Amazon Bedrock Setup

Connect a Bedrock IAM role or API key so Nexus Auto can call supported models through your AWS account.

Bedrock usage and charges stay in your AWS account.

• Setup follows the same admin workflow as Provider Keys, plus a Bedrock model ID and region for each model.
• Fireworks stores the credential.

Before you start, confirm your AWS account can invoke every model you plan to add. Some models need explicit Bedrock model access, a Marketplace agreement, or approval from AWS or the model provider. Anthropic may also require a one-time use-case form.

​

Supported models

Model	Example Bedrock model ID	AWS reference
Claude Opus 5	global.anthropic.claude-opus-5	Model ID · Regions
Claude Opus 5.5	global.anthropic.claude-opus-5-5	Model ID · Regions
GPT-5.6 Sol	global.openai.gpt-5.6-sol	Model ID · Regions
GPT-6 Sol	global.openai.gpt-6-sol	Model ID · Regions
GPT-6.1 Sol	global.openai.gpt-6.1-sol	Model ID · Regions
GPT-6 Astra	global.openai.gpt-6-astra	Model ID · Regions

• Copy the Bedrock model ID exactly from AWS. Any geo or global profile, or ARN, that AWS lists for the model also works if your region can invoke it, unless your account uses US data residency (below).
• Supported regions: us-east-1, us-east-2, us-west-1, and us-west-2.

​

US data residency

If your Fireworks account enforces US data residency, each route must keep requests in the US:

• Use a us. inference profile, such as us.anthropic.claude-opus-5-5, or an in-Region model ID with no geo prefix.
• global. profiles are rejected, even in a US region, because AWS can serve them from any region. Requests to that model return 403 with reason_code: residency.
• A model with only a global. profile on Bedrock, such as GPT-6 Sol, can’t be served on Bedrock for your account.

​

Prepare AWS

In the AWS account that pays for inference, request or verify access to each model. Complete any use-case form, Marketplace agreement, or provider approval AWS asks for, then confirm the account can invoke the model or inference profile.

Then create one credential, either an IAM role or an API key.

IAM role

1. Configure the trust policy

   In AWS IAM → Roles → Create role, choose Custom trust policy and paste this. Set sts:ExternalId to your exact Fireworks account ID.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::843780049090:role/nexus-bedrock-byok"
         },
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": {
             "sts:ExternalId": "<FIREWORKS_ACCOUNT_ID>"
           }
         }
       }
     ]
   }
   

   
2. Add Bedrock permissions

   In Step 2: Add permissions, select Create inline policy and paste:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "bedrock:InvokeModel",
           "bedrock:InvokeModelWithResponseStream"
         ],
         "Resource": "*"
       }
     ]
   }
   
3. Create the role

   Name the role FireworksBedrockBYOK, or any name that starts with FireworksBedrock. Keep the default IAM path. Create the role, then copy its ARN from the role summary.

API key

Generate a long-term key in Amazon Bedrock console → API keys, then copy it.

Don’t use a short-term key. It works only in the Region where it was generated, expires within 12 hours, and Fireworks doesn’t refresh it.

​

Connect in the dashboard

1. Connect the credential

   Open Settings → Provider Keys and click Connect on the Amazon Bedrock row.

   • IAM Role: keep the External ID exactly as shown. Paste the role ARN, not the permission policy ARN.
   • API Key: paste the Bedrock key.

   Click Continue.

   
2. Pick models

   In Add models to Amazon Bedrock, select at least one model, then click Connect. The card shows Connecting for about a minute.

3. Fill in the model routes

   Connecting stores the credential but routes no traffic yet. For each row under Models using Bedrock, paste the AWS Model ID, select a Region, and click Save.

   Traffic for those models now bills to your AWS account. Every other model keeps its current provider.

​

Change model routes later

• Add model or the trash icon adds or removes a model. Edit models changes a Model ID or Region. Then click Save.
• Update Key replaces the API key or IAM role ARN and keeps the routes. This is the Replace action on Provider Keys.
• Remove deletes the Bedrock credential and all its routes.

​

Manage with firectl

firectl is the older way to set up Bedrock and remains supported for existing route files and scripts. For new setups, use Provider Keys in Nexus settings.

Task	Command
Upload an IAM role	firectl provider-key upload --provider-type bedrock --aws-iam-role-arn ROLE_ARN
Upload an API key	firectl provider-key upload --provider-type bedrock --from-file PATH
Bind with routes	firectl provider-key-binding bind bedrock KEY_ID --routes-file ./routes.json
Check routes	firectl provider-key-binding get bedrock -o json

​

Troubleshooting

• AssumeRole is denied (IAM role): the trust policy needs the exact Fireworks principal ARN and your Fireworks account ID as sts:ExternalId. The role name must start with FireworksBedrock and use the default IAM path.
• Model not found or region unavailable: copy the exact model or profile ID from AWS, and confirm the region can invoke it.
• 403 with reason_code: residency: your account uses US data residency and the route uses a global. or non-US profile. Switch it to a us. profile. See US data residency.
• Connected but traffic doesn’t reach Bedrock: make sure the route list isn’t empty and requests use a route containing one of the configured served model IDs.