Skip to main content
Goal: Connect with a short-term Bedrock API key and run a task through your AWS account. AWS bills model usage; Millwork charges the platform fee when it accepts a live run. You are done when: the CLI shows the model’s answer and a receipt naming AWS Bedrock, with the certified Bedrock model Millwork offers ready for your next task. Connecting alone does not call a model.

​
Before you begin

Install the CLI and configure your Millwork API key for the organization you want to use. Before generating an AWS key, check which providers you can connect:
Continue when the available providers include aws_bedrock. If it is absent, contact support about AWS access for your organization. A saved AWS connection may still appear separately; use its connection ID to manage it. Then prepare your AWS account and key:
  • Have access to the AWS system-defined profile for the certified Bedrock model Millwork offers. Millwork lists the profiles available to your key and matches the exact certified profile; you do not need to find or paste its ARN.
  • Sign in to the AWS account you want billed for model usage, with permission to use that profile and model. The IAM principal that generates a short-term key must allow bedrock:CallWithBearerToken, bedrock:ListInferenceProfiles, bedrock:GetInferenceProfile, and bedrock:InvokeModel; the key inherits those permissions. The similarly named bedrock-mantle:CallWithBearerToken permission is for Mantle. It does not authorize the Bedrock profile lookups or model requests Millwork uses. In the Bedrock console, switch to us-east-1 for the default path, or to the source Region you want to use. Then choose API keys → Short-term API keys → Generate short-term API keys. Follow AWS’s key-generation instructions if you need help.
Use the generated Bedrock API key on Millwork’s private setup page. For an existing AWS STS workflow, see Use AWS STS credentials. Millwork connects to standard Amazon Bedrock, not Bedrock Mantle. It uses the Bedrock control plane at bedrock.<region>.amazonaws.com to list and check inference profiles, and Bedrock Runtime at bedrock-runtime.<region>.amazonaws.com to send model requests. A successful Mantle request does not show that this connection will work. The optional Region is the source Region, where requests enter Bedrock. It must match the Region where you generated the key. Leave it blank only for a key generated in us-east-1; otherwise enter that commercial AWS Region as given. For geographic processing requirements, check AWS’s routing Regions. A Global profile can process requests worldwide across commercial AWS Regions; its listed model Regions are not a fixed destination list. Use the API-key method for a Global profile, and use it only when worldwide processing fits your data requirements.

​
Connect and run a task

1

Start setup

Start the guided setup with a Bedrock API key:
Review AWS Bedrock and the certified Bedrock model Millwork offers before approving setup. Keep the Application: ID to return to this same setup if your terminal closes. Setup may reuse an existing connection or saved setup. Check its provider, model and connection method, then follow the next step printed in the terminal. Existing STS connections keep that method.
2

Enter the Bedrock API key privately

If setup asks for credentials, open the link printed in your terminal. Sign in to the same Millwork organization whose API key you configured. If this saved connection uses STS, enter its STS fields and continue the same setup. For the API-key method, enter:Do not paste an inference-profile ARN. Millwork uses the key to list the system-defined profiles available in your account and matches the certified profile for the certified Bedrock model Millwork offers. No AWS access key ID, session token or expiration is needed for the API-key method.Millwork uses the key for at most 12 hours after you save it. AWS can end access sooner, including when the session used to generate the key expires. When access expires, replace the key on this connection. Millwork does not refresh it automatically.Keep the key and private setup link out of chat. The link’s deadline is for completing the browser step; it does not extend the key’s use window.
3

Return to the same setup

When you save the form, Millwork lists the system-defined profiles available to your key and saves the unique profile that matches the certified Bedrock model Millwork offers. After saving, return to the terminal where you started. Millwork rechecks that exact profile; it does not choose a different model. These metadata requests do not call the model. The model run comes next, with a separate approval.If the terminal stopped, use the printed continuation command with the same application ID. To inspect without continuing, use millwork tenant show --application-id "<application ID>" --json. Interrupted setup explains recovery when you lost the ID.
4

Approve the model run and read the answer

The free test run (the API calls it Echo) checks the Millwork API lifecycle without calling a model. The CLI then asks separately before running your Bedrock model.Review the model and provider, data rules, runtime limit, Millwork platform fee and model-usage budget before answering y. AWS bills model usage under your account. Millwork’s recorded model cost is an estimate, not your AWS bill. A model call already running can exceed the budget; reaching it stops further calls. The platform fee is separate.If Millwork credit is needed, add credit and continue the same setup. Review its current spending proposal after returning. A new spending approval does not renew AWS access.Expected result: First live result ready., followed by the answer and receipt. Check that Provider: is aws_bedrock and Model: names the certified Bedrock model Millwork offers. The receipt records the run without storing its prompt or answer. Keep the run and connection IDs if you need help.

