Amazon Bedrock: IAM credentials

Amazon Bedrock is a fully managed AWS service that gives you access to leading generative models such as Anthropic Claude and Amazon Nova. This page is for organizations with an established AWS environment (IAM roles, AWS SSO, AWS Organizations, and so on) that need secure, compliant access.

Step 1: Prepare your AWS environment

Create or reuse an IAM user or role

1. Sign in to the AWS Management Console.

2. Search for IAM in the console.

3. Create a new IAM user, or use your enterprise AWS SSO to assume a role dedicated to Bedrock access. See the IAM User Guide.

Attach the required policies

Dline needs these minimal permissions to invoke models:

• bedrock:InvokeModel
• bedrock:InvokeModelWithResponseStream

Option 1: Minimal permissions (recommended for production)

1. Create a new policy in the AWS IAM console.

2. Paste this policy into the JSON editor:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
         "Resource": "*"
       }
     ]
   }

   For better security, scope Resource to specific model ARNs.

3. Name the policy (for example DlineBedrockInvokeAccess) and attach it to your IAM user or role.

Option 2: Managed policy (simpler initial setup)

You can instead attach the AWS managed policy AmazonBedrockLimitedAccess. It grants broader permissions, including listing models and managing provisioned throughput, which suits an initial setup or teams that need those capabilities.

Note

• Model listing: The minimal permissions are enough to invoke models. If you want Dline to list available Bedrock models dynamically, you may also need permissions such as bedrock:ListFoundationModels.
• Third-party models: Models such as Anthropic Claude need an active AWS Marketplace subscription, usually managed under Model access in the Bedrock console. If that has not been handled, you may need the aws-marketplace:Subscribe permission.
• Enterprise tip: Always apply least privilege. Scope resource ARNs in your policies to specific models or regions where possible, and use Service Control Policies (SCPs) for governance across AWS Organizations.

Step 2: Confirm region and model access

1. Choose a region: Bedrock is available in many regions. Pick one that meets your latency and compliance needs; see AWS Global Infrastructure.

2. Confirm model access: In the Bedrock console, check that the models your team needs (for example Anthropic Claude or Amazon Nova) are marked “Access granted”. Some models are only reachable through an inference profile; in that case, check Use cross-region inference in Dline.

3. Subscribe to third-party models (if needed): Accept the third-party provider’s terms (for example Anthropic’s) on the model subscription page of the Bedrock console; see AWS Marketplace. Enterprises often manage subscriptions centrally, so check with your cloud team first.

Step 3: Configure Dline

If Dline is not installed yet, see Installing Dline first.

1. Click the Settings button in the Dline panel title bar.

2. Set Provider to Amazon Bedrock.

3. Choose AWS Credentials as the authentication method and fill in AWS Access Key and AWS Secret Key. For temporary credentials, such as those issued by AWS SSO, also fill in AWS Session Token.

4. Select or type a region under AWS Region, for example us-east-1 or your enterprise-approved region.

5. Select a model under Model.

6. Send a simple prompt to test the connection, for example “Write a Python function that checks whether a number is prime.”

If you leave the keys empty, Dline uses the default AWS credential provider chain.

Step 4: Security and operations

• Access: Prefer AWS SSO or federated roles over long-lived IAM credentials; see IAM best practices. With SSO, the AWS CLI profile method is recommended.
• Network: Consider AWS PrivateLink, then check Use custom VPC endpoint in Dline and enter the endpoint address.
• Monitoring: Enable CloudTrail to log Bedrock API calls, use CloudWatch to track invocation count, latency, and token usage, and set alerts for abnormal activity.
• Cost: Use AWS Cost Explorer and set billing alerts; see AWS Cost Management.
• Audits: Review IAM roles and CloudTrail logs regularly and follow your organization’s data privacy and governance policies.