> For the complete documentation index, see [llms.txt](https://docs.flashback.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flashback.tech/guides/configure-external-delegated-credentials/configure-delegated-access-for-aws-bedrock.md).

# Configure delegated access for AWS Bedrock

## Overview

For AWS Bedrock, delegated access usually means using IAM role assumption (STS) and short-lived credentials instead of distributing long-lived AWS keys.

Bedrock APIs are generally authenticated with **SigV4** signing. Flashgate's AI LLM configuration accepts provider endpoint + secret/token fields, so production integrations often use a controlled credential flow or a signing gateway.

## When to use this

* Production workloads with strict key management requirements.
* Teams using centralized IAM and short credential lifetime.
* Multi-team environments where external access must be auditable and revocable.

## Prerequisites

* AWS account with Bedrock enabled in your target region.
* Permissions to create/update IAM roles and trust policies.
* Defined list of models/actions required by your workload.
* Flashgate AI LLM setup path: [Configure an AI LLM](/guides/setup-the-cloud-and-ai-gateway/start-with-cloud-storage/create-a-bucket-1.md).

## Step-by-step (provider side)

{% stepper %}
{% step %}

### Create an IAM role with least privilege

Create a role for delegated Bedrock access and attach only required actions, for example:

* `bedrock:InvokeModel`
* `bedrock:InvokeModelWithResponseStream` (if streaming is needed)
* optional model discovery permissions only if your flow requires them.

Scope permissions to required model ARNs/regions whenever possible.
{% endstep %}

{% step %}

### Configure trust policy with STS AssumeRole + External ID

Use a third-party access trust policy pattern (`sts:AssumeRole`) and require an External ID condition.

This reduces confused-deputy risk and keeps delegated access explicit and auditable.
{% endstep %}

{% step %}

### Choose an integration pattern for Flashgate

Because Bedrock requests are SigV4-signed, common patterns are:

1. **Signing gateway/proxy pattern (recommended for many setups)** Run an internal service that:
   * assumes the IAM role,
   * signs Bedrock requests with SigV4,
   * exposes a stable endpoint that Flashgate can call.
2. **Direct configuration pattern (only if supported in your environment)** If your Flashgate environment supports direct Bedrock endpoint + secret/token flow, configure only documented fields and validate.

{% hint style="info" %}
If direct Bedrock auth behavior is not explicitly documented in your environment, treat it as an integration pattern and validate with a non-production model first.
{% endhint %}
{% endstep %}
{% endstepper %}

## Configure in Flashgate

Use [Configure an AI LLM](/guides/setup-the-cloud-and-ai-gateway/start-with-cloud-storage/create-a-bucket-1.md) with the existing model:

* Select the appropriate **AI LLM Type** for your provider/integration.
* Set **API Endpoint** to your provider endpoint or signing proxy endpoint.
* Set **API Secret** to the credential/token expected by that endpoint.
* Use **API Key** only if your endpoint requires it.

Do not add undocumented fields; map provider-side delegated credentials to Flashgate's existing endpoint + secret/token inputs.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.flashback.tech/guides/configure-external-delegated-credentials/configure-delegated-access-for-aws-bedrock.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.