Set up AWS Bedrock

Who this is for: anyone whose company runs models in AWS Bedrock and wants SpiderGate to call them with its own AWS account.

What this does: walks you through making an IAM user with invoke-only permissions, creating its access key, and adding it to your SpiderGate vault.

Before you begin

An AWS account with a valid payment method for AWS Marketplace purchases. AWS says that, with the right Marketplace permissions, "Access to many Amazon Bedrock foundation models is enabled by default".
For Anthropic models, the First Time Use form, submitted from the model catalogue in the Bedrock console.
Permission to create IAM users and access keys.
About 15 minutes.

Limits and terms to know first

Warning: AWS recommends against long-lived access keys: "use temporary security credentials (such as IAM roles) instead of creating long-term credentials like access keys", and "Do NOT use your account's root credentials to create access keys." SpiderGate's Bedrock form takes an access key pair, so create a dedicated IAM user that can only invoke models.

The first call to a third-party model starts a Marketplace subscription in the background, which AWS says can take "up to 15 minutes".

Steps

Step 1 — Create an invoke-only IAM user

In IAM, create a user for SpiderGate and attach a policy that allows only invoking models. AWS's own minimal example allows:

{
  "Effect": "Allow",
  "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
  "Resource": [
    "arn:aws:bedrock:*::foundation-model/*",
    "arn:aws:bedrock:<region>:<account-id>:inference-profile/*"
  ]
}

AWS's example also lets the user view and subscribe to Marketplace offers when called through Bedrock, which third-party models need on first use. To limit the user to certain models, replace Resource with those models' ARNs.

Step 2 — Create the access key

In IAM, choose Users, open the user, and on the Security credentials tab choose Create access key. Choose Other, then Next. Choose Show or Download .csv file. AWS says "This is your only time to view or download the newly created access key".

Step 3 — Add it in SpiderGate

Open Gate → Vault (/dashboard/gate/vault) and click Add Provider. Pick AWS Bedrock from the Enterprise group, then fill in Access Key ID, Secret Access Key, Region (for example us-east-1) and a Label. Under Routing, turn Share with SpiderIQ key pool off, so the key stays with your brand. Click Add key.

Verify it worked

SpiderGate has no live check for Bedrock yet, so it saves the key without testing it. To test it, give the key a slot in one of your own routing aliases and send one request; the trace shows whether Bedrock answered.

Troubleshoot

The first request to a third-party model fails. The Marketplace subscription may still be setting up. AWS says this takes up to 15 minutes.

Anthropic models refuse every request. Submit the First Time Use form from the Bedrock model catalogue.

Access denied. The IAM policy does not allow bedrock:InvokeModel on that model or region. Check the Resource list.