Amazon Bedrock

An Amazon Bedrock connection sends the models you choose through your own AWS account, so AWS bills your account instead of Amp. It serves Claude models through Bedrock’s Anthropic-compatible Messages endpoint and other models through Bedrock’s OpenAI-compatible endpoint.

Amp authenticates with IAM web identity federation. You register Amp as an OIDC identity provider in your AWS account and create an IAM role that trusts Amp and may invoke Bedrock models. Amp assumes that role with short-lived signed tokens and stores no key or secret.

Set Up a Connection

In Amp, open personal model routing or workspace model routing and add an Amazon Bedrock connection. The form walks you through creating the IAM role by showing you this script:

Sign in to see your own AMP_ISSUER and AMP_SUBJECT values in the script. 
# The Amp user or workspace that will use this connection.
export AMP_ISSUER=AMP_ISSUER
export AMP_SUBJECT=AMP_SUBJECT

export ROLE_NAME=AmpBedrock
export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
export AMP_OIDC_PROVIDER="${AMP_ISSUER#https://}"

# Register Amp as an OIDC identity provider (once per AWS account).
aws iam create-open-id-connect-provider \
  --url "$AMP_ISSUER" \
  --client-id-list sts.amazonaws.com

# Create a role that only tokens for your Amp account can assume. Keep both conditions.
aws iam create-role --role-name "$ROLE_NAME" --assume-role-policy-document "$(cat <<EOF
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Federated": "arn:aws:iam::$AWS_ACCOUNT_ID:oidc-provider/$AMP_OIDC_PROVIDER" },
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": { "StringEquals": {
      "$AMP_OIDC_PROVIDER:aud": "sts.amazonaws.com",
      "$AMP_OIDC_PROVIDER:sub": "$AMP_SUBJECT"
    } }
  }]
}
EOF
)"

# Allow the role to invoke Bedrock models. Narrow Resource to specific model and
# inference profile ARNs if your policy requires it.
aws iam put-role-policy --role-name "$ROLE_NAME" --policy-name AmpBedrockInvoke \
  --policy-document "$(cat <<EOF
{
  "Version": "2012-10-17",
  "Statement": [{ "Effect": "Allow", "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:CallWithBearerToken"], "Resource": "*" }]
}
EOF
)"

aws iam get-role --role-name "$ROLE_NAME" --query Role.Arn --output text

The last command prints the role ARN. Paste it into the IAM Role ARN field, select which models should use the connection, and save.

Amp does not call the AWS subscription or agreement APIs. Saving a connection does not invoke a model, even though web settings activate new connections immediately. Check Access and activating an existing connection in web settings invoke one selected model. These checks and normal Amp requests can trigger Bedrock’s first-use auto-enablement and acceptance of the model’s license terms.

The generated role has invocation permissions only. If your AWS administrator chooses to allow Bedrock auto-enablement, they can separately grant aws-marketplace:Subscribe, aws-marketplace:Unsubscribe, and aws-marketplace:ViewSubscriptions. Restrict those permissions to calls made through Bedrock so the role cannot manage unrelated Marketplace products. AWS lists all three actions as prerequisites for auto-enablement. Amp does not call Subscribe or Unsubscribe itself:

{
	"Effect": "Allow",
	"Action": [
		"aws-marketplace:Subscribe",
		"aws-marketplace:Unsubscribe",
		"aws-marketplace:ViewSubscriptions"
	],
	"Resource": "*",
	"Condition": {
		"StringEquals": { "aws:CalledViaLast": "bedrock.amazonaws.com" }
	}
}

After AWS enables a model, Amp can invoke it without Marketplace permissions. A permission boundary or AWS Organizations policy can still override an allow policy on the role.

You can subscribe to each approved model before Amp invokes it. This requires AWS CLI 2.27.42 or later. Replace the model and region below, review the returned offer, and then create the agreement:

export MODEL_ID=openai.gpt-5.6-sol
export AWS_REGION=us-east-2

aws bedrock list-foundation-model-agreement-offers \
  --model-id "$MODEL_ID" --offer-type ALL --region "$AWS_REGION"

# Review the returned offer terms and copy the offerToken you approve.
export OFFER_TOKEN='<reviewed offerToken>'

aws bedrock create-foundation-model-agreement \
  --model-id "$MODEL_ID" --offer-token "$OFFER_TOKEN" --region "$AWS_REGION"

aws bedrock get-foundation-model-availability \
  --model-id "$MODEL_ID" --region "$AWS_REGION"

AWS can take several minutes to finish the subscription. You can also open the model in the Bedrock model catalog, review its terms, and subscribe there. See AWS’s guide to managing model access.

Check Access confirms that AWS accepts Amp’s identity and invokes one selected model. The result names that model. It does not test every selected model or establish access to them. With no selected model that Amp can resolve to a Bedrock model ID, the check does not pass and sends no Bedrock request. To test a particular model, use a connection whose Models field contains only that model during the check.

Amp sends requests to us-east-1 unless you change the region under Custom Region. Where Bedrock offers a cross-region inference profile for the region’s geography (us., eu., apac., and so on) or a global. profile, Amp uses that profile; otherwise it sends the foundation model ID. To pin a specific model ID, map it explicitly, for example anthropic/claude-opus-4-6 -> eu.anthropic.claude-opus-4-6-v1.

You can also add the connection from the CLI:

amp config model-providers setup-guide amazon-bedrock --workspace

amp config model-providers add-router amazon-bedrock --workspace \
  --iam-role-arn arn:aws:iam::123456789012:role/AmpBedrock \
  --aws-region us-east-1 \
  --model-mapping anthropic/claude-opus-4-6

Credentials Amp Does Not Accept

IAM web identity federation is the only supported authentication method. Amp does not accept these credentials, and does not plan to:

  • IAM user access keys. These are long-lived secrets that AWS recommends against for workloads.
  • Bedrock API keys. Long-term Bedrock API keys are bound to an IAM user, and short-term keys expire within 12 hours and cannot be refreshed by Amp.
  • Temporary credentials from aws sts get-session-token or SSO. These expire and Amp cannot refresh them.

For more, see AWS’s documentation on OIDC identity providers and AssumeRoleWithWebIdentity.