AWS Bedrock

Separate the hosting platform from model providers

Amazon Bedrock is AWS's managed multi-provider foundation-model platform, not a model originator. One AWS service can expose models from Amazon, Anthropic, Meta, Mistral, and others; verify the author, license, region, capability, and price for the exact modelId. This site's /v1/chat/completions is an adapted gateway route, not a Bedrock-native URL, and represents only the models enabled by the current channel.

Direct access has two authentication choices

The traditional path uses IAM credentials and AWS Signature Version 4 (SigV4) request signing. Bedrock also supports API keys: a short-term key inherits IAM permissions and region and lasts no more than 12 hours, subject to the current IAM session duration. AWS prefers short-term credentials for production; long-term keys are better limited to initial exploration, with production moved to short-lived credentials, least privilege, rotation, and secret management. A Bedrock API-key Bearer value, AWS IAM credentials, and this site's API key are not interchangeable.

Model access can involve subscription and an EULA

Having API permissions does not guarantee that every third-party model is immediately callable. A first invocation can initiate an AWS Marketplace subscription and signifies acceptance of the applicable end-user license agreement; selected providers also require first-use information. For AccessDeniedException, check IAM, Marketplace permissions, region, model-access conditions, and provider requirements instead of merely rotating the key.

Choose Converse, InvokeModel, or asynchronous jobs

Converse/ConverseStream provides a more uniform message shape across models and is useful for chat or reduced migration work, but does not make tool or content support identical. InvokeModel/InvokeModelWithResponseStream uses the model-native payload for synchronous or streaming inference and provider-specific parameters. Asynchronous capabilities such as video use StartAsyncInvoke to create a job followed by result retrieval; do not wait for them with a synchronous response parser.

modelId is not always a base-model name

The request can identify a base-model ID or ARN, an inference profile, provisioned throughput, or another deployed model resource. Confirm region and inference mode before copying an example, and persist the effective resource identifier, request ID, latency, and usage. Run regression tests when aliases or versions move.

Limits, cost, and security

For 401/403, check credentials, IAM, and model access; for 404, check region and resource identifier; for 429, lower concurrency according to AWS guidance; retry only transient 5xx failures with bounded exponential backoff and jitter. Configure service quotas, budget alerts, CloudTrail/CloudWatch, input and output limits, and sensitive-data controls. Guardrails are an additional control, not a replacement for application authorization, audit, or content safety.