Agentic Data Plane

Set Up AWS Bedrock as an LLM Provider

Set up the AWS side that AI Gateway needs to invoke Amazon Bedrock, then register Bedrock as an LLM provider in Redpanda Agentic Data Plane. For how foundation models, cross-region inference profiles, and IAM ARNs map to the provider form, see Inference profiles and IAM.

After completing this guide, you will be able to:

  • Create an IAM policy that grants AI Gateway permission to invoke Bedrock foundation models and cross-region inference profiles

  • Create a dedicated IAM user, attach the policy, and generate access keys for AI Gateway

  • Register Bedrock as an LLM provider in Agentic Data Plane and choose model identifiers that Bedrock and AI Gateway accept

A Bedrock provider can also authenticate with an Amazon Bedrock API key instead of an IAM access key pair, which skips the IAM user and access-key steps in this guide. The identity behind the key still needs the invoke permissions from Create the IAM policy, plus bedrock:CallWithBearerToken to use the key and bedrock:ListFoundationModels for Test connection. See Configure an LLM provider.

Prerequisites

  • An AWS account where the models you plan to call are available in your region. Model availability varies by region. See Bedrock models by region.

  • For third-party models, such as Anthropic’s, a one-time enablement in the AWS account. Bedrock enables model access by default, but the first call to a third-party model subscribes the account through AWS Marketplace. That call needs the aws-marketplace:Subscribe, aws-marketplace:Unsubscribe, and aws-marketplace:ViewSubscriptions permissions, or someone with those permissions must enable the model once. Anthropic models also require the one-time First Time Use form in the Bedrock console. See Access Amazon Bedrock foundation models.

  • Access to the AWS CLI configured with credentials that can create IAM users, policies, and access keys.

  • Access to the Redpanda UI.

Create the IAM policy

Create a policy that grants the two Bedrock invoke actions on both foundation-model ARNs and cross-region inference-profile ARNs:

aws iam create-policy \
  --policy-name RedpandaBedrockInvoke \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "BedrockInvoke",
        "Effect": "Allow",
        "Action": [
          "bedrock:InvokeModel",
          "bedrock:InvokeModelWithResponseStream"
        ],
        "Resource": [
          "arn:aws:bedrock:*::foundation-model/*",
          "arn:aws:bedrock:*:*:inference-profile/*"
        ]
      }
    ]
  }'

The second resource entry enables cross-region inference profiles such as us.anthropic.claude-sonnet-4-6, which AI Gateway uses when the model identifier carries a geography prefix. See Inference profiles and IAM for the full prefix list and Cross-region inference profile billing for pricing.

Many current Anthropic Claude models, including Claude Haiku 4.5 and Claude 4.6 and later, can’t be invoked with the bare foundation-model ID and require an inference profile. Without the second Resource entry, those calls fail with AccessDenied.

To restrict the policy to specific models and regions for production, replace the wildcard resources with explicit ARNs. When you call a model through an inference profile, list the inference-profile ARN and the foundation-model ARN in every destination region the profile routes to. The model’s AWS model card lists those regions. For example, to allow only the US Claude Haiku 4.5 profile from us-east-1:

{
  "Resource": [
    "arn:aws:bedrock:us-east-1:<account-id>:inference-profile/us.anthropic.claude-haiku-4-5-20251001-v1:0",
    "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0",
    "arn:aws:bedrock:us-east-2::foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0",
    "arn:aws:bedrock:us-west-2::foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0"
  ]
}

A global. profile also needs the region-less foundation-model ARN, for example arn:aws:bedrock:::foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0.

Create the IAM user

Create a dedicated IAM user for AI Gateway and attach the policy:

aws iam create-user --user-name redpanda-bedrock-invoker

aws iam attach-user-policy \
  --user-name redpanda-bedrock-invoker \
  --policy-arn arn:aws:iam::<account-id>:policy/RedpandaBedrockInvoke

Replace <account-id> with the account ID returned in the create-policy output (visible in the policy ARN).

Don’t reuse an existing IAM user. A dedicated user makes it easy to rotate credentials or revoke access without affecting other AWS workloads.

