Bedrock workload identity

The bedrock connection profile calls AWS Bedrock in your AWS account. RouterPlus signs each call with AWS SigV4, using temporary credentials from AssumeRole on a role you own. You store no AWS key with RouterPlus.

The model mapping and the AWS region are part of the connection and cannot change. Check that the model is available and that your account has access in the region you choose.

Set up the AWS role

1. 01
   Create a role in your account. Its trust policy names the RouterPlus source role and requires sts:ExternalId equal to tm:<org UUID>.
2. 02
   Allow bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream only on the regional foundation-model ARNs you approve.
3. 03
   Ask RouterPlus to grant your organization that role ARN. The console offers the Bedrock profile only to an organization with a grant.

How RouterPlus operators grant a role:

• The gateway gets its own AWS credentials from its instance role through IMDSv2. It uses no static AWS key from the environment.
• The instance role gets sts:AssumeRole on your exact role ARN.
• The grant map is set on both gateway processes, and takes effect after a restart:

TM_BEDROCK_ROLE_GRANTS='{"ORG_UUID":["arn:aws:iam::123456789012:role/tm-customer"]}'

• An organization cannot register or use another organization's role without a grant.
• The grant map does not replace AWS IAM authorization. Keep trust grants least-privilege, with a distinct external ID per organization.

Create and validate

Send POST /api/connections with the same session and Origin headers as other connection management calls. In the console, open Access > Provider connections. Replace the example model with a regional model your account can invoke.

{
  "profile": "bedrock",
  "models": ["your-public-model-id"],
  "endpoint_config": {
    "region": "us-east-1",
    "deployments": {
      "your-public-model-id": "anthropic.claude-3-haiku-20240307-v1:0"
    }
  },
  "workload_role": {
    "role_arn": "arn:aws:iam::123456789012:role/tm-customer"
  }
}

workload_role is write-only. RouterPlus encrypts it with envelope encryption. Do not send api_key, AWS access keys, an external ID override, a bearer token or a request-time credential.

Then:

1. 01
   Call POST /api/connections/<id>/validate. It checks that RouterPlus can assume the role, and makes no billable completion. An active result does not prove model access, capacity, private connectivity, processing residency or ZDR.
2. 02
   Declare a quota pool with provider:"bedrock" and bind it.
3. 03
   Bind the connection or a policy to a virtual key.
4. 04
   Run one small real request to confirm model permissions and streaming.

Runtime behavior

Credentials:

• STS uses the regional endpoint, 15-minute sessions and an external ID bound to your organization.
• Temporary credentials live only in process memory, with at most 256 sessions and 64 concurrent refreshes.
• They refresh at least one minute before expiry.
• They are never written to a database, cache, log or telemetry.

Requests:

• The AWS clients make one attempt each. The gateway owns retries. SDK retries and endpoint overrides from the environment are off.
• The gateway records the request before it assumes the role and calls the model. Authorization and admission checks still run before the signed call.
• A credential failure before inference counts as never dispatched.
• When the outcome of the inference call is uncertain, the normal usage reservation stays.
• The gateway turns AWS binary events into the Anthropic stream. After output starts, an error ends the request. There is no silent retry.
• The gateway does not relay AWS exception text, because it can echo sensitive input.

Billing and privacy:

• BYOK billing applies: RouterPlus charges 0.
• The AWS cost is unknown to RouterPlus.
• A regional endpoint is not a ZDR guarantee. Privacy and residency route filters still need provider facts that RouterPlus operators record.

References: AWS Claude request format, stream operation, Bedrock PrivateLink.