AWS Bedrock

Amazon Bedrock hosts Claude, Llama, Mistral, and Amazon Nova models on your AWS account. Contenox calls the Bedrock Converse API; credentials come from the standard AWS chain, and the region is carried in the backend --url.

Prerequisites

An AWS account with Bedrock available in your region.
Enable the models you want in the Bedrock console → Model access. Until a model is enabled, every call returns AccessDeniedException — even though the model still appears in contenox model list.
Working AWS credentials (see auth below). Verify with:
```
aws sts get-caller-identity
```

Auth — the ambient AWS credential chain

Contenox uses the standard AWS SDK credential chain: environment variables, a shared profile (~/.aws/credentials), or an IAM role (EC2/ECS/EKS/IMDS). No --api-key-env is needed.

# Example: env-var credentials (or use a profile: export AWS_PROFILE=my-profile)
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...

contenox backend add bedrock --type bedrock \
  --url "https://bedrock-runtime.us-east-1.amazonaws.com"          # the region lives in the URL

contenox model list                                                 # curated Converse-capable model ids
contenox config set default-model anthropic.claude-3-5-sonnet-20241022-v2:0   # example — use an enabled id
contenox config set default-provider bedrock

The --url carries the region (bedrock-runtime.<region>.amazonaws.com); a bare region like us-east-1 also works. The IAM principal needs bedrock:InvokeModel (and bedrock:InvokeModelWithResponseStream for streaming).

Static keys instead of the ambient chain

To pin specific credentials, store a JSON blob in an env var and pass --api-key-env:

export AWS_BEDROCK_CREDS='{"AccessKeyID":"AKIA...","SecretAccessKey":"...","SessionToken":""}'

contenox backend add bedrock --type bedrock \
  --url "https://bedrock-runtime.us-east-1.amazonaws.com" --api-key-env AWS_BEDROCK_CREDS

Model ids and inference profiles

contenox model list shows a curated set of common Converse model ids (e.g. anthropic.claude-3-5-sonnet-20241022-v2:0), but any Bedrock model id works as default-model.

Most current Claude/Llama models can't be invoked on-demand by their bare foundation id — they require a regional inference profile. If a call fails with ValidationException: ... on-demand throughput isn't supported ... use an inference profile, prefix the id with your region group — us., eu., or apac.:

contenox config set default-model us.anthropic.claude-3-5-sonnet-20241022-v2:0

Troubleshooting

Error	Cause	Fix
`AccessDeniedException` on a model	Model not enabled for your account	Enable it in Bedrock console → Model access
`ValidationException: on-demand throughput isn't supported`	Bare foundation id needs an inference profile	Prefix with `us.` / `eu.` / `apac.` (see above)
`could not load credentials` / `no EC2 IMDS role found`	AWS chain found no credentials	Set `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` or `AWS_PROFILE`; confirm with `aws sts get-caller-identity`
`UnrecognizedClientException`	Keys invalid, or wrong region for the model	Check the keys and that the `--url` region matches where the model is enabled