Generate access keys

Generate the access keys AI Gateway uses:

aws iam create-access-key --user-name redpanda-bedrock-invoker

Save the AccessKeyId and SecretAccessKey from the output. You need both in the next section to register them as Redpanda secrets.

AWS displays the secret access key only at creation. Store it in a password manager or pass it directly into the secret-creation flow in the next section.

Verify Bedrock access (optional)

Confirm the IAM user can invoke Bedrock before moving to the UI:

aws bedrock-runtime invoke-model \
  --model-id us.anthropic.claude-haiku-4-5-20251001-v1:0 \
  --region us-east-1 \
  --content-type application/json \
  --accept application/json \
  --cli-binary-format raw-in-base64-out \
  --body '{"anthropic_version":"bedrock-2023-05-31","max_tokens":32,"messages":[{"role":"user","content":"Hello"}]}' \
  /tmp/bedrock-test.json \
  && jq . /tmp/bedrock-test.json && rm /tmp/bedrock-test.json

A successful model response confirms the IAM policy, region, and credentials are correct. If you see AccessDeniedException, check the policy resource list. On the first call to a third-party model, also check the AWS Marketplace permissions and, for Anthropic models, the First Time Use form (see Prerequisites).

Register Bedrock as an LLM provider

  1. Open LLM providers in the sidebar and click Add provider.

  2. Enter a Display name such as My Bedrock. Agentic Data Plane derives the resource ID in the proxy URL from it.

  3. Select AWS Bedrock as the provider type.

  4. In the Credential section, click Static keys. This guide uses the IAM access keys you created. For the Bedrock API key, default-chain, and assume-role options, see Configure an LLM provider.

  5. Configure the credentials:

    1. For Access key ID reference, click New, enter a secret name such as AWS_ACCESS_KEY_ID, paste the AccessKeyId value into Secret value, and click Create secret. The secret is stored in the Agentic Data Plane secret store, scoped to AI Gateway.

    2. Repeat for Secret access key reference. Use a name such as AWS_SECRET_ACCESS_KEY and paste the SecretAccessKey value.

      Secret names are normalized to UPPER_SNAKE_CASE automatically and get the AI Gateway scope.

  6. In the Connection settings section, select the Region where you want to invoke Bedrock, such as us-east-1.

  7. Click Test connection under Verify connection. A successful result confirms the AWS credentials in the region you picked. It doesn’t check access to any model, so credentials that pass can still fail on a model that IAM doesn’t allow.

  8. Select the models you want to expose through this provider. The picker groups them under the vendor that publishes each one, such as Anthropic or Amazon. For example:

    • us.anthropic.claude-sonnet-4-6

    • us.anthropic.claude-haiku-4-5-20251001-v1:0

    • mistral.mistral-large-3-675b-instruct

      For Anthropic models that require an inference profile, pick the profile ID rather than the bare foundation-model ID.

  9. Click Create provider.

  10. To re-run the check on the saved provider, click Test connection under Verify provider on its Connect tab.

Inference profiles and IAM

Three Bedrock concepts affect how you configure a provider: foundation models, cross-region inference profiles, and IAM. Get these right and your model calls succeed. Get them wrong and you see AccessDenied or ValidationException errors.

Foundation models versus inference profiles

A foundation model is the base model AWS exposes (for example, anthropic.claude-sonnet-4-6). It runs in the AWS region you call.

A cross-region inference profile wraps a foundation model with a geography prefix that routes requests across multiple regions for higher availability and throughput. The prefix tells AWS which geography runs the request:

Prefix Geography

us.

US regions

eu.

EU regions

apac.

Asia-Pacific regions. AI Gateway rejects apac. profiles from every provider region, so use global. instead.

au.

Australia regions

jp.

Japan regions

global.

Any region, routed for lowest cost

Examples: us.anthropic.claude-sonnet-4-6 (Claude Sonnet 4.6 routed across US regions), eu.anthropic.claude-haiku-4-5-20251001-v1:0 (Claude Haiku 4.5 routed across EU regions).

AI Gateway checks the prefix against the geography of the provider’s AWS region before it calls AWS, and rejects a mismatch with a 400 error. A provider in a US or Canadian region can call us. profiles, a provider in an EU region can call eu. profiles, and providers in the Japanese and Australian regions that AWS assigns to those geographies can call jp. and au. profiles. Some newer models publish fewer geographies than this. If AI Gateway rejects a geography profile, use the global. profile or the bare foundation-model ID instead.

