Integrations · AWS Bedrock
Guild agents call models on AWS Bedrock in your own AWS account. Guild assumes an IAM role you create, matched by an external ID, so it never stores long-lived AWS keys. AWS bills the calls to your account.
Book a demo
See how teams govern agents that use AWS Bedrock.
Start free
Connect AWS Bedrock and scope your first agent.
Your AWS account, your IAM role
A Bedrock credential is a role ARN and a region, not a secret. The role’s trust policy names Guild’s principal and an external ID from the form, and one role can serve every Bedrock credential on the same Guild account. Six publishers route through it: Anthropic, OpenAI, DeepSeek, Alibaba, Moonshot AI, and Z.ai.How it works
1
Start the credential
In Access & setup > Models & providers, click Add API key and choose AWS Bedrock. Copy the Principal and External ID the dialog shows.
2
Create the role in AWS
Create an IAM role that can invoke the Bedrock models you want, and trust the principal with the external ID. Paste its ARN into IAM role ARN and pick an AWS region.
3
Choose publishers and policies
Check each publisher under Models, click Add Key, then add model policies that decide which workspaces and agents may call which models.
Every AWS Bedrock call goes through your policies
Agents never hold the key. Guild stores the credential server-side and shows only a masked value, so you can rotate it without touching agent code or the model policies bound to it. Policies are an allowlist: a workspace, agent, or installed agent can call a model through it only if a rule allows it. Set a daily token limit to cap spend, and see each call by workspace, agent, and user in Usage. Every call assumes your role with a session name ofguild-<task-id>, so CloudTrail ties each Bedrock call to the Guild task that made it. Guild prefers a model’s regional us. inference profile over a global. one, which keeps requests on the continent your data-residency terms and regional IAM policies expect.
A raw API key in an agent’s environment reaches every model the key can. A policy reaches only the models you name.
About AWS Bedrock on Guild
Publishers on Bedrock
Guild routes six publishers through Bedrock. Models marked with a region list are only in those regions. The rest are in all four supported regions.
Guild refreshes this list from Bedrock’s catalog every day, so it can change. It keeps only models that are active and produce text. Bedrock also lists Llama models, but Guild doesn’t route Meta models through Bedrock, and Gemini models aren’t on Bedrock.
Connect Bedrock
1
Start the credential
Click Access & setup in the left nav, then Models & providers. Click Add API key and choose AWS Bedrock from the menu.
2
Copy Guild's values
Give the credential a Name. Under Add these to your role, copy the Principal and the External ID. Keep the dialog open.
3
Create the role in AWS
In your AWS account, create an IAM role that can invoke the Bedrock models you want. Set its trust policy to let the Principal assume it, and match the External ID with a
StringLike condition.4
Enter the role and region
Paste the role’s ARN, such as
arn:aws:iam::123456789012:role/GuildBedrock, into IAM role ARN. Enter the region to call Bedrock in, such as us-east-1, under AWS region. Pick a region that has the models you want.5
Choose publishers
Under Models, check each publisher this credential should reach, and keep or change each default model. Then click Add Key.
:* because Guild appends the credential’s ID when it assumes the role. One role can serve every Bedrock credential on the same Guild account.
If the dialog says the deployment has no AWS role configured, Bedrock can’t be connected on that deployment yet.
Regions and model IDs
A Bedrock credential names one region. Guild supportsus-east-1, us-east-2, us-west-1, and us-west-2. A model that isn’t in your credential’s region can’t be routed through it, so add a credential for another region if you need one. Write canonical model names, such as claude-sonnet-4-6 or deepseek-r1, in policies and llmPreferences. Guild maps each one to its Bedrock ID, such as us.anthropic.claude-sonnet-4-6 or us.deepseek.r1-v1:0.
When a model has an inference profile, Guild prefers the profile for your region’s geography, us., over a global. profile. A global profile can serve a request from another continent, which may break data-residency terms or IAM policies scoped to regional ARNs. Guild uses a global profile only when AWS publishes nothing narrower.
Audit calls in CloudTrail
Each call Guild makes assumes your role with a session name ofguild-<task-id>. To trace a Bedrock call back to the Guild task that made it, look for that session name in CloudTrail.
Frequently asked questions
Does Guild store AWS access keys?
Does Guild store AWS access keys?
No. Guild assumes an IAM role you create, matched by an external ID. There are no long-lived AWS keys to store or rotate.
Which AWS regions can I use?
Which AWS regions can I use?
Four US regions:
us-east-1, us-east-2, us-west-1, and us-west-2. Regions outside the US aren’t supported. A credential names one region, so add another credential to reach a model that isn’t in yours.Can I run Llama or Gemini models through Bedrock?
Can I run Llama or Gemini models through Bedrock?
No. Bedrock lists Llama models, but Guild doesn’t route Meta models through Bedrock, and Gemini models aren’t on Bedrock. Use OpenRouter for both.
What if the dialog says no AWS role is configured?
What if the dialog says no AWS role is configured?
Bedrock can’t be connected on that deployment yet.
Put a governed agent on AWS Bedrock this week
Book a demo
See how teams govern agents that use AWS Bedrock.
Start free
Connect AWS Bedrock and scope your first agent.