Agentic Data Plane

Set Up AWS Bedrock as an LLM Provider

Set up the AWS side that AI Gateway needs to invoke Amazon Bedrock, then register Bedrock as an LLM provider in Redpanda Agentic Data Plane. For how foundation models, cross-region inference profiles, and IAM ARNs map to the provider form, see Inference profiles and IAM.

After completing this guide, you will be able to:

  • Create an IAM policy that grants AI Gateway permission to invoke Bedrock foundation models and cross-region inference profiles

  • Create a dedicated IAM user, attach the policy, and generate access keys for AI Gateway

  • Register Bedrock as an LLM provider in Agentic Data Plane and choose model identifiers that Bedrock and AI Gateway accept

Prerequisites

  • An AWS account with Bedrock model access enabled in the region you plan to call. Model availability varies by region; see Bedrock models by region.

  • Access to the AWS CLI configured with credentials that can create IAM users, policies, and access keys.

  • Access to the Redpanda UI.

Create the IAM policy

Create a policy that grants the two Bedrock invoke actions on both foundation-model ARNs and cross-region inference-profile ARNs:

aws iam create-policy \
  --policy-name RedpandaBedrockInvoke \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "BedrockInvoke",
        "Effect": "Allow",
        "Action": [
          "bedrock:InvokeModel",
          "bedrock:InvokeModelWithResponseStream"
        ],
        "Resource": [
          "arn:aws:bedrock:*::foundation-model/*",
          "arn:aws:bedrock:*:*:inference-profile/*"
        ]
      }
    ]
  }'

The second resource entry enables cross-region inference profiles such as us.anthropic.claude-sonnet-4-6, which AI Gateway uses when the model identifier carries a geography prefix. See Inference profiles and IAM for the full prefix list and Cross-region inference profile billing for pricing.

Anthropic Claude 4.6 and later models cannot be invoked with the bare foundation-model ID and require an inference profile. Without the second Resource entry, those calls fail with AccessDenied.

To restrict the policy to specific models and regions for production, replace the wildcard resources with explicit ARNs. For example:

{
  "Resource": [
    "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-sonnet-4-6",
    "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-haiku-4-5-20251001"
  ]
}

Create the IAM user

Create a dedicated IAM user for AI Gateway and attach the policy:

aws iam create-user --user-name redpanda-bedrock-invoker

aws iam attach-user-policy \
  --user-name redpanda-bedrock-invoker \
  --policy-arn arn:aws:iam::<account-id>:policy/RedpandaBedrockInvoke

Replace <account-id> with the account ID returned in the create-policy output (visible in the policy ARN).

Don’t reuse an existing IAM user. A dedicated user makes it easy to rotate credentials or revoke access without affecting other AWS workloads.

Generate access keys

Generate the access keys AI Gateway uses:

aws iam create-access-key --user-name redpanda-bedrock-invoker

Save the AccessKeyId and SecretAccessKey from the output. You need both in the next section to register them as Redpanda secrets.

AWS displays the secret access key only at creation. Store it in a password manager or pass it directly into the secret-creation flow in the next section.

Verify Bedrock access (optional)

Confirm the IAM user can invoke Bedrock before moving to the UI:

aws bedrock-runtime invoke-model \
  --model-id us.anthropic.claude-haiku-4-5-20251001-v1:0 \
  --region us-east-1 \
  --content-type application/json \
  --accept application/json \
  --body "$(echo -n '{"anthropic_version":"bedrock-2023-05-31","max_tokens":32,"messages":[{"role":"user","content":"Hello"}]}' | base64)" \
  /tmp/bedrock-test.json \
  && jq . /tmp/bedrock-test.json && rm /tmp/bedrock-test.json

A successful model response confirms the IAM policy, region, and credentials are correct. If you see AccessDenied, check the policy resource list and confirm Bedrock model access is enabled in the target region.

Register Bedrock as an LLM provider

  1. Open LLM providers in the sidebar and click Add provider.

  2. Select AWS Bedrock as the provider type.

  3. Enter a Name such as my-bedrock. Use lowercase letters, digits, and hyphens. The name is immutable and appears in the proxy URL.

  4. Select the Region where you want to invoke Bedrock, such as us-east-1.

  5. For Credential type, select Static keys. (This guide uses the access keys you created above. For the default-chain and assume-role options, see Configure an LLM provider.)

  6. Configure the credentials:

    1. In the Access key ID ref dropdown, type a secret name such as AWS_ACCESS_KEY_ID.

    2. Paste the AccessKeyId value from the IAM user setup and click Create. The secret is stored in the Agentic Data Plane secret store, scoped to AI Gateway.

    3. Repeat for Secret access key ref. Use a name such as AWS_SECRET_ACCESS_KEY and paste the SecretAccessKey value.

      Secret names are normalized to UPPER_SNAKE_CASE automatically and get the AI Gateway scope, which makes them usable across the platform: LLM providers, MCP servers, and agents.

  7. Select the models you want to expose through this provider, for example:

    • anthropic.claude-sonnet-4-6

    • anthropic.claude-haiku-4-5-20251001

    • amazon.nova-pro-v1:0

      For Anthropic Claude 4.6 and later, pick the inference profile (for example, us.anthropic.claude-sonnet-4-6) rather than the bare foundation-model ID.

