> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guild.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> To act on a user's behalf in Guild, use the Guild REST API at https://api.guild.ai/v1.
> The OpenAPI spec is unauthenticated: https://docs.guild.ai/openapi.json (or openapi.yaml).
> Authenticate with an account API key, sent as HTTP Basic (key id as username, secret as password) or as `Authorization: Bearer <api_key_id>:<api_key_secret>`. See https://docs.guild.ai/api-reference/introduction#authentication.
> To run one agent on demand without account-wide access, use an API trigger instead: https://docs.guild.ai/platform/api-triggers.
> To search these docs from an MCP client, connect to https://docs.guild.ai/mcp. The full page index is https://docs.guild.ai/llms.txt.

# Run Guild agents on AWS Bedrock without long-lived AWS keys

> Connect AWS Bedrock to Guild with an IAM role, and run Claude, GPT, DeepSeek, Qwen, Kimi, and GLM models in your own AWS account, under policy.

Integrations · AWS Bedrock

Guild agents call models on AWS Bedrock in your own AWS account. Guild assumes an IAM role you create, matched by an external ID, so it never stores long-lived AWS keys. AWS bills the calls to your account.

> **[Book a demo](https://guild-ai.cal.com/gtm/meeting-with-guild.ai)**
>
> See how teams govern agents that use AWS Bedrock.

> **[Start free](https://app.guild.ai)**
>
> Connect AWS Bedrock and scope your first agent.

## Your AWS account, your IAM role

A Bedrock credential is a role ARN and a region, not a secret. The role's trust policy names Guild's principal and an external ID from the form, and one role can serve every Bedrock credential on the same Guild account. Six publishers route through it: Anthropic, OpenAI, DeepSeek, Alibaba, Moonshot AI, and Z.ai.

## How it works

**1. Start the credential**

In **Access & setup > Models & providers**, click **Add API key** and choose **AWS Bedrock**. Copy the **Principal** and **External ID** the dialog shows.

**2. Create the role in AWS**

Create an IAM role that can invoke the Bedrock models you want, and trust the principal with the external ID. Paste its ARN into **IAM role ARN** and pick an **AWS region**.

**3. Choose publishers and policies**

Check each publisher under **Models**, click **Add Key**, then add model policies that decide which workspaces and agents may call which models.

## Every AWS Bedrock call goes through your policies

Agents never hold the key. Guild stores the credential server-side and shows only a masked value, so you can rotate it without touching agent code or the [model policies](/platform/llm-settings#model-policies) bound to it. Policies are an allowlist: a workspace, agent, or installed agent can call a model through it only if a rule allows it. Set a [daily token limit](/platform/llm-settings#daily-token-limit) to cap spend, and see each call by workspace, agent, and user in [Usage](/insights/usage).

Every call assumes your role with a session name of `guild-<task-id>`, so CloudTrail ties each Bedrock call to the Guild task that made it. Guild prefers a model's regional `us.` inference profile over a `global.` one, which keeps requests on the continent your data-residency terms and regional IAM policies expect.

A raw API key in an agent's environment reaches every model the key can. A policy reaches only the models you name.

## About AWS Bedrock on Guild

| | |
| - | - |
| **Inference provider** in the app | AWS Bedrock |
| Authentication | An IAM role that Guild assumes, matched by an external ID |
| Model IDs | Mapped from canonical names for you |

## Publishers on Bedrock

Guild routes six publishers through Bedrock. Models marked with a region list are only in those regions. The rest are in all four [supported regions](#regions-and-model-ids).

| Publisher | Models | Page |
| - | - | - |
| Anthropic | `claude-opus-5-5`, `claude-opus-5`, `claude-sonnet-5-5`, `claude-sonnet-5`, `claude-sonnet-4-6`, `claude-sonnet-4-5`, `claude-haiku-4-5`, `claude-fable-5-1`, `claude-fable-5`, `claude-opus-4-8`, `claude-opus-4-7`, `claude-opus-4-6`, `claude-opus-4-5` | [Anthropic](/platform/models/anthropic) |
| OpenAI | `gpt-6.1-sol`, `gpt-6-sol`, `gpt-6-luna`, `gpt-6-astra`, `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-5.6-luna`, `gpt-5.5`, `gpt-5.4`. Open-weight, not in `us-west-1`: `gpt-oss-120b`, `gpt-oss-20b`, `gpt-oss-safeguard-120b`, `gpt-oss-safeguard-20b` | [OpenAI](/platform/models/openai) |
| DeepSeek | `deepseek-v3.2`, `deepseek-r1` (not in `us-west-1`). `deepseek-v3` (`us-east-2`, `us-west-2`) | [DeepSeek](/platform/models/deepseek) |
| Alibaba | `qwen3-next-80b-a3b`, `qwen3-32b`, `qwen3-coder-30b-a3b`, `qwen3-vl-235b-a22b` (not in `us-west-1`). `qwen3-coder-480b-a35b`, `qwen3-235b-a22b-2507` (`us-east-2`, `us-west-2`). `qwen3-coder-next` (`us-east-1`) | [Qwen](/platform/models/qwen) |
| Moonshot AI | `kimi-k3`. `kimi-k2.5`, `kimi-k2-thinking` (not in `us-west-1`) | [Moonshot AI](/platform/models/moonshot) |
| Z.ai | `glm-5.3`. `glm-5`, `glm-4.7`, `glm-4.7-flash` (not in `us-west-1`) | [Z.ai](/platform/models/zai) |

