AWS Bedrock Setup

Overview

This guide walks you through setting up Amazon Bedrock as an AI Provider in Elementum so you can use Bedrock-hosted Claude (and other foundation) models across your AI Services, automations, and agents. Running models through your own AWS account keeps AI workloads within your cloud infrastructure and compliance boundaries.

Connecting a Bedrock Agent built in AWS to an Elementum App is a separate setup. Once this provider is configured, see AWS Bedrock Agents Setup to invoke a Bedrock Agent through App Intelligence.

Time required: About 15–20 minutes, depending on your existing AWS setup.

Prerequisites

Elementum requirements

Organization permissions: Ability to add or edit AI Providers in Organization Settings.

AWS requirements

AWS Account: Active AWS account with Bedrock access.
Region: Bedrock available in your target region (e.g., us-east-1, us-east-2, us-west-2).
Bedrock Access: Amazon Bedrock service enabled for your account.
Foundation Model Access: Access granted to at least one foundation model (Claude, Titan, etc.).
IAM Permissions: Ability to create IAM users and policies.

Model access: You need access to the foundation models you plan to use. In the Amazon Bedrock console, confirm model access for your account and region; approval timing depends on AWS.

Step 1: Prepare AWS Authentication

Elementum supports two methods for authenticating the Bedrock AI Provider with AWS:

Credential-based (Access Key + Secret Key) — Create an IAM user with programmatic access and provide its access keys to Elementum. Best when your organization manages service accounts with long-lived credentials.
IAM Role — Provide an IAM role ARN that Elementum assumes at runtime. Aligns with enterprise AWS security practices by eliminating static credentials and using role-based access instead.

Choose one method below and follow the corresponding steps.

Credential-Based (Access Key)
IAM Role

Create an IAM user whose access keys Elementum will use to call Bedrock models.

Navigate to IAM

In the AWS Console, go to IAM → Users → Create user.

Configure user

User name: Choose a descriptive name (e.g., elementum-bedrock-invoker).
Do not enable console access (programmatic access only).

Attach permissions

Create and attach a policy with bedrock:InvokeModel. If you also plan to connect Bedrock Agents later, include bedrock:InvokeAgent now or add it then.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel"
      ],
      "Resource": "*"
    }
  ]
}

Least privilege: For production, restrict the Resource to specific model ARNs:

"Resource": [
  "arn:aws:bedrock:us-east-2::foundation-model/*"
]

Create access keys

Open the user details.
Go to the Security credentials tab.
Click Create access key.
Choose a use case that matches programmatic access from outside AWS, then complete the prompts.
Copy and securely store the Access Key ID and Secret Access Key.

Store credentials securely: The secret access key is only shown once. Store it in a secure password manager until you configure it in Elementum.

Create an IAM role that Elementum assumes at runtime to call Bedrock models.

Navigate to IAM Roles

In the AWS Console, go to IAM → Roles → Create role.

Configure trust policy

Set up the trust relationship so Elementum can assume the role. Select Custom trust policy and configure it to allow Elementum’s AWS account to assume the role.

Attach permissions

Attach a policy with bedrock:InvokeModel. If you also plan to connect Bedrock Agents later, include bedrock:InvokeAgent now or add it then.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel"
      ],
      "Resource": "*"
    }
  ]
}

Least privilege: For production, restrict the Resource to specific model ARNs:

"Resource": [
  "arn:aws:bedrock:us-east-2::foundation-model/*"
]

Copy the Role ARN

After creation, copy the Role ARN from the role summary page.Format: arn:aws:iam::{account-id}:role/{role-name}

Step 2: Create the Bedrock AI Provider in Elementum

Configure Elementum to connect to AWS using the authentication method you prepared in Step 1.

Go to Organization Settings and open the Providers tab.
Click + Provider and select Amazon Bedrock.
Enter a Provider name and the Region where your Bedrock resources are deployed (for example us-east-2).
Choose your authentication method:
- Credential-based: Enter the Access Key ID and Secret Access Key from your IAM user.
- IAM Role: Enter the Role ARN from the IAM role you created.
Use Test Connection to confirm the configuration, then Save.

The provider is now available for creating AI Services. Tips

The provider Region must match the region where your Bedrock models are available.
Use separate providers for different AWS accounts or regions if needed.
IAM Role authentication avoids static credential rotation and aligns with AWS security best practices for enterprise environments.

Step 3: Create your first AI service

With the provider saved, create an AI Service that uses a Bedrock-hosted model. See AI Services for the full walkthrough, including LLM and embedding service configuration, assignment, and failover.

Bedrock-hosted models run within your AWS account, keeping AI workloads inside your own cloud infrastructure and compliance boundaries.