  8. Before you create the provider, select Test connection under Verify connection in the Connection settings section. A successful result confirms the AWS credentials in the region you picked. It doesn’t check access to any model, so a run whose credentials pass can still fail on a model that IAM doesn’t allow.

  9. Click Create provider.

  10. To re-run the check on the saved provider, select Test connection under Verify provider on its Connect tab.

Inference profiles and IAM

Three Bedrock concepts affect how you configure a provider: foundation models, cross-region inference profiles, and IAM. Get these right and your model calls succeed. Get them wrong and you see AccessDenied or ValidationException errors.

Foundation models versus inference profiles

A foundation model is the base model AWS exposes (for example, anthropic.claude-sonnet-4-6). It runs in the AWS region you call.

A cross-region inference profile wraps a foundation model with a geography prefix that routes requests across multiple regions for higher availability and throughput. The prefix tells AWS which geography runs the request:

Prefix Geography

us.

US regions

eu.

EU regions

apac.

Asia-Pacific regions. AI Gateway rejects apac. profiles from every provider region, so use global. instead.

au.

Australia regions

jp.

Japan regions

global.

Any region, routed for lowest cost

Examples: us.anthropic.claude-sonnet-4-6 (Claude Sonnet 4.6 routed across US regions), eu.anthropic.claude-haiku-4-5 (Haiku 4.5 routed across EU regions).

AI Gateway checks the prefix against the geography of the provider’s AWS region before it calls AWS, and rejects a mismatch with a 400 error. A provider in a US or Canadian region can call us. profiles, a provider in an EU region can call eu. profiles, and providers in the Japanese and Australian regions that AWS assigns to those geographies can call jp. and au. profiles. Some newer models publish fewer geographies than this. If AI Gateway rejects a geography profile, use the global. profile or the bare foundation-model ID instead.

Anthropic Claude 4.6+ models (Sonnet 4.6, Opus 4.6, Opus 4.7) require an inference profile. Bedrock rejects the bare foundation-model ID for them and returns:

"Invocation of model ID … with on-demand throughput isn’t supported. Retry your request with the ID or ARN of an inference profile that contains this model."

Older 4.5 and earlier Claude models still accept bare IDs.

IAM ARN shapes

Bedrock IAM resources have different ARN structures depending on whether you reference a foundation model, a system-defined inference profile, or an account-scoped application inference profile. The provider’s IAM principal needs bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream on every resource it calls.

Resource type ARN shape

Foundation model

arn:aws:bedrock:{region}::foundation-model/{model-id} (no account ID, AWS-owned)

System-defined inference profile

arn:aws:bedrock:{region}:*:inference-profile/{profile-id} (wildcard account, system-defined)

Application inference profile (account-scoped)

arn:aws:bedrock:{region}:{account-id}:application-inference-profile/{profile-id}

The policy in Create the IAM policy covers the first two shapes. An application inference profile has its own ARN shape, so add its ARN to the policy explicitly if you use one.

Cross-region inference profile billing

When you call a cross-region inference profile (any model identifier with a us., eu., au., jp., or global. prefix), AI Gateway bills at the rate for that profile. It preserves the prefix end to end when it records spend, so the Cost and usage page attributes usage to the correct regional rate. For example, requests to eu.anthropic.claude-haiku-4-5 bill at the EU Haiku rate, not the headline foundation-model rate.

The bare foundation-model ID and the global. profile share AWS’s headline rate. The geography-specific profiles (us., eu., au., jp.) carry approximately a 10% cross-region inference premium. Use global. when you want the headline rate and don’t need a specific geography. Use us. or eu. when data residency matters.

Troubleshooting

Symptom What to check

AccessDenied from Bedrock

Confirm the IAM policy includes both bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream, and that the resource list covers the model or inference profile you’re calling. For Claude 4.6 and later, the policy must include arn:aws:bedrock:*:*:inference-profile/* or an explicit inference-profile ARN.

ValidationException: model ID not supported

The model isn’t enabled in the region you chose. Open the AWS Bedrock console, switch to the target region, and enable model access for the foundation models you want to expose.

ambient AWS credentials are unavailable on this cluster

The provider has no explicit access keys, so it falls back to an ambient AWS identity that the environment can’t supply. This is expected on an Agentic Data Plane environment hosted on a cloud other than AWS. Set the provider’s Credential type to Static keys and reference the access key pair from the secret store. An assume-role ARN doesn’t resolve this on its own, because AI Gateway authenticates the AssumeRole call with the same ambient identity. See Configure an LLM provider.

Invocation of model ID … with on-demand throughput isn’t supported

You called a Claude 4.6 or later model with a bare foundation-model ID. Switch to an inference profile, for example us.anthropic.claude-sonnet-4-6 instead of anthropic.claude-sonnet-4-6. See Inference profiles and IAM.

Bedrock returns 400 "cannot be invoked from AWS region … Bedrock geo inference profiles are restricted to their own geography"

You called a geography inference profile (a us., eu., au., or jp. prefix) from a provider whose AWS region is in a different geography, or an apac. profile from any region. AI Gateway rejects the call before it reaches AWS. Use the global. profile, the bare model ID, or a profile that matches the provider’s region. See Inference profiles and IAM.

For errors that aren’t specific to Bedrock, such as a missing secret reference, see the provider troubleshooting table.

Next steps