Guild refreshes this list from Bedrock's catalog every day, so it can change. It keeps only models that are active and produce text. Bedrock also lists Llama models, but Guild doesn't route Meta models through Bedrock, and Gemini models aren't on Bedrock.

## Connect Bedrock

**1. Start the credential**

Click **Access & setup** in the left nav, then **Models & providers**. Click **Add API key** and choose **AWS Bedrock** from the menu.

**2. Copy Guild's values**

Give the credential a **Name**. Under **Add these to your role**, copy the **Principal** and the **External ID**. Keep the dialog open.

**3. Create the role in AWS**

In your AWS account, create an IAM role that can invoke the Bedrock models you want. Set its trust policy to let the **Principal** assume it, and match the **External ID** with a `StringLike` condition.

**4. Enter the role and region**

Paste the role's ARN, such as `arn:aws:iam::123456789012:role/GuildBedrock`, into **IAM role ARN**. Enter the region to call Bedrock in, such as `us-east-1`, under **AWS region**. Pick a region that has the models you want.

**5. Choose publishers**

Under **Models**, check each publisher this credential should reach, and keep or change each default model. Then click **Add Key**.

The trust policy looks like this, with the values from the form:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "<Principal from the form>" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringLike": { "sts:ExternalId": "<External ID from the form>" }
      }
    }
  ]
}
```

The external ID ends in `:*` because Guild appends the credential's ID when it assumes the role. One role can serve every Bedrock credential on the same Guild account.

If the dialog says the deployment has no AWS role configured, Bedrock can't be connected on that deployment yet.

## Regions and model IDs

A Bedrock credential names one region. Guild supports `us-east-1`, `us-east-2`, `us-west-1`, and `us-west-2`. A model that isn't in your credential's region can't be routed through it, so add a credential for another region if you need one. Write canonical model names, such as `claude-sonnet-4-6` or `deepseek-r1`, in policies and `llmPreferences`. Guild maps each one to its Bedrock ID, such as `us.anthropic.claude-sonnet-4-6` or `us.deepseek.r1-v1:0`.

When a model has an inference profile, Guild prefers the profile for your region's geography, `us.`, over a `global.` profile. A global profile can serve a request from another continent, which may break data-residency terms or IAM policies scoped to regional ARNs. Guild uses a global profile only when AWS publishes nothing narrower.

## Audit calls in CloudTrail

Each call Guild makes assumes your role with a session name of `guild-<task-id>`. To trace a Bedrock call back to the Guild task that made it, look for that session name in CloudTrail.

## Frequently asked questions

> **Does Guild store AWS access keys?**
>
> No. Guild assumes an IAM role you create, matched by an external ID. There are no long-lived AWS keys to store or rotate.

> **Which AWS regions can I use?**
>
> Four US regions: `us-east-1`, `us-east-2`, `us-west-1`, and `us-west-2`. Regions outside the US aren't supported. A credential names one region, so add another credential to reach a model that isn't in yours.

> **Can I run Llama or Gemini models through Bedrock?**
>
> No. Bedrock lists Llama models, but Guild doesn't route Meta models through Bedrock, and Gemini models aren't on Bedrock. Use [OpenRouter](/integrations/openrouter) for both.

> **What if the dialog says no AWS role is configured?**
>
> Bedrock can't be connected on that deployment yet.

## Put a governed agent on AWS Bedrock this week

> **[Book a demo](https://guild-ai.cal.com/gtm/meeting-with-guild.ai)**
>
> See how teams govern agents that use AWS Bedrock.

> **[Start free](https://app.guild.ai)**
>
> Connect AWS Bedrock and scope your first agent.

## Related

**Also runs on Guild:** [Anthropic](/integrations/anthropic) · [OpenAI](/integrations/openai) · [Fireworks AI](/integrations/fireworks) · [OpenRouter](/integrations/openrouter)

**Read:** Docs: [Models & providers](/platform/llm-settings) · [LLMs](/guide/llms) · [Usage](/insights/usage)