> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getmillwork.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect AWS Bedrock

> Connect with a short-term Bedrock API key, choose a model, and read its answer and receipt.

**Goal:** Connect with a short-term Bedrock API key and run a task through your AWS account. AWS bills model usage;
Millwork charges the platform fee when it accepts a live run.

**You are done when:** the CLI shows the model's answer and a receipt naming
AWS Bedrock, with that model selected for your next task. Connecting alone
does not call a model.

## Before you begin

* [Install the CLI](/get-started/tenant-start#run-your-next-task) and
  [configure your Millwork API key](/get-started/tenant-start#configure-your-api-key)
  for the organization you want to use.
* Have access to an AWS Bedrock inference profile. A profile identifies the
  model route you want AWS to use; you will need its full ARN and region.
  [List inference profiles in AWS](https://docs.aws.amazon.com/cli/latest/reference/bedrock/list-inference-profiles.html).
  If you are unsure which profile serves your model, ask your AWS administrator.
* Sign in to an AWS account allowed to use that profile and model. In the
  [Bedrock console](https://console.aws.amazon.com/bedrock), switch to the
  profile's Region. Choose **API keys → Short-term API keys → Generate
  short-term API keys**. Follow [AWS's key-generation instructions](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html#api-keys-gen-short)
  if you need help.

Use the generated Bedrock API key on Millwork's private setup page. For an
existing AWS STS workflow, see [Use AWS STS credentials](#use-aws-sts-credentials-advanced).

The region in the ARN is where requests enter Bedrock. A cross-Region profile
can send them to models in other Regions; check its
[routing Regions](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-support.html)
against your organization's data requirements before connecting.

## Connect and run a task

<Steps>
  <Step title="Check AWS availability and choose a model">
    ```bash theme={null}
    millwork provider list
    ```

    Continue when the available providers include `aws_bedrock`. If it is absent,
    [contact support](/help/contact) about AWS access for your organization. A saved
    AWS connection may still appear separately; use its connection ID to manage it.

    Start the guided setup with a Bedrock API key:

    ```bash theme={null}
    millwork provider connect aws_bedrock
    ```

    Choose the model served by your profile from the Bedrock models shown.
    Review the provider and model before
    approving setup. Keep the `Application:` ID to return to this same setup if
    your terminal closes. Setup may reuse an existing connection or saved setup.
    Check its provider, model and connection method, then follow the next step
    printed in the terminal. Existing STS connections keep that method.
  </Step>

  <Step title="Enter the Bedrock API key privately">
    If setup asks for credentials, open the link printed in your terminal. Sign
    in to the same Millwork
    organization whose API key you configured. If this saved connection uses STS,
    enter its [STS fields](#sts-setup-fields) and continue the same setup. For the
    API-key method, enter:

    | Field                 | What to enter                                                          |
    | --------------------- | ---------------------------------------------------------------------- |
    | Bedrock API key       | The short-term key you generated in the Bedrock console                |
    | AWS region            | The same Region used to generate the key and named in your profile ARN |
    | Inference profile ARN | The full ARN of the profile you intend to use                          |

    Enter the profile ARN, not a model name or a foundation-model ARN. This form
    needs only these three values; no AWS access key ID, session token or
    expiration is needed for the API-key method.

    Millwork uses the key for at most 12 hours after you save it.
    AWS can expire or reject it sooner. When access expires,
    [replace the key on this connection](#renew-aws-access). Millwork does not
    refresh it automatically.

    Keep the key and private setup link out of chat. The link's deadline is for
    completing the browser step; it does not extend the key's use window.
  </Step>

  <Step title="Return to the same setup">
    After saving, return to the terminal where you started. Millwork checks the
    profile and loads the supported models it can use. These are metadata
    requests. The model run comes next, with a separate approval.

    If the terminal stopped, use the printed continuation command with the same
    application ID. To inspect without continuing, use
    `millwork tenant show --application-id "<application ID>" --json`.
    [Interrupted setup](/get-started/tenant-start#continue-an-interrupted-setup)
    explains recovery when you lost the ID.
  </Step>

  <Step title="Approve the model run and read the answer">
    The free test run (the API calls it Echo) checks the Millwork API lifecycle
    without calling a model. The CLI then asks separately before running your
    Bedrock model.

    Review the model and provider, data rules, runtime limit, Millwork platform
    fee and model-usage budget before answering `y`. AWS bills model usage under
    your account. Millwork's recorded model cost is an estimate, not your AWS
    bill. A model call already running can exceed the budget; reaching it stops
    further calls. The platform fee is separate.

    If Millwork credit is needed, [add credit and continue the same setup](/get-started/tenant-start#add-credit-and-continue).
    Review its current spending proposal after returning. A new spending
    approval does not renew AWS access.

    **Expected result:** `First live result ready.`, followed by the answer and
    receipt. Check that `Provider:` is `aws_bedrock` and the model is the one you
    selected. The receipt records the run without storing its prompt or answer.
    Keep the run and connection IDs if you need help.
  </Step>
</Steps>

## Use AWS STS credentials (advanced)

Choose this method explicitly if your organization supplies temporary AWS STS
credentials instead of a Bedrock API key:

```bash theme={null}
millwork provider connect aws_bedrock \
  --auth-scheme aws_sts_sigv4
```

Use your organization's AWS process to
[obtain one temporary session](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)
allowed to read the selected profile and invoke its model. You need all three
credentials and the actual expiration from that session. If your AWS process
does not show the expiration, ask your administrator how to obtain it.

