Studio. After setting up this provider, you can use foundation models from AWS Bedrock when building agents.

AI Studio currently supports Bedrock models in us-east-1, us-west-1, us-west-2, and eu-west-1 regions only. See Regional considerations for details.

Prerequisites

Before adding Bedrock models to AI Studio, you need:

An AWS account with access to Amazon Bedrock
Credentials for one of the supported authentication methods (see Configure AWS credentials)
Permission to invoke the models you want to use in your selected region

AI Studio supports text generation and embedding models from Bedrock. Video, audio, and image generation models are not supported.

Configure AWS credentials

AI Studio supports three authentication methods for AWS Bedrock. Choose the method that matches how your organization manages AWS access.

Bedrock API key
AWS access keys
AWS assume role

Amazon Bedrock API keys authenticate requests with a bearer token. Generate a long-term key in the Amazon Bedrock console.

Sign in to the Amazon Bedrock console
In the left navigation pane, select API keys
Open the Long-term API keys tab and select Generate long-term API keys
Choose an expiration period and optional advanced permissions
Select Generate, then copy the key and store it securely

The API key is only shown once. Short-term API keys expire with your console session (up to 12 hours) and are a poor fit for AI Studio. Use a long-term key for production credentials.

After you generate the key, copy the value and either enter it when you add a Bedrock model, or save it as a reusable credential set on the LLM Credentials page.

Access keys authenticate AI Studio with an IAM user. Create a dedicated IAM user for AI Studio rather than using personal credentials.

Create an IAM user

Sign in to the AWS IAM Console
Navigate to Users in the left sidebar
Select Create user
Enter a username (for example, writer-aistudio-bedrock)
Select Next
Choose Attach policies directly
Attach a least-privilege Bedrock invoke policy for the models you configure. See IAM policy example
Select Next, then Create user

Generate access keys

Select the user you created
Navigate to the Security credentials tab
Under Access keys, select Create access key
Choose Third-party service as the use case
Acknowledge the recommendation and select Next
Add an optional description tag (for example, AI Studio Bedrock integration)
Select Create access key
Copy the Access key ID and Secret access key

The secret access key is only shown once. Copy it immediately and store it securely. If you lose the secret key, you must create new access keys.

After you generate the access keys, copy the values and either enter them when you add a Bedrock model, or save them as a reusable credential set on the LLM Credentials page.

IAM policy example

Scope the policy to the foundation model or inference profile ARNs you use. Replace the region, account ID, and model IDs with your values. For streaming, add bedrock:InvokeModelWithResponseStream to the Action array.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel"],
      "Resource": [
        "arn:aws:bedrock:us-west-2::foundation-model/anthropic.claude-opus-5",
        "arn:aws:bedrock:us-west-2:123456789012:inference-profile/us.anthropic.claude-opus-5"
      ]
    }
  ]
}

Use AWS assume role for cross-account access or when your organization requires role-based access. Both sides of the assume-role relationship must allow the call: the role trust policy and the source identity policy. See Grant a user permissions to switch roles in the AWS documentation.

Create an IAM role

Sign in to the AWS IAM Console
Navigate to Roles in the left sidebar
Select Create role
Configure the role trust policy so the source IAM user or account is allowed as a principal for sts:AssumeRole
Attach a least-privilege Bedrock invoke policy for the models you configure. See IAM policy example
Create the role and copy the Role ARN
If the role requires an external ID for cross-account access, note the External ID

Create source credentials

Create or select an IAM user that provides the access keys to AI Studio
Attach an identity policy to that user that allows sts:AssumeRole on the target role ARN. Creating the user alone is not enough—without this permission, assume-role calls fail
Navigate to the Security credentials tab for that user
Under Access keys, select Create access key
Choose Third-party service as the use case
Acknowledge the recommendation and select Next
Add an optional description tag (for example, AI Studio Bedrock assume role)
Select Create access key
Copy the Access key ID and Secret access key

The secret access key is only shown once. Copy it immediately and store it securely. If you lose the secret key, you must create new access keys.

After you generate the access keys, copy the values (and the Role ARN) and either enter them when you add a Bedrock model, or save them as a reusable credential set on the LLM Credentials page.

IAM policy example for assume role

Attach this policy to the role you assume (not only to the source user). Scope it to the foundation model or inference profile ARNs you use. Replace the region, account ID, and model IDs with your values. For streaming, add bedrock:InvokeModelWithResponseStream to the Action array.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel"],
      "Resource": [
        "arn:aws:bedrock:us-west-2::foundation-model/anthropic.claude-opus-5",
        "arn:aws:bedrock:us-west-2:123456789012:inference-profile/us.anthropic.claude-opus-5"
      ]
    }
  ]
}

Add Bedrock models in AI Studio

After configuring your AWS credentials, add Bedrock models to AI Studio.

