Skip to main content
Goal: Connect with a short-term Bedrock API key and run a task through your AWS account. AWS bills model usage; Millwork charges the platform fee when it accepts a live run. You are done when: the CLI shows the model’s answer and a receipt naming AWS Bedrock, with that model selected for your next task. Connecting alone does not call a model.

​
Before you begin

Use the generated Bedrock API key on Millwork’s private setup page. For an existing AWS STS workflow, see Use AWS STS credentials. The region in the ARN is where requests enter Bedrock. A cross-Region profile can send them to models in other Regions; check its routing Regions against your organization’s data requirements before connecting.

​
Connect and run a task

1

Check AWS availability and choose a model

Continue when the available providers include aws_bedrock. If it is absent, contact support about AWS access for your organization. A saved AWS connection may still appear separately; use its connection ID to manage it.Start the guided setup with a Bedrock API key:
Choose the model served by your profile from the Bedrock models shown. Review the provider and model before approving setup. Keep the Application: ID to return to this same setup if your terminal closes. Setup may reuse an existing connection or saved setup. Check its provider, model and connection method, then follow the next step printed in the terminal. Existing STS connections keep that method.
2

Enter the Bedrock API key privately

If setup asks for credentials, open the link printed in your terminal. Sign in to the same Millwork organization whose API key you configured. If this saved connection uses STS, enter its STS fields and continue the same setup. For the API-key method, enter:Enter the profile ARN, not a model name or a foundation-model ARN. This form needs only these three values; no AWS access key ID, session token or expiration is needed for the API-key method.Millwork uses the key for at most 12 hours after you save it. AWS can expire or reject it sooner. When access expires, replace the key on this connection. Millwork does not refresh it automatically.Keep the key and private setup link out of chat. The link’s deadline is for completing the browser step; it does not extend the key’s use window.
3

Return to the same setup

After saving, return to the terminal where you started. Millwork checks the profile and loads the supported models it can use. These are metadata requests. The model run comes next, with a separate approval.If the terminal stopped, use the printed continuation command with the same application ID. To inspect without continuing, use millwork tenant show --application-id "<application ID>" --json. Interrupted setup explains recovery when you lost the ID.
4

Approve the model run and read the answer

The free test run (the API calls it Echo) checks the Millwork API lifecycle without calling a model. The CLI then asks separately before running your Bedrock model.Review the model and provider, data rules, runtime limit, Millwork platform fee and model-usage budget before answering y. AWS bills model usage under your account. Millwork’s recorded model cost is an estimate, not your AWS bill. A model call already running can exceed the budget; reaching it stops further calls. The platform fee is separate.If Millwork credit is needed, add credit and continue the same setup. Review its current spending proposal after returning. A new spending approval does not renew AWS access.Expected result: First live result ready., followed by the answer and receipt. Check that Provider: is aws_bedrock and the model is the one you selected. The receipt records the run without storing its prompt or answer. Keep the run and connection IDs if you need help.

​
Use AWS STS credentials (advanced)

Choose this method explicitly if your organization supplies temporary AWS STS credentials instead of a Bedrock API key:
Use your organization’s AWS process to obtain one temporary session allowed to read the selected profile and invoke its model. You need all three credentials and the actual expiration from that session. If your AWS process does not show the expiration, ask your administrator how to obtain it.

​
STS setup fields

Enter these values on the private setup page: Copy the expiration AWS supplied; choosing a later time does not extend it. Return to the same terminal and follow its next step. The model run still needs its own spending approval. In a script, include --auth-scheme aws_sts_sigv4 when requesting and applying the plan; follow Choose a provider and model in a script. Once setup starts, continue with its saved application ID.

​
Renew AWS access

For an API-key connection, generate a fresh short-term Bedrock key in the same Region. For an STS connection, obtain a fresh complete temporary session with its actual expiration. Keep the same region and exact inference-profile ARN, then replace access on the existing connection:
The private form keeps this connection’s method: enter a new Bedrock API key or the new STS session it asks for. Renewal does not switch between the two. Millwork tests the replacement before using it. A failed replacement keeps the previous settings; renew expired access before another model run. Millwork does not renew AWS access automatically. Replacing a short-term key or session does not end the old one in AWS; its existing expiration still applies. Short-term Bedrock keys have no individual delete control. The replacement has its own continuation command, request key and handoff ID. Keep those values to resume it; do not start another connection. Replacing access does not approve a paid run or select another model.

​
Use a different inference profile

Renewal keeps a connection’s method, region and exact profile. To use another profile, first check with support that Millwork supports its model and routing Regions. Then create a separate connection through Connect through the REST API:
  1. Follow that guide’s prerequisites and provider discovery. In its secure-setup request, use "source_id": "aws_bedrock" and "auth_scheme": "api_key". For the advanced STS method, explicitly use "auth_scheme": "aws_sts_sigv4".
  2. Enter the new profile’s region and full ARN with the Bedrock API key or STS credentials requested by that method on the private browser page.
  3. Keep the completed response’s source_scope unchanged. Create the connection with a name you will recognize, such as AWS project account, in place of OpenAI account.
  4. Test the new connection and refresh its models. Keep its new CONNECTION_ID and follow Run a model to select a model from that connection and approve its run.
Your existing connection and saved setup stay in place. The new connection is used only when you select one of its models.

​
If setup or a run fails

For the API-key method, ask your administrator to check bedrock:CallWithBearerToken as well as the operation you are trying to perform. Reading profile information and running a model need different AWS permissions. Ask your administrator to check bedrock:GetInferenceProfile for setup and bedrock:InvokeModel for the model run, including the profile’s underlying models and routing Regions. AWS describes the profile permissions and Converse permission. If a short-term Bedrock key is exposed, ask your AWS administrator to follow AWS’s compromised-key guidance. For STS, use AWS’s role-session controls. These actions can affect other keys or workloads. Disconnecting in Millwork disables the saved connection; it does not revoke credentials in AWS. Follow Data and credentials for the immediate response.

​
Run your next task

Send another task from the CLI using the selected model. To call the REST API, find this connection with millwork provider list and set its ID in your terminal:
Continue in that terminal with Run a model. It filters the catalog to this connection and pins the run to the model you choose.