--- title: Connect AWS Bedrock to AI Runtime Control with an IAM role summary: >- Use AI Runtime Control (ARC) to call models on AWS Bedrock without storing long-lived AWS credentials by allowing ARC to assume an IAM role in your AWS account. url: >- https://www.fastly.com/documentation/solutions/tutorials/ai-runtime-control/connect-aws-bedrock-with-an-iam-role --- In this tutorial, you'll connect AWS Bedrock to AI Runtime Control (ARC) using AWS IAM authentication. Instead of giving ARC an API key, you'll create a role in your AWS account that ARC is allowed to assume, give that role permission to call Bedrock models, and send a test request through ARC to confirm everything works. By the end, you'll understand how the trust policy and the permissions policy work together, and where to look when a request is denied. ## Before you begin This tutorial assumes you've already gotten access to ARC and have completed the steps to get started using it. You'll also need the following: - The [Superuser role](https://www.fastly.com/documentation/guides/organizations-and-accounts/account-members-and-permissions/about-user-roles-and-permissions/). Other account roles can't access ARC. - Access to an AWS account with permission to create IAM roles and policies. - Bedrock model access in the AWS region you plan to use. Some models, including Anthropic models, require a one-time use case submission in the Bedrock console before you can call them. - A [virtual key](https://www.fastly.com/documentation/guides/platform/ai-runtime-control/managing-virtual-keys/) in ARC to test with. ## Why use an IAM role With an IAM role, ARC never holds a long-lived AWS credential. When ARC needs to call Bedrock, it asks AWS for temporary credentials by assuming your role, and AWS only allows that if your role says ARC is trusted. You stay in control from your own AWS account, and you can change the role's permissions or revoke ARC's access at any time without touching ARC. Two policies on the role make this work: - The **trust policy** controls who can assume the role. Yours will trust ARC, and only when ARC presents your unique external ID. - The **permissions policy** controls what the role can do once it's assumed. Yours will allow calling Bedrock models. Most setup problems come from mixing these two up, so it helps to keep them separate as you go. ## Step 1: Start adding the provider in ARC Start in ARC, because it generates the values you'll need in AWS. 1. Log in to the [Fastly control panel](https://manage.fastly.com). 2. Go to **Tools** > **AI Runtime Control**. 3. Click the **Providers** tab. 4. Click **Add**, then select **AWS Bedrock**. 5. For **Authentication type**, select **AWS IAM**. ARC displays a **Role ARN** and an **External ID**. 6. Click the clipboard Clipboard icon next to each value and paste them somewhere you can copy from later. Keep this page open. You'll come back to it in Step 4. > **IMPORTANT:** The external ID is unique to your account. It isn't a password, but avoid sharing it publicly or including it in screenshots. ## Step 2: Create the role in AWS Next, create the role that ARC will assume and attach a trust policy that allows only ARC to assume it. 1. In the AWS console, open **IAM**. 2. In the left navigation, click **Roles**, then click **Create role**. 3. For **Trusted entity type**, select **Custom trust policy**. Don't select **AWS service**, which creates a role for an AWS service instead of for ARC. 4. Replace the policy in the editor with the following, filling in the two values you copied from ARC: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "" } } } ] } ``` 5. Click **Next**. ## Step 3: Give the role permission to call Bedrock Now attach a permissions policy that lets the role call Bedrock models. 1. On the **Add permissions** page, select **Create inline policy**. 2. Switch the editor to **JSON** and replace its contents with the following: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:inference-profile/*" ] }, { "Effect": "Allow", "Action": [ "bedrock-mantle:CreateInference" ], "Resource": "arn:aws:bedrock-mantle:*:*:project/*" } ] } ``` 3. Click **Next**, enter a policy name (for example, `ArcBedrockInvoke`), and continue. 4. Enter a role name that makes its purpose clear later (for example, `FastlyArcAccess`), and update the description to match. 5. On the review page, confirm the trust policy shows the ARC role ARN and your external ID, then click **Create role**. 6. Open the role you just created and copy its ARN from the top of the page. > **NOTE:** This policy allows any Bedrock model in any region, which keeps setup simple. For production, consider limiting `Resource` to the regions and models you actually use. ## Step 4: Finish adding the provider in ARC Return to the ARC page you left open in Step 1. 1. In the **Customer role ARN** field, paste the ARN of the role you created. 2. In the **Region** field, enter the region code of the AWS region where you enabled Bedrock model access (for example, `us-east-1`). 3. Under **Model permissions**, do one of the following: - To make every model available for this provider, select **Allow all models**. - To limit access to specific models, select **Limit model access** and then select which models to allow. 4. Click **Save**. The new provider appears on the Providers tab. > **IMPORTANT:** The region in ARC must match the region where your models are enabled. If they don't match, ARC can assume your role, but model requests will fail. ## Step 5: Send a test request Make sure your virtual key is allowed to use a model served by the AWS Bedrock provider, then send a request. Store the key in an environment variable so it doesn't end up in your shell history. ```term copy $ export ARC_API_KEY="your-virtual-key" $ curl -i "https://arc.fastly.app/v1/chat/completions" \ -H "Authorization: Bearer $ARC_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "your-model-id", "messages": [ {"role": "user", "content": "Say hello and tell me which model you are."} ], "max_tokens": 100 }' ``` Set the values as follows: - `ARC_API_KEY`: your virtual key. - `your-model-id`: the ID of a Bedrock model allowed by both the provider and your virtual key, as recognized by ARC. A `200` response with the model's reply means your setup is complete. ## Troubleshooting When a request fails, the error message usually indicates whether the error originated from AWS or ARC. Specifically, look for errors that mention: - **`sts:AssumeRole`**. ARC couldn't assume your role. Check that the trust policy uses the exact Role ARN and External ID from ARC, and that you selected **Custom trust policy** when creating the role. - **A role not being authorized to perform an action**. ARC assumed your role, but the permissions policy doesn't allow the request. The error names the missing action. Add it to your inline policy. - **On-demand throughput not being supported**. The model can only be called through a cross-region inference profile. - **The model being unavailable or inaccessible** Model access isn't enabled in the region you set in ARC. Check the Bedrock console in that region. ## What's next You've connected AWS Bedrock to ARC without storing AWS credentials in ARC. From here, you can: - [manage your providers](https://www.fastly.com/documentation/guides/platform/ai-runtime-control/managing-providers/), including editing the region or model permissions for your Bedrock provider. - [manage your virtual keys](https://www.fastly.com/documentation/guides/platform/ai-runtime-control/managing-virtual-keys/) to control which keys can use your Bedrock models.