Navigate to Models & Guardrails > Models in AI Studio
Under Bring your own model, select + Add model
Select Amazon Bedrock as the provider, then select Next
Select the model from the Model name dropdown
Enter a unique Display name for the model
Provide credentials using one of the following options (not both):
- Select an existing credential set from the Credentials name dropdown
- Enter a new Credential name and the authentication fields for your chosen method, using the values from Configure AWS credentials
Configure team access:
- All teams: Anyone with builder access can use the model
- Specific teams: Restrict to selected teams
Select Save

Use either an existing credential set or new credential fields. Filling both sides of the credentials section can prevent the form from saving.

If the model you need does not appear in the Model name dropdown, contact Writer support. Use a unique display name so the model does not collide with a WRITER-managed catalog entry in WRITER Agent.

Regional considerations

AI Studio supports Bedrock models in the following AWS regions:

US East (us-east-1)
US West (us-west-1)
US West 2 (us-west-2)
EU West (eu-west-1)

Support for additional AWS regions is coming soon.

When configuring Bedrock in AI Studio:

Select a supported region where your credentials can invoke the model
Ensure your credentials have permissions in the same region you select
Some Bedrock models are only available in specific regions—check the Amazon Bedrock regional availability documentation

Ensure the region you select in AI Studio matches the region where your credentials can invoke the model.

Monitor costs

AWS bills Bedrock usage directly to your AWS account based on the tokens processed. WRITER also charges a 10% pass-through fee on external model usage, paid via credits. AI Studio tracks usage and costs for external models, providing visibility into spending across all your models in one place.

Troubleshoot Bedrock configuration

Invalid credentials error

If you see an “Invalid credentials” or “Authentication failed” error:

Verify credentials are copied correctly without extra spaces
For Bedrock API keys, confirm the key is still active and has not expired
For access keys, check that the keys are still active in the IAM console
For assume role, verify the Role ARN, External ID (if required), that the role trust policy allows the source principal, and that the source user’s identity policy allows sts:AssumeRole on the target role ARN
Ensure the credentials allow bedrock:InvokeModel on the model or inference profile ARNs you configured
For streaming failures, confirm the policy also allows bedrock:InvokeModelWithResponseStream

Model not available error

If a model doesn’t appear or returns an error:

Confirm the model appears in the Bedrock Model catalog for your region
For Anthropic models, confirm you completed the first-time use form if prompted
Verify you selected the correct region in AI Studio
Check that your credentials allow access to the specific model or inference profile ARNs in your IAM policy

Duplicate model in WRITER Agent

If the model dropdown shows a confusing duplicate:

Check whether the same model is already enabled as a WRITER-managed catalog model on the Models page
Use a distinct Display name for the BYOM entry, or delete the extra BYOM model if you intended to use the WRITER-managed version

Form will not save

If the Add model form does not save:

Clear either the Credentials name dropdown or the new credential fields so only one path is filled
Confirm all required fields for the selected authentication method are complete

Next steps

Add external models: Learn about managing external models in AI Studio
Choose a model: Compare Palmyra models with external provider models
Amazon Bedrock documentation: Explore Bedrock’s full capabilities

Getting started

Core concepts

Agent Builder v2

Monitor and manage

Models and pricing

Connect to your data

Chat completions

No-code agents

Knowledge Graphs

Tool calling

Additional capabilities

Integrations

Security and compliance

Resources

Prerequisites

Configure AWS credentials

Create an IAM user

Generate access keys

IAM policy example

Create an IAM role

Create source credentials

IAM policy example for assume role

Add Bedrock models in AI Studio

Regional considerations

Monitor costs

Troubleshoot Bedrock configuration

Invalid credentials error

Model not available error

Duplicate model in WRITER Agent

Form will not save

Next steps

​Prerequisites

​Configure AWS credentials

​Create an IAM user

​Generate access keys

​IAM policy example

​Create an IAM role

​Create source credentials

​IAM policy example for assume role

​Add Bedrock models in AI Studio

​Regional considerations

​Monitor costs

​Troubleshoot Bedrock configuration

​Invalid credentials error

​Model not available error

​Duplicate model in WRITER Agent

​Form will not save

​Next steps

Prerequisites

Configure AWS credentials

Create an IAM user

Generate access keys

IAM policy example

Create an IAM role

Create source credentials

IAM policy example for assume role

Add Bedrock models in AI Studio

Regional considerations

Monitor costs

Troubleshoot Bedrock configuration

Invalid credentials error

Model not available error

Duplicate model in WRITER Agent

Form will not save

Next steps