> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Bedrock

> Connect Amazon Bedrock to Orq.ai's AI Gateway. Configure your AWS access key, secret, and region to route Bedrock model requests with observability.

* **Name**: Can be anything. Example: `orq_bedrock`
* **Access key id**: Retrieve this from your IAM in AWS. See the image below as an example.
* **Secret access key**: Also retrieve this from your IAM in AWS. See the image below as an example.
* **Region**: Make sure that you select the right region. Example: us-east-1

<Frame caption="Integrate AWS Bedrock into Orq.ai">
  <img src="https://mintcdn.com/orqai/wN0WvbQrtiupQYum/images/setup-amazon-bedrock-1225.png?fit=max&auto=format&n=wN0WvbQrtiupQYum&q=85&s=80ed68cdfa920e4bc632e55201040041" alt="Setup Amazon Bedrock 1225" width="1857" height="1239" data-path="images/setup-amazon-bedrock-1225.png" />
</Frame>

## Retrieve access keys in AWS

<Frame caption="Retrieve the access keys in AWS Bedrock">
  <img src="https://mintcdn.com/orqai/EqUGDI2og-dnTmDI/images/docs/74d3e4bce3ee0015cfdbdf0b00a81a09b0930b36ee770a4fa4d8640667a4dd15-iScreen_Shoter_-_20250114172037284.jpg?fit=max&auto=format&n=EqUGDI2og-dnTmDI&q=85&s=0ea25a9d9481524ae9a3e23378f22ed0" alt="integrate AWS Bedrock into Orq.ai" width="4473" height="2596" data-path="images/docs/74d3e4bce3ee0015cfdbdf0b00a81a09b0930b36ee770a4fa4d8640667a4dd15-iScreen_Shoter_-_20250114172037284.jpg" />
</Frame>

## Policies / Permissions in AWS

In order for the model to work, make sure that the following two permissions are included in the policy which is attached to the user in AWS.

1. Bedrock: InvokeModel
2. Bedrock: InvokeModelWithResponseStream

<Frame caption="Make sure that the right permissions are linked to the policy">
  <img src="https://mintcdn.com/orqai/XbJWQ7lqn4sIVHea/images/docs/e002012d8c35a367dde103138492e6232a4fc97f64f8510d3cd42185c0e7930d-iScreen_Shoter_-_Google_Chrome_-_250114171859.jpg?fit=max&auto=format&n=XbJWQ7lqn4sIVHea&q=85&s=15dda2859bf0b00018671757d251ef46" alt="Make sure that the right permissions are linked to the policy" width="2494" height="1771" data-path="images/docs/e002012d8c35a367dde103138492e6232a4fc97f64f8510d3cd42185c0e7930d-iScreen_Shoter_-_Google_Chrome_-_250114171859.jpg" />
</Frame>

## IAM role

The **AI Studio** exposes the **Pod Identity (On-Premise)** auth mode on [on-premise deployments](/enterprise/deployment-options) only. A Bedrock model on such a deployment can authenticate with an IAM role instead of an access key and secret, so no long-lived AWS credentials are stored with the model.

In the **AI Gateway** sidebar, open **Models**, select <Icon icon="circle-plus" /> **Model**, and choose **AWS Bedrock**. Set **Auth Mode** to **Pod Identity (On-Premise)**, which sends `auth_mode: "pod-identity"` in the API.

Credentials then come from the AWS default credential chain of the deployment: the role attached to the gateway through EKS Pod Identity or IAM Roles for Service Accounts (IRSA), or the instance metadata service.

### Assume a role in another account

Set **Assume Role ARN** to have **Orq.ai** assume a role in a different AWS account. The optional **External ID** acts as a shared secret that the target role's trust policy requires before it grants access.

| Field                                       | Required | Description                                                                                                                                                                                 |
| ------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Auth Mode** (`auth_mode`)                 | Yes      | `pod-identity`. Uses the deployment's own AWS identity instead of a stored AWS integration.                                                                                                 |
| **Assume Role ARN** (`assume_role_arn`)     | No       | ARN of the IAM role to assume in the target account, such as `arn:aws:iam::123456789012:role/bedrock-access-role`.                                                                          |
| **External ID** (`assume_role_external_id`) | No       | Sent as the `ExternalId` of the `sts:AssumeRole` call, with no value added by **Orq.ai**. The target role's trust policy must require the same value. Shown once an Assume Role ARN is set. |

The assumed role needs the Bedrock permissions listed above. Without an Assume Role ARN, requests sign with the credentials the deployment resolves from its environment.

### Trust policy on the target role

The target role's trust policy must allow the identity the deployment runs as, and that identity needs `sts:AssumeRole` permission on the target role.

```json JSON theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<deployment_account_id>:role/<deployment_role_name>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

Replace `<deployment_account_id>` and `<deployment_role_name>` with that identity, which `aws sts get-caller-identity` reports from inside the deployment. When an External ID is set, add `"Condition": { "StringEquals": { "sts:ExternalId": "<external_id>" } }` to the statement.

***