Configure AWS Bedrock provider

Configure an Omnia Provider that serves requests from AWS Bedrock, authenticating with workload identity (IRSA) or an access key.

Bedrock hosts both the claude and openai provider types. The examples use claude. The API server rejects gemini on Bedrock at admission.

Prerequisites

An EKS cluster with the OIDC provider enabled
AWS Bedrock model access enabled in your target region (enable model access)
eksctl and aws CLI installed
Omnia operator installed in the cluster

Option 1: workload identity (IRSA)

IRSA lets the agent pod assume an IAM role without static credentials. Use it in production.

1. Create an IAM policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*"
    }
  ]
}

Save it as bedrock-policy.json and create the policy:

aws iam create-policy \
  --policy-name OmniaBedrock \
  --policy-document file://bedrock-policy.json

2. Create a ServiceAccount bound to an IAM role

The agent pod runs as the ServiceAccount named in spec.podOverrides.serviceAccountName on the AgentRuntime. If that is unset, it runs as the Workspace’s spec.runtime.serviceAccountName, then as the operator-created <agent name>-facade ServiceAccount. Create your own ServiceAccount and point the agent at it. The values below are illustrative.

eksctl create iamserviceaccount \
  --name bedrock-agent \
  --namespace agents \
  --cluster my-cluster \
  --role-name omnia-bedrock-role \
  --attach-policy-arn arn:aws:iam::123456789012:policy/OmniaBedrock \
  --approve

eksctl annotates the ServiceAccount with eks.amazonaws.com/role-arn. To give every agent in a workspace the same identity, set the ServiceAccount on the Workspace instead. See Workspace.

3. Create the Provider

apiVersion: omnia.altairalabs.ai/v1alpha1
kind: Provider
metadata:
  name: bedrock-claude
  namespace: agents
spec:
  type: claude
  model: anthropic.claude-3-5-sonnet-20241022-v2:0

  platform:
    type: bedrock
    region: us-east-1

  auth:
    type: workloadIdentity

  capabilities:
    - text
    - streaming
    - vision
    - tools

platform.region is optional and not validated. Set it to the region where you enabled model access.

4. Reference the Provider from an AgentRuntime

Set the ServiceAccount from step 2 in podOverrides.

apiVersion: omnia.altairalabs.ai/v1alpha1
kind: AgentRuntime
metadata:
  name: my-agent
  namespace: agents
spec:
  promptPackRef:
    name: my-prompts
  podOverrides:
    serviceAccountName: bedrock-agent
  providers:
    - name: default
      providerRef:
        name: bedrock-claude
  facades:
    - type: websocket
      port: 8080

Option 2: access key

For development or environments without IRSA, use static AWS credentials.

1. Create a Secret

kubectl create secret generic aws-credentials \
  --namespace agents \
  --from-literal=AWS_ACCESS_KEY_ID=AKIA... \
  --from-literal=AWS_SECRET_ACCESS_KEY=...

To use temporary credentials, add an AWS_SESSION_TOKEN key.

2. Create the Provider

apiVersion: omnia.altairalabs.ai/v1alpha1
kind: Provider
metadata:
  name: bedrock-claude
  namespace: agents
spec:
  type: claude
  model: anthropic.claude-3-5-sonnet-20241022-v2:0

  platform:
    type: bedrock
    region: us-east-1

  auth:
    type: accessKey
    credentialsSecretRef:
      name: aws-credentials

  capabilities:
    - text
    - streaming
    - vision
    - tools

The Secret must be in the Provider’s namespace. Reference the Provider from an AgentRuntime as in step 4 above, without podOverrides.

Verify

kubectl get provider bedrock-claude -n agents -o wide
kubectl get provider bedrock-claude -n agents -o jsonpath='{.status.conditions}' | jq .

AuthConfigured, CredentialConfigured, ModelValid and Ready are True.

Troubleshooting

Model access not enabled

If the Provider reports an error, check that model access is enabled in the target region:

aws bedrock list-foundation-models --region us-east-1 \
  --query "modelSummaries[?modelId=='anthropic.claude-3-5-sonnet-20241022-v2:0']"

Region mismatch

platform.region must match the region where you enabled Bedrock model access. Model availability varies by region.

IRSA annotation missing

Check that the ServiceAccount the agent pod runs as carries the role annotation:

kubectl get sa bedrock-agent -n agents -o jsonpath='{.metadata.annotations}'

Look for eks.amazonaws.com/role-arn pointing to the correct role.

Checking Provider conditions

kubectl describe provider bedrock-claude -n agents

Read the Conditions section for AuthConfigured, CredentialConfigured, ModelValid and Ready.