For a side-by-side comparison of available Bedrock models against other providers, see AI Models.

How Bedrock model invocation works

When Elementum invokes a Bedrock-hosted model:

AWS Bedrock API used

InvokeModel sends a prompt to a Bedrock-hosted foundation model and returns the model response. Used by all AI Services created with the Bedrock provider. Key parameters:

modelId: The identifier of the foundation model.
body: The request payload (prompt, parameters).
contentType / accept: Media types for the request and response.

Documentation: Amazon Bedrock InvokeModel API

Security model

Aspect	Implementation
Authentication	IAM Access Key/Secret Key or IAM Role (assumed at runtime) via Bedrock AI Provider
Authorization	IAM policies control which models can be invoked
Data in transit	TLS encryption for all API calls
Audit	AWS CloudTrail logs all Bedrock API calls

Troubleshooting

Access Denied Errors

Error: “Access Denied” or “Not authorized to perform bedrock:InvokeModel”.Possible causes:

IAM user or role missing bedrock:InvokeModel permission.
Policy not attached to the user or role.
Resource restrictions in policy don’t match the model ARN.
For IAM Role auth: trust policy does not allow Elementum to assume the role.

Solutions:

Verify the IAM policy includes bedrock:InvokeModel and is attached to the IAM user (for credential-based auth) or IAM role (for role-based auth) configured on the Bedrock AI Provider.
Ensure the policy Resource matches your foundation model ARNs or uses a permitted pattern.
For credential-based auth, confirm the access keys in Elementum belong to the correct IAM user.
For IAM Role auth, verify the role’s trust policy allows Elementum to assume it.

Region Mismatch

Error: “Could not connect to endpoint” or timeout errors.Possible causes:

Provider configured for a different region than where the model is available.
Model access not granted in the configured region.

Solutions:

Verify the region in your Bedrock AI Provider matches where the model is enabled.
Confirm Bedrock and the model are available in your target region.
Update provider configuration if needed.

Test Connection fails

Error: Connection test returns an error despite credentials looking correct.Solutions:

Confirm the IAM user or role has at least bedrock:InvokeModel permission.
Verify the Region field uses the AWS region code (for example us-east-2, not US East 2).
Check that no SCP or AWS Organizations policy is blocking Bedrock for the account.
For IAM Role auth, confirm the role’s trust policy is configured correctly.

Best Practices

IAM and credentials

Apply least privilege; scope bedrock:InvokeModel to specific model ARNs when practical.
Prefer IAM Role authentication for enterprise environments to avoid managing static credentials.
If using credential-based auth, rotate access keys on a schedule your organization defines (for example, every 90 days).
Use different IAM users, keys, or roles per environment (development vs production).

Model choice

Pick a foundation model that balances latency, cost, and quality for your task. Available models depend on your AWS region and account. See AI Models for a comparison across providers.

Monitor usage and spend

Use AWS Cost Explorer (and related billing views) to monitor token-related usage and Bedrock charges tied to your provider.

Right-size models for simple tasks

Prefer smaller or faster models for straightforward classification or short replies when quality requirements allow; reserve larger models for harder reasoning.

Next Steps

AI Services

Create LLM services using Bedrock-hosted models

AI Models

Compare models across providers

AWS Bedrock Agents Setup

Connect a Bedrock Agent you’ve built in AWS to an Elementum App

AWS Bedrock Docs

Reference AWS’s official Bedrock documentation

Understand AI

Connect a provider

Create AI services

Use AI capabilities

Build agents

Deploy agents to channels

External agents

Overview

Prerequisites

Elementum requirements

AWS requirements

Step 1: Prepare AWS Authentication

Step 2: Create the Bedrock AI Provider in Elementum

Step 3: Create your first AI service

How Bedrock model invocation works

AWS Bedrock API used

Security model

Troubleshooting

Best Practices

Next Steps

AI Services

AI Models

AWS Bedrock Agents Setup

AWS Bedrock Docs

​Overview

​Prerequisites

​Elementum requirements

​AWS requirements

​Step 1: Prepare AWS Authentication

​Step 2: Create the Bedrock AI Provider in Elementum

​Step 3: Create your first AI service

​How Bedrock model invocation works

​AWS Bedrock API used

​Security model

​Troubleshooting

​Best Practices

​Next Steps

AI Services

AI Models

AWS Bedrock Agents Setup

AWS Bedrock Docs

Overview

Prerequisites

Elementum requirements

AWS requirements

Step 1: Prepare AWS Authentication

Step 2: Create the Bedrock AI Provider in Elementum

Step 3: Create your first AI service

How Bedrock model invocation works

AWS Bedrock API used

Security model

Troubleshooting

Best Practices

Next Steps