Many current Anthropic Claude models, including Claude Haiku 4.5 and the 4.6 and later models (Sonnet 4.6, Opus 4.6, Opus 4.7), require an inference profile. Bedrock rejects the bare foundation-model ID for them and returns:

"Invocation of model ID … with on-demand throughput isn’t supported. Retry your request with the ID or ARN of an inference profile that contains this model."

Whether a model accepts a bare in-region ID depends on the model and the region. Check the model’s card in the Amazon Bedrock model reference for the IDs it supports.

IAM ARN shapes

Bedrock IAM resources have different ARN structures depending on whether you reference a foundation model, a system-defined inference profile, or an account-scoped application inference profile. The provider’s IAM principal needs bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream on every resource it calls.

Resource type ARN shape

Foundation model

arn:aws:bedrock:{region}::foundation-model/{model-id} (no account ID, AWS-owned)

System-defined inference profile

arn:aws:bedrock:{region}:*:inference-profile/{profile-id} (wildcard account, system-defined)

Application inference profile (account-scoped)

arn:aws:bedrock:{region}:{account-id}:application-inference-profile/{profile-id}

The policy in Create the IAM policy covers the first two shapes. An application inference profile has its own ARN shape, so add its ARN to the policy explicitly if you use one.

Cross-region inference profile billing

When you call a cross-region inference profile (any model identifier with a us., eu., au., jp., or global. prefix), AI Gateway bills at the rate for that profile. It preserves the prefix end to end when it records spend, so the Cost and usage page attributes usage to the correct regional rate. For example, requests to eu.anthropic.claude-haiku-4-5-20251001-v1:0 bill at the EU Haiku rate, not the headline foundation-model rate.

The bare foundation-model ID and the global. profile share AWS’s headline rate. The geography-specific profiles (us., eu., au., jp.) carry approximately a 10% cross-region inference premium. Use global. when you want the headline rate and don’t need a specific geography. Use us. or eu. when data residency matters.

Troubleshooting

Symptom What to check

AccessDenied from Bedrock

Confirm the IAM policy includes both bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream, and that the resource list covers the model or inference profile you’re calling. For Claude 4.6 and later, the policy must include arn:aws:bedrock:*:*:inference-profile/* or an explicit inference-profile ARN.

ValidationException: model ID not supported

The model ID isn’t valid in the region you chose, or the model isn’t available there. Check the model’s AWS model card for the IDs it accepts in that region, and use an inference profile if the model requires one.

AccessDeniedException on the first call to a third-party model

The account hasn’t enabled the model yet. Grant the IAM principal aws-marketplace:Subscribe, aws-marketplace:Unsubscribe, and aws-marketplace:ViewSubscriptions, or have someone with those permissions enable the model once. For Anthropic models, also submit the First Time Use form in the Bedrock console. Enablement can take a few minutes to complete.

ambient AWS credentials are unavailable on this cluster

The provider has no explicit access keys, so it falls back to an ambient AWS identity that the environment can’t supply. This is expected on an Agentic Data Plane environment hosted on a cloud other than AWS. Set the provider’s Credential type to Static keys and reference the access key pair from the secret store. An assume-role ARN doesn’t resolve this on its own, because AI Gateway authenticates the AssumeRole call with the same ambient identity. See Configure an LLM provider.

Invocation of model ID … with on-demand throughput isn’t supported

You called a Claude 4.6 or later model with a bare foundation-model ID. Switch to an inference profile, for example us.anthropic.claude-sonnet-4-6 instead of anthropic.claude-sonnet-4-6. See Inference profiles and IAM.

Bedrock returns 400 "cannot be invoked from AWS region … Bedrock geo inference profiles are restricted to their own geography"

You called a geography inference profile (a us., eu., au., or jp. prefix) from a provider whose AWS region is in a different geography, or an apac. profile from any region. AI Gateway rejects the call before it reaches AWS. Use the global. profile, the bare model ID, or a profile that matches the provider’s region. See Inference profiles and IAM.

For errors that aren’t specific to Bedrock, such as a missing secret reference, see the provider troubleshooting table.

Next steps