# Connect AWS Bedrock with an AWS credential

> Bedrock takes an AWS credential and a region rather than an API key, and only a long-term key can list models at all.

- Canonical: https://big-agi.com/docs/connect-bedrock
- Minimum tier: open  [Open ⊂ Free ⊂ Pro - a tier only ever ADDS to the Open baseline]
- Kind: provider · Last content update generation: 2026-07-27 · Review by: 2026-10-27
- Answers: Which AWS credentials does Big-AGI need? · Why is the model I want not in the list? · Which region do I choose?

Bedrock takes an AWS credential and a region, issued by your own AWS account. Generate a **long-term** key - the short-term kind expires with the console session and cannot list models, which is what leaves the list empty on an otherwise correct setup.

## The AWS account behind it

Usage lands on the AWS invoice. A funded AWS account is the prerequisite for a first answer. The enforceable limit is an AWS Budget on that account.

## Generating a long-term key

1. Open the [Bedrock console](https://console.aws.amazon.com/bedrock) in the region you intend to use. Switch regions first - the credential is scoped to one.
2. **API keys** -> **Long-term API keys** -> **Generate long-term API keys** -> pick an expiration -> **Generate** ([AWS's own steps](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html)).
3. The IAM route instead: in [IAM](https://console.aws.amazon.com/iam/), a user with the **AmazonBedrockFullAccess** policy -> **Security credentials** -> **Create access key** -> **Application running outside AWS**.

## The two credential modes

| Credential mode | Fields to fill |
|---|---|
| Bearer token | **Bedrock long-term API Key**, plus the region |
| IAM | **AWS Access Key ID** and **AWS Secret Access Key** (session token optional), plus the region |

The modes are mutually exclusive and the app enforces that: a bearer token wins, and the IAM fields are dropped from the request. The region defaults to `us-east-1`.

To fill them, open **Models** (`Ctrl + Shift + M`), press **More Services** if the **Setup AI Models** wizard opens, then **Add** -> **AWS Bedrock**. Complete one mode plus the region and press **Models** ([add and manage your keys](/docs/connect-models)).

## Region and model access decide the list

Each model must be enabled for your account in that region before it can appear. Together with the region scope, those two conditions account for nearly every empty list here.

## Every request takes the server path

This API sends no browser-access headers, so every request goes through the Big-AGI fast edge servers.

> **Direct Connection works only with your API key stored in the browser**, and with an AI service that permits direct browser calls (CORS). Where it cannot be used, requests route through the Big-AGI fast edge servers instead - everything still works, within the standard upload size and time limits.

## Related

- [Connect an AI service](/docs/connect-models)
- [Keys held by a server you operate](/docs/self-host-configuration)
- [Direct Connection](/docs/feature-direct-connection)