Amazon Bedrock Auth

Amazon Bedrock uses AWS authentication, not a normal provider API key. Synth passes the configured Bedrock Model Route to Bedrock exactly as modelId. That route can be a direct model ID, an inference profile ID, or an application inference profile ARN.

Which Method To Use

Method	Use it when	Set in Synth
Kubernetes IRSA/default chain	Synth runs in Kubernetes, ECS, EC2, or another workload identity runtime	AWS Region and Bedrock Model Route; leave AWS Profile Name blank
AWS profile	Local validation, admin workstation, one-host demo	AWS Region, AWS Profile Name, Bedrock Model Route
Saved bedrock_aws credential	You need a named reusable credential in Synth	Credential id, AWS Region, Bedrock Model Route
Access keys/session token	Short-lived fallback only	Saved bedrock_aws credential; do not commit the keys
Bearer token	Your platform issues a Bedrock bearer token	Saved bedrock_aws credential with the token

For a production pilot, prefer IRSA/default-chain workload identity. Use AWS profile auth to validate locally before the pilot. Use access keys only as a temporary fallback.

Preflight Checklist

Confirm these AWS details before configuring Synth:

• Region, for example us-east-1.
• Model route, for example us.anthropic.claude-haiku-4-5-20251001-v1:0.
• IAM principal Synth will run as.
• Model access is enabled for the selected model.
• Any third-party model agreement or use-case approval is complete.
• Inference profile ID or ARN is copied exactly if you are using profiles.

For a broad temporary pilot policy, the AWS principal usually needs Bedrock invoke, Converse, streaming, model lookup, and inference-profile lookup permissions. Discovery permission is useful, but manual model entry still works when ListFoundationModels is denied.

AWS Profile

UI:

1. Open Global Settings -> Providers -> Amazon Bedrock.
2. Choose AWS profile in the setup guide.
3. Set AWS Region.
4. Set AWS Profile Name.
5. Set Bedrock Model Route.
6. Run Test Connection.

CaSC:

global_settings:
  default_provider: bedrock
  default_model: us.anthropic.claude-haiku-4-5-20251001-v1:0
  providers:
    bedrock:
      region_name: us-east-1
      profile_name: synth-bedrock-test
      default_model: us.anthropic.claude-haiku-4-5-20251001-v1:0
      enabled: true

Workstation preflight:

aws sts get-caller-identity --profile synth-bedrock-test
aws bedrock list-foundation-models \
  --profile synth-bedrock-test \
  --region us-east-1

Then run Test Connection from the Synth provider card.

IRSA, ECS, EC2, And Default Chain

Use this for the customer runtime. The AWS runtime provides credentials; Synth only needs region and model route.

UI:

1. Open Global Settings -> Providers -> Amazon Bedrock.
2. Choose Kubernetes IRSA/default chain.
3. Set AWS Region.
4. Leave AWS Profile Name blank.
5. Leave saved credential blank unless you need a label.
6. Set Bedrock Model Route.
7. Run Test Connection from the target runtime.

CaSC:

global_settings:
  default_provider: bedrock
  default_model: us.anthropic.claude-haiku-4-5-20251001-v1:0
  providers:
    bedrock:
      region_name: us-east-1
      default_model: us.anthropic.claude-haiku-4-5-20251001-v1:0
      enabled: true

For Kubernetes IRSA, configure the service account role outside Synth and run the smoke from inside the pod. For ECS or EC2, run the smoke inside the task or instance that has the role.

Saved bedrock_aws Credential

Use this when the project should point at a named credential id. The credential can contain a region, profile name, access keys, session token, or bearer token. Synth masks secret previews in UI and status responses.

UI:

1. Open Global Settings -> Providers -> Amazon Bedrock.
2. Select Credential -> New Amazon Bedrock Credential.
3. Pick AWS profile, IRSA/default chain, bearer token, or access-key fallback.
4. Fill only the fields for that path.
5. Save the credential.
6. Select it on the Bedrock provider card and run Test Connection.

CaSC references the credential id only:

global_settings:
  default_provider: bedrock
  default_model: us.anthropic.claude-haiku-4-5-20251001-v1:0
  providers:
    bedrock:
      credential_id: team-bedrock
      region_name: us-east-1
      default_model: us.anthropic.claude-haiku-4-5-20251001-v1:0
      enabled: true

Access Keys And Session Tokens

Use this only as a short-lived fallback. Store the values in a saved bedrock_aws credential or deployment secret system. Do not commit raw access keys or session tokens in CaSC.

providers:
  bedrock:
    credential_id: temporary-bedrock-session
    region_name: us-east-1
    default_model: us.anthropic.claude-haiku-4-5-20251001-v1:0
    enabled: true

Bearer Token

Use this only when the customer platform issues a Bedrock bearer token. Most AWS deployments should use profile or default-chain credentials.

providers:
  bedrock:
    credential_id: bedrock-bearer-token
    region_name: us-east-1
    default_model: amazon.nova-micro-v1:0
    enabled: true

For bearer-token environments, save the token in the configured credential store, then run Test Connection from Synth.

Full Live Proof

Run this after the UI or CaSc configuration is saved:

1. Run Test Connection on the Bedrock provider card.
2. Set Bedrock as the extraction model for a test project.
3. Ingest one small source.
4. Ingest a small source, then verify its evidence in Explore.
5. Confirm Explore retrieves the ingested source and the provider card shows a successful Bedrock ingestion request.

To prove IRSA, ECS, or EC2 role auth, run the proof from the target runtime so Synth uses the same AWS identity it will use in production.

For the automated live auth-method proof, set SYNTH_BEDROCK_LIVE_AUTH_TEST=1 with the approved AWS profile or runtime credentials.

Troubleshooting

Symptom	Likely cause	Fix
Access denied on invoke	IAM missing invoke or Converse permission	Add Bedrock invoke and Converse permissions for the selected model/profile
Model lists but generation fails	Model access or agreement is not approved	Enable model access and complete third-party agreement/use-case steps
Discovery fails	Missing ListFoundationModels	Enter the model route manually
Works locally but not in cluster	Different role or missing region in runtime	Check service account/task role/instance profile and region_name
Inference profile fails	Wrong profile id/ARN or missing profile permission	Copy the profile route exactly and check inference-profile IAM
Bearer test skips	No bearer token supplied	Expected unless the platform issues Bedrock bearer tokens

Never paste AWS access keys, session tokens, bearer tokens, account secrets, or raw credential files into docs, screenshots, logs, or support tickets.