### STS setup fields

Enter these values on the private setup page:

| Field                   | What to enter                                              |
| ----------------------- | ---------------------------------------------------------- |
| Temporary access key ID | The access key ID from your temporary STS session          |
| Secret access key       | The secret from that same session                          |
| Session token           | The token from that same session                           |
| Session expiration      | The session's actual `Expiration`, including its time zone |
| AWS region              | The region named in your inference-profile ARN             |
| Inference profile ARN   | The full ARN of the profile you intend to use              |

Copy the expiration AWS supplied; choosing a later time does not extend it.
Return to the same terminal and follow its next step. The model run still
needs its own spending approval. In a script, include
`--auth-scheme aws_sts_sigv4` when requesting and applying the plan; follow
[Choose a provider and model in a script](/get-started/tenant-start#choose-a-provider-and-model-in-a-script).
Once setup starts, continue with its saved application ID.

<span id="renew-an-expired-session" />

## Renew AWS access

For an API-key connection, [generate a fresh short-term Bedrock key](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html#api-keys-gen-short)
in the same Region. For an STS connection, obtain a fresh complete temporary
session with its actual expiration. Keep the same region and exact
inference-profile ARN, then
[replace access on the existing connection](/cookbook/replace-a-provider-key#replace-access-from-your-terminal):

```bash theme={null}
millwork provider rotate "<AWS connection ID>"
```

The private form keeps this connection's method: enter a new Bedrock API key
or the new STS session it asks for. Renewal does not switch between the two.
Millwork tests the replacement before using it. A failed replacement keeps
the previous settings; renew expired access before another model run.

Millwork does not renew AWS access automatically. Replacing a short-term key
or session does not end the old one in AWS; its existing expiration still
applies. Short-term Bedrock keys have no individual delete control.

The replacement has its own continuation command, request key and handoff
ID. Keep those values to resume it; do not start another connection. Replacing
access does not approve a paid run or select another model.

## Use a different inference profile

Renewal keeps a connection's method, region and exact profile. To use another
profile, first check with [support](/help/contact) that Millwork supports its
model and routing Regions. Then create a separate connection through
[Connect through the REST API](/guides/connect-a-source#connect-through-the-rest-api):

1. Follow that guide's prerequisites and provider discovery. In its secure-setup
   request, use `"source_id": "aws_bedrock"` and `"auth_scheme": "api_key"`.
   For the advanced STS method, explicitly use `"auth_scheme": "aws_sts_sigv4"`.
2. Enter the new profile's region and full ARN with the Bedrock API key or
   STS credentials requested by that method on the private browser page.
3. Keep the completed response's `source_scope` unchanged. Create the connection
   with a name you will recognize, such as `AWS project account`, in place of
   `OpenAI account`.
4. Test the new connection and refresh its models. Keep its new `CONNECTION_ID`
   and follow [Run a model](/get-started/builder) to select a model from that
   connection and approve its run.

Your existing connection and saved setup stay in place. The new connection
is used only when you select one of its models.

## If setup or a run fails

| What happened                                            | What to do                                                                                                                                                                                                    |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The private setup link expired                           | Inspect the same application or replacement before requesting another browser step. This does not renew AWS access.                                                                                           |
| AWS rejected the key or session, or its use window ended | Before connection creation, correct the credentials through the same saved setup's browser step. After creation, [renew access on that connection](#renew-aws-access). Keep its method, region and profile.   |
| AWS denied access to the profile or model                | Ask your AWS administrator to check permissions for that exact profile and its model, including bearer-key permission when using an API key. A passing metadata check does not grant permission to invoke it. |
| The profile or region does not match                     | Check the full profile ARN and its region in AWS. To change either, [connect the different profile](#use-a-different-inference-profile).                                                                      |
| The check passed but no model appeared                   | Confirm the intended profile and model access, then ask Millwork support about that model. Replacing valid credentials does not add model support.                                                            |
| A paid run failed                                        | Inspect its status and receipt before another attempt. Check the reported cause and approve any new paid request explicitly.                                                                                  |

For the API-key method, ask your administrator to check
[`bedrock:CallWithBearerToken`](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-permissions.html)
as well as the operation you are trying to perform.
Reading profile information and running a model need different AWS permissions.
Ask your administrator to check `bedrock:GetInferenceProfile` for setup and
`bedrock:InvokeModel` for the model run, including the profile's underlying
models and routing Regions. AWS describes the
[profile permissions](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-prereq.html)
and [Converse permission](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Converse.html).

If a short-term Bedrock key is exposed, ask your AWS administrator to follow
[AWS's compromised-key guidance](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-revoke.html).
For STS, use AWS's [role-session controls](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html).
These actions can affect other keys or workloads. Disconnecting in Millwork disables the saved connection; it
does not revoke credentials in AWS. Follow
[Data and credentials](/guides/security-and-data#if-a-credential-may-be-exposed)
for the immediate response.

## Run your next task

[Send another task from the CLI](/get-started/tenant-start#run-your-next-task)
using the selected model.

To call the REST API, find this connection with `millwork provider list` and
set its ID in your terminal:

```bash theme={null}
export CONNECTION_ID="<AWS connection ID from the list>"
```

Continue in that terminal with [Run a model](/get-started/builder). It filters
the catalog to this connection and pins the run to the model you choose.