​

Set Up AWS Bedrock IAM Access

​

Prerequisites

• AWS Account access with administrative privileges to create IAM roles and policies
• Bedrock models enabled in your AWS account and region

​

Choose Your Authentication Method

​

Option 1: IAM Role ARN (Recommended for Production)

• Production environments
• Organizations that want to tightly scope permissions
• Scenarios requiring role-based access control

​

Option 2: Access Key (Simpler Setup)

• Quick setup and testing
• Development environments
• Scenarios where role assumption is not required

​

Option 1: IAM Role ARN Setup

​

Step 1: Create an IAM Policy for Bedrock Access

1. Log in to the AWS Console and navigate to IAM.
2. In the left sidebar, go to Policies → Create policy.
3. Select the JSON tab and paste the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BedrockInvokeAccess",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:*::foundation-model/*",
                "arn:aws:bedrock:*:*:inference-profile/*"
            ]
        }
    ]
}

4. Click Next.
5. Name the policy AiriaBedrockAccessPolicy (or your preferred name).
6. Add an optional description, then click Create policy.

​

Step 2: Create the Execution Role

1. In IAM, go to Roles → Create role.
2. Under Trusted entity type, select AWS account.
3. Select This account (since the IAM user you’ll create next will be in the same account).
4. Click Next.
5. On the Add permissions page, search for and select the AiriaBedrockAccessPolicy you created in Step 1.
6. Click Next.
7. Name the role AiriaBedrockExecutionRole (or your preferred name).
8. Add an optional description.
9. Click Create role.
10. Important: Copy the Role ARN (it will look like arn:aws:iam::123456789012:role/AiriaBedrockExecutionRole). You’ll need this in Step 5.

​

Step 3: Create an IAM User for Airia

1. In IAM, go to Users → Create user.
2. Enter the username AiriaBedrockUser (or your preferred name).
3. Click Next.
4. Under Set permissions, select Attach policies directly.
5. Click Create policy (this opens a new tab/window).
6. In the policy creation window:
   • Select the JSON tab
   • Paste the following JSON, replacing YOUR_ROLE_ARN with the Role ARN you copied in Step 2:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAssumeRole",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::123456789012:role/AiriaBedrockExecutionRole"
        }
    ]
}

7. Click Next, name the policy AiriaAssumeRolePolicy, and click Create policy.
8. Return to the user creation tab, refresh the policies list, and select AiriaAssumeRolePolicy.
9. Click Next, review your selections, and click Create user.

​

Step 4: Generate Access Keys

1. Click on the AiriaBedrockUser you just created.
2. Go to the Security credentials tab.
3. Scroll to Access keys and click Create access key.
4. Select Application running outside AWS (or Other).
5. Click Next, add an optional description tag, and click Create access key.
6. Important: Copy both the Access Key ID and Secret Access Key. You won’t be able to see the secret key again after closing this dialog.

​

Step 5: Configure Airia with Role ARN

1. Log in to your Airia platform.
2. Navigate to Models → filter by Provider Bedrock → select a Bedrock Model (such as Claude Sonnet 4.5)
3. Click on the model to edit it, or click Provide my own key if creating a new credential
4. In the credential configuration dialog, select Role ARN as the authentication method
5. Configure the following fields:
   • Name: Enter a descriptive name for this credential (e.g., “Bedrock Production ARN”)
   • Type: Should be set to “AWS Bedrock”
   • AWS Access Key: Enter the Access Key ID from Step 4
   • AWS Secret Key: Enter the Secret Access Key from Step 4
   • AWS Region: Enter the region where your Bedrock models are enabled (e.g., us-east-1, us-east-2, us-west-2)
   • Account number: Enter your AWS Account number (found in the top-right corner of your AWS Console)
   • IAM Role: Enter the role name from Step 2 (just the role name, not the full ARN - e.g., AiriaBedrockExecutionRole)
   • External ID: (Optional) Leave blank unless you configured an External ID condition in the role’s trust policy
   • Scope: Select whether this credential should be available to all projects or specific projects
6. Click Create to save the configuration.

​

Option 2: Access Key Setup

​

Step 1: Create an IAM Policy for Bedrock Access

​

Step 2: Create an IAM User for Airia

• Instead of creating a policy that allows assuming a role, attach the AiriaBedrockAccessPolicy directly to the user
• When setting permissions, search for and select the AiriaBedrockAccessPolicy you created in Step 1
• You do not need to create the AiriaAssumeRolePolicy or configure role assumption

​

Step 3: Generate Access Keys

​

Step 4: Configure Airia with Access Key

1. Log in to your Airia platform.
2. Navigate to Models → filter by Provider Bedrock → select a Bedrock Model (such as Claude Sonnet 4.5)
3. Click on the model to edit it, or click Provide my own key if creating a new credential
4. In the credential configuration dialog, select Access Key as the authentication method
5. Configure the following fields:
   • Name: Enter a descriptive name for this credential (e.g., “Bedrock Development Access Key”)
   • Type: Should be set to “AWS Bedrock”
   • AWS Access Key: Enter the Access Key ID from Step 3
   • AWS Secret Key: Enter the Secret Access Key from Step 3
   • AWS Region: Enter the region where your Bedrock models are enabled (e.g., us-east-1, us-east-2, us-west-2)
   • Scope: Select whether this credential should be available to all projects or specific projects
6. Click Create to save the configuration.

​

Configure the Bedrock Model in Airia

1. In Airia, navigate to Models → filter by Provider Bedrock
2. Select the Bedrock model you want to configure (e.g., “Claude Sonnet 4.5 ARN”)
3. Click to edit the model configuration
4. In the Edit Model dialog:
   • Display Name: Verify or update the model display name
   • Model ID: Verify the model ID (e.g., global.anthropic.claude-sonnet-4-5-20250929-v1:0)
   • Model Provider: Should be set to “Bedrock”
   • Credentials: Select “I have my own key”
   • Select credential: Choose the credential you created in the previous step (e.g., “Bedrock ARN” or “Bedrock Development Access Key”)
   • Model Endpoint: Verify the endpoint URL (e.g., https://bedrock.us-east-2.amazonaws.com)
   • Configure pricing, model input, and other settings as needed
5. Click Submit to save the model configuration

​

Verification

1. In Airia, test the Bedrock connection by adding a Model to your project
2. Create a test agent or workflow that uses a Bedrock model
3. Run a test query to confirm the model responds correctly.

​

Troubleshooting

​

Common Issues

• Verify the IAM policy is attached to the execution role
• Ensure the policy includes both bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream actions
• Check that the resource ARNs include both foundation-model/* and inference-profile/*

• Verify the IAM user has permission to assume the role (check AiriaAssumeRolePolicy)
• Ensure the IAM role name and account number are correct
• Verify the role’s trust policy allows the IAM user to assume it

• Confirm the Bedrock model is enabled in your AWS account and region
• For Anthropic Claude models, check if you need to complete the use case form in Bedrock Console
• Verify you’re using the correct region in your Airia configuration

​

Next Steps

• Add Bedrock models to your agents
• Configure agent prompts to use Bedrock models
• Test your agents to ensure proper model integration

​

Additional Resources

• AWS Bedrock Documentation
• AWS IAM Best Practices
• AWS Bedrock Model Access