Amazon Bedrock

Amazon Bedrock is the default provider behind ai. It runs models from several model makers, including Anthropic's Claude models, inside your own AWS account, so your app calls them with an IAM role instead of a provider API key. Pick Bedrock when you already run on AWS, when you want model calls billed and governed in one AWS account, or when you need to choose the AWS region your prompts are processed in.

ai:
  driver: bedrock

Before you start

You need an AWS account and permission to manage IAM in it.

1. Pick a region. Choose the AWS region your model calls run in. Pick one in the same MainSDK region as your data (US, EU or India), and check that the models you want are offered there; model availability differs by region.
2. Turn on model access. In the Bedrock console for that region, request access to each model family your app calls. Some model makers ask you to accept their terms first.
3. Create an IAM role for your app. Give it a policy that allows invoking models in Bedrock, limited to the models and region you use. Keep it narrow: your app needs to call models, not manage Bedrock.
4. Let your host assume the role with OIDC. Instead of long-lived access keys, register your host as an OIDC identity provider in IAM and let the role trust it:
   • Vercel: Vercel issues an OIDC token per project and environment. Add Vercel's issuer for your team as an identity provider in IAM, and limit the role's trust policy to your project and the environments that should call models.
   • GitHub Actions or other CI: add the CI's OIDC issuer the same way, limited to your repository and branch, for jobs such as evals or contract tests that call real models.
5. Avoid access keys. If your host cannot use OIDC, prefer the host's own workload role (for example on AWS compute). Only fall back to an access key pair as a last resort, stored in your secrets manager.

Configure

ai takes the driver and the region directly. There is no key, because Bedrock authenticates with the role.

ai:
  driver: bedrock                    # IAM role, no keys in code
  region: us-east-1                  # the AWS region with your model access
  models: [anthropic/claude-*]       # allowlist; anything else is refused
  data: { training: never, retention: zero }
  limits: { per-user: $1/day, total: $500/month }

How the driver picks up the role's credentials on each host (the OIDC token on Vercel, the workload role on AWS) is not specified yet. Model hosts come from the driver's declared hosts, so you don't add Bedrock endpoints to network.allow yourself.

To keep EU users' prompts in the EU, set the region in a market overlay:

ai:
  region: eu-central-1               # an EU region with your model access

Use it

import { ai, auth, db } from "mainsdk";

export async function GET(req: Request, { params }: { params: { id: string } }) {
  const session = await auth.require(req);
  const order = await db.orders.for(session.user).get(params.id);

  const summary = await ai.generate({
    model: "anthropic/claude-sonnet",   // [to be decided] model identifiers per driver
    feature: "order-summary",           // caps and audit per feature
    user: session.user,                 // caps and audit per user
    prompt: `Summarise this order for its owner: ${JSON.stringify(order)}`,
  });
  return Response.json(summary);
}

Personal data in the prompt reaches Bedrock as placeholders and comes back restored inside your app.

Local development and testing

• No AWS account: set ai.driver: local in main.env.dev.yaml to use the built-in local fake while you build.
• Real models from your machine: use your own AWS sign-in with a role that may invoke models in your region. Keep caps low in the dev overlay, for example limits: { total: $10/month }.
• Tests: createTestApp() from @mainsdk/testing runs ai on its in-memory fake with redaction, caps and audit enforced. chaos.on("ai:bedrock", { outage: true }) simulates a Bedrock outage, so you can prove a fallback driver takes over.

import { it } from "node:test";
import { createTestApp, chaos } from "@mainsdk/testing";
import { ai } from "mainsdk";

it("ai fails over when bedrock is down", async () => {
  createTestApp({ main: "./main.yaml" });
  chaos.on("ai:bedrock", { outage: true });
  await ai.generate({ model: "anthropic/claude-sonnet", feature: "chat", prompt: "hello" });
});

What MainSDK adds on top

• No provider key in your code: Bedrock uses an IAM role, and any key a driver needs is a secret: reference.
• Providers, models or account modes that train on or keep prompts are refused; a declaration that doesn't meet ai.data fails mainsdk check with MAIN-AI-0001.
• Personal data redacted before the model sees it.
• Spend limits per user, per feature and in total, checked before the request leaves your app (MAIN-AI-0007 at the limit).
• Every call audited with feature, model, tokens and cost, never the prompt.

See AI calls for the full contract.

Limits and notes

• Bedrock is the owner's default ai driver in the catalog. The ai spec (phase 1) lists anthropic, openai, gateway and local and does not name Bedrock yet; the spec is to be updated.
• The catalog lists Bedrock with retention: none and the spec writes data: { training: never, retention: zero }. How "no retention" is proven per provider is an open question in the spec.
• Bedrock runs in the AWS region you set. Your prompts are processed there, so match it to your MainSDK data region.
• Model identifiers per driver are not final.
• ai.raw() returns the provider's client for Bedrock-only features. mainsdk check lists every use.

Swap to or from it

AI calls are stateless, so a swap is one line and mainsdk swap runs the contract tests against the new driver before switching:

ai:
  driver: anthropic                  # was bedrock
  key: secret:ANTHROPIC_API_KEY      # [to be decided] key field name for drivers that need one

Or keep Bedrock and fail over to a second provider:

fallback:
  ai: [bedrock, anthropic]           # [to be decided] the ai spec does not define fallback yet

FAQ

Do I need AWS access keys to use Bedrock? No. Use an IAM role your host assumes, with OIDC on Vercel or in CI. Access keys are a last resort.

Can I call Claude models through Bedrock? Yes, once model access for them is turned on in your region. List them in ai.models, for example anthropic/claude-*.

How do I keep EU prompts in the EU? Set ai.region to an EU region in a market overlay, and check your models are offered there.

Next

• AI calls
• Anthropic, OpenAI and AI gateway
• Vercel
• Swap a driver

Open questions