Amazon Bedrock

Route Pullfrog’s model calls through Amazon Bedrock in your own AWS account. Use it to spend AWS credits or an enterprise AWS commitment, keep inference inside AWS for compliance, or use provisioned throughput you already pay for.

Bedrock is bring-your-own-key only. AWS bills inference to your account, and Pullfrog never proxies Bedrock traffic.

Setup

Pick Amazon Bedrock on the Provider card

In the Pullfrog console, pick the Amazon Bedrock tile on the Provider card.

Amazon Bedrock picked on the Pullfrog console Provider card

Store your AWS credential

Click Set up on the tile and save one of these:

A Bedrock API key, created under API keys in the Bedrock console. It becomes AWS_BEARER_TOKEN_BEDROCK.
An IAM access-key pair whose policy allows bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream.

The Configure Amazon Bedrock dialog with the bearer token and access key fields

You can store the credential as a GitHub Actions secret instead and map it in the workflow’s env: block.

Set the region and model in your workflow

Add AWS_REGION and BEDROCK_MODEL_ID to the env: block of .github/workflows/pullfrog.yml. Neither is secret.

- name: Run agent
  uses: pullfrog/pullfrog@v0
  with:
    prompt: ${{ inputs.prompt }}
  env:
    AWS_REGION: us-east-1
    BEDROCK_MODEL_ID: us.anthropic.claude-opus-5-5
    # only when the credential is a GitHub Actions secret
    AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}

Submit the Anthropic use-case form

Anthropic models only: before the first call, submit the one-time use-case form in the Bedrock console. Open Model catalog, pick an Anthropic model, and complete the form.

Variables

Name	Secret	Purpose
`AWS_BEARER_TOKEN_BEDROCK`	Yes	Bedrock API key. Use this or the access-key pair.
`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`	Yes	IAM access-key pair.
`AWS_SESSION_TOKEN`	Yes	Optional. Needed only with temporary STS credentials.
`AWS_REGION`	No	AWS region to call, for example `us-east-1`.
`BEDROCK_MODEL_ID`	No	Exact Bedrock model ID. Pullfrog runs it as written and never upgrades it.
`CLAUDE_CODE_USE_MANTLE`	No	Optional. Set to `1` to run Anthropic models on the Mantle endpoint.

A credential stored in the console needs no env: line, because Pullfrog injects it into every run. A value set in the workflow wins over a stored one.

On an account that pays through Pullfrog Router, store the credential in the Pullfrog console. Pullfrog decides how to fund a run before the runner starts, when GitHub Actions secrets are not visible to it, so a run whose credential exists only there falls back to the Router’s default model.

Model IDs

The model menu has a single Amazon Bedrock entry; BEDROCK_MODEL_ID names the actual model. Copy the ID from the Programmatic Access section of the model’s card in Bedrock’s model list. For example:

us.anthropic.claude-opus-5-5   # Claude Opus 5.5, US cross-region inference profile
amazon.nova-pro-v1:0           # Amazon Nova Pro, in-region
openai.gpt-oss-120b-1:0        # gpt-oss-120b, in-region

Cross-region inference profiles carry a geography prefix such as us., eu., jp., au. or global.. Pick the prefix that matches AWS_REGION, or use the bare in-region ID where the model card lists one. To change models, edit BEDROCK_MODEL_ID and commit.

Routing

Pullfrog reads the model ID to choose the agent:

Anthropic models, whose ID contains an anthropic segment, run on Claude Code. Pullfrog sets CLAUDE_CODