# Configure AWS Bedrock provider

Configure an Omnia Provider that serves requests from AWS Bedrock, authenticating with workload identity (IRSA) or an access key.

Bedrock hosts both the `claude` and `openai` provider types. The examples use `claude`. The API server rejects `gemini` on Bedrock at admission.

## Prerequisites

- An EKS cluster with the OIDC provider enabled
- AWS Bedrock model access enabled in your target region ([enable model access](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html))
- `eksctl` and `aws` CLI installed
- Omnia operator installed in the cluster

## Option 1: workload identity (IRSA)

IRSA lets the agent pod assume an IAM role without static credentials. Use it in production.

### 1. Create an IAM policy

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*"
    }
  ]
}
```

Save it as `bedrock-policy.json` and create the policy:

```bash
aws iam create-policy \
  --policy-name OmniaBedrock \
  --policy-document file://bedrock-policy.json
```

### 2. Create a ServiceAccount bound to an IAM role

The agent pod runs as the ServiceAccount named in `spec.podOverrides.serviceAccountName` on the AgentRuntime. If that is unset, it runs as the Workspace's `spec.runtime.serviceAccountName`, then as the operator-created `<agent name>-facade` ServiceAccount. Create your own ServiceAccount and point the agent at it. The values below are illustrative.

```bash
eksctl create iamserviceaccount \
  --name bedrock-agent \
  --namespace agents \
  --cluster my-cluster \
  --role-name omnia-bedrock-role \
  --attach-policy-arn arn:aws:iam::123456789012:policy/OmniaBedrock \
  --approve
```

`eksctl` annotates the ServiceAccount with `eks.amazonaws.com/role-arn`. To give every agent in a workspace the same identity, set the ServiceAccount on the Workspace instead. See [Workspace](/reference/core/workspace/).

### 3. Create the Provider

```yaml
apiVersion: omnia.altairalabs.ai/v1alpha1
kind: Provider
metadata:
  name: bedrock-claude
  namespace: agents
spec:
  type: claude
  model: anthropic.claude-3-5-sonnet-20241022-v2:0

  platform:
    type: bedrock
    region: us-east-1

  auth:
    type: workloadIdentity

  capabilities:
    - text
    - streaming
    - vision
    - tools
```

`platform.region` is optional and not validated. Set it to the region where you enabled model access.

### 4. Reference the Provider from an AgentRuntime

Set the ServiceAccount from step 2 in `podOverrides`.

```yaml
apiVersion: omnia.altairalabs.ai/v1alpha1
kind: AgentRuntime
metadata:
  name: my-agent
  namespace: agents
spec:
  promptPackRef:
    name: my-prompts
  podOverrides:
    serviceAccountName: bedrock-agent
  providers:
    - name: default
      providerRef:
        name: bedrock-claude
  facades:
    - type: websocket
      port: 8080
```

## Option 2: access key

For development or environments without IRSA, use static AWS credentials.

### 1. Create a Secret

```bash
kubectl create secret generic aws-credentials \
  --namespace agents \
  --from-literal=AWS_ACCESS_KEY_ID=AKIA... \
  --from-literal=AWS_SECRET_ACCESS_KEY=...
```

To use temporary credentials, add an `AWS_SESSION_TOKEN` key.

### 2. Create the Provider

```yaml
apiVersion: omnia.altairalabs.ai/v1alpha1
kind: Provider
metadata:
  name: bedrock-claude
  namespace: agents
spec:
  type: claude
  model: anthropic.claude-3-5-sonnet-20241022-v2:0

  platform:
    type: bedrock
    region: us-east-1

  auth:
    type: accessKey
    credentialsSecretRef:
      name: aws-credentials

  capabilities:
    - text
    - streaming
    - vision
    - tools
```

The Secret must be in the Provider's namespace. Reference the Provider from an AgentRuntime as in step 4 above, without `podOverrides`.

## Verify

```bash
kubectl get provider bedrock-claude -n agents -o wide
kubectl get provider bedrock-claude -n agents -o jsonpath='{.status.conditions}' | jq .
```

`AuthConfigured`, `CredentialConfigured`, `ModelValid` and `Ready` are `True`.

## Troubleshooting

### Model access not enabled

If the Provider reports an error, check that model access is enabled in the target region:

```bash
aws bedrock list-foundation-models --region us-east-1 \
  --query "modelSummaries[?modelId=='anthropic.claude-3-5-sonnet-20241022-v2:0']"
```

### Region mismatch

`platform.region` must match the region where you enabled Bedrock model access. Model availability varies by region.

### IRSA annotation missing

Check that the ServiceAccount the agent pod runs as carries the role annotation:

```bash
kubectl get sa bedrock-agent -n agents -o jsonpath='{.metadata.annotations}'
```

Look for `eks.amazonaws.com/role-arn` pointing to the correct role.

### Checking Provider conditions

```bash
kubectl describe provider bedrock-claude -n agents
```

Read the `Conditions` section for `AuthConfigured`, `CredentialConfigured`, `ModelValid` and `Ready`.

## Related pages

- [Provider reference](/reference/core/provider/)
- [Configure pod overrides](/how-to/operations/configure-pod-overrides/)
- [Configure GCP Vertex AI Provider](/how-to/providers/configure-vertex-provider/)
- [Configure Azure AI Provider](/how-to/providers/configure-azure-ai-provider/)