​
Use AWS STS credentials (advanced)

Choose this method explicitly if your organization supplies temporary AWS STS credentials instead of a Bedrock API key:
Use your organization’s AWS process to obtain one temporary session allowed to read the selected profile and invoke its model. You need all three credentials and the actual expiration from that session. If your AWS process does not show the expiration, ask your administrator how to obtain it.

​
STS setup fields

Enter these values on the private setup page: Copy the expiration AWS supplied; choosing a later time does not extend it. Return to the same terminal and follow its next step. The model run still needs its own spending approval. In a script, include --auth-scheme aws_sts_sigv4 when requesting and applying the plan; follow Choose a provider and model in a script. Once setup starts, continue with its saved application ID.

​
Renew AWS access

For an API-key connection, generate a fresh short-term Bedrock key in the same AWS account and Region. Millwork lists the profiles again and requires the same certified profile. For an STS connection, obtain a fresh complete temporary session with its actual expiration. Keep the same region and exact inference-profile ARN. Then replace access on the existing connection:
The private form keeps this connection’s method: enter a new Bedrock API key or the new STS session it asks for. Renewal does not switch between the two. Millwork tests the replacement before using it. A failed replacement keeps the previous settings; renew expired access before another model run. Millwork does not renew AWS access automatically. Replacing a short-term key or session does not end the old one in AWS; its existing expiration still applies. Short-term Bedrock keys have no individual delete control. The replacement has its own continuation command, request key and handoff ID. Keep those values to resume it; do not start another connection. Replacing access does not approve a paid run or change the certified Bedrock model Millwork offers.

​
Use a different source Region or profile

Renewal keeps a connection’s method, region and the same certified Bedrock model Millwork offers. The API-key path matches that model against the current certified Bedrock offerings. To use another source Region, or another profile through advanced STS, first check with support that Millwork supports it. Check where the new profile may process requests against your data requirements. Then create a separate connection through Connect through the REST API:
  1. Follow that guide’s prerequisites and provider discovery. In its secure-setup request, use "source_id": "aws_bedrock" and "auth_scheme": "api_key". For the advanced STS method, explicitly use "auth_scheme": "aws_sts_sigv4".
  2. For an API key, enter the new source Region and let Millwork list the available profiles and match the certified Bedrock model Millwork offers. For STS, enter the new profile’s region and full ARN with the credentials requested on the private browser page.
  3. Keep the completed response’s source_scope unchanged. Create the connection with a name you will recognize, such as AWS project account, in place of OpenAI account.
  4. Test the new connection and refresh its models. Keep its new CONNECTION_ID and follow Run a model to use the certified Bedrock model available through that connection and approve its run.
Your existing connection and saved setup stay in place. The new connection is used only when you run the certified Bedrock model available through it.

​
If setup or a run fails

For the API-key method, ask your administrator to check the standard Bedrock permission bedrock:CallWithBearerToken as well as the operation you are trying to perform. Mantle uses a separate bedrock-mantle:CallWithBearerToken permission. It cannot replace bedrock:CallWithBearerToken for Millwork’s Bedrock profile lookups or model requests. Reading profile information and running a model need different AWS permissions. Ask your administrator to check bedrock:ListInferenceProfiles for API-key setup, bedrock:GetInferenceProfile for connection checks and bedrock:InvokeModel for the model run, including the profile’s underlying models. For a Global profile, also check AWS’s Global inference permissions. AWS describes the profile permissions and Converse permission. If a short-term Bedrock key is exposed, ask your AWS administrator to follow AWS’s compromised-key guidance. For STS, use AWS’s role-session controls. These actions can affect other keys or workloads. Disconnecting in Millwork disables the saved connection; it does not revoke credentials in AWS. Follow Data and credentials for the immediate response.

​
Run your next task

Send another task from the CLI using the certified Bedrock model Millwork offers. To call the REST API, find this connection with millwork provider list and set its ID in your terminal:
Continue in that terminal with Run a model. It filters the catalog to this connection and pins the run to the certified Bedrock model Millwork offers.