Bedrock

The gateway speaks Bedrock natively and does the SigV4 signing itself.

What's specific to Bedrock

Property	Value
Provider id	bedrock
Gateway speaks	Bedrock Runtime (Converse API), region-derived host
Credential	AWS workload role, or static access key + secret; plus region
Signing	Gateway signs SigV4 itself
Client base URL	OPENAI_BASE_URL (or ANTHROPIC_BASE_URL for Claude) → :8787

Everything shared — self-hosting, the config-based redirect, how credentials are stored — is documented once in the gateway.

Configure the provider

Console → Providers → add bedrock:

• Region — e.g. us-east-1
• Access key ID / Secret access key — leave both blank to use the gateway's AWS role
• Session token — optional, for explicitly configured temporary keys

With no explicit key pair, the gateway uses the standard AWS credential chain. This covers:

• an ECS/Fargate task role (use the task role, not the task execution role)
• an EC2 instance profile
• an EKS service-account role (IRSA)
• standard AWS environment or shared-config credentials

Role credentials are short-lived and refreshed by the AWS provider chain; Anyray does not store them. If you configure an explicit access-key pair, it takes precedence over the role. Workload-role discovery applies to the Node gateway running in AWS; a Cloudflare Worker has no access to AWS workload metadata and must use explicit credentials.

Grant the gateway role access

Attach a least-privilege policy to the role used by the gateway workload. For basic chat and streaming, it needs these actions (scope Resource to the model and inference profile ARNs your organization allows):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*"
    }
  ]
}

For the Anyray CloudFormation deployment, attach this permission to the gateway ECS task role created by the stack. The execution role only pulls images and reads startup secrets; Bedrock does not use it.

Route requests to it

export OPENAI_BASE_URL=http://<gateway>:8787/v1
# Claude on Bedrock via Anthropic SDKs:
export ANTHROPIC_BASE_URL=http://<gateway>:8787
# requests carry:  x-anyray-provider: bedrock

Models use Bedrock ids, e.g. anthropic.claude-3-5-sonnet-20240620-v1:0, amazon.titan-embed-text-v2:0.