Skip to main content
Unlisted page
This page is unlisted. Search engines will not index it, and only users having a direct link can access it.

Amazon Bedrock adapter status: not available

Keeptrusts recognizes Amazon Bedrock targets and implements AWS SigV4 signing for InvokeModel. The current request translation does not yet construct a complete Bedrock model body, so this page intentionally stops at configuration linting.

:::danger Do not adopt this integration

This is an implementation-status record, not a customer integration guide. Configuration linting proves only that the YAML is structurally valid. It does not make the adapter usable. Choose a currently supported provider for live traffic.

:::

Use this status record when​

  • You are reviewing the Bedrock adapter before rollout.
  • You want a lintable provider declaration with explicit region ownership.
  • You need to understand why the current adapter must not receive production traffic.

Lint the provider declaration​

The region in base_url and aws_region must match. Replace the model placeholder with the Bedrock model ID you intend to validate after the runtime is fixed.

pack:
  name: aws-bedrock-integration
  version: 1.0.0
  enabled: true
policies:
  chain:
    - prompt-injection
    - pii-detector
    - audit-logger
providers:
  targets:
    - id: aws-bedrock-primary
      provider: aws-bedrock
      model: "replace-with-bedrock-model-id"
      base_url: https://bedrock-runtime.us-east-1.amazonaws.com
      aws_region: us-east-1
kt policy lint --file policy-config.yaml

Linting verifies the public configuration shape. It does not sign or send an AWS request.

Current implementation status​

AreaProven behavior
Provider aliasaws-bedrock resolves to the Bedrock provider profile
Upstream path/model/{model}/invoke
AuthenticationAWS SigV4 using an explicit aws_region, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and optional AWS_SESSION_TOKEN
Runtime request handlingThe Bedrock runtime passes the translated body through unchanged

:::warning Confirmed non-runnable path

The provider profile selects Anthropic-format translation, but that translation does not add Bedrock's required anthropic_version field. The Bedrock runtime then passes the incomplete body through unchanged. Other Bedrock model families are not proven because the same profile is fixed to Anthropic format. Do not route production requests through this target until the owning adapter and integration tests cover the selected Bedrock request body.

:::

Production checks after the runtime is fixed​

  • Verify the model ID, region, IAM permissions, and request schema in current Amazon Bedrock documentation.
  • Use a separate client API token for application requests; do not reuse the gateway runtime token.
  • Validate SigV4, temporary credentials, streaming, tools, and policy behavior end to end.
  • Supply AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY to the gateway process, plus AWS_SESSION_TOKEN for temporary credentials. The current signer does not load AWS profiles, SDK default-chain credentials, or instance roles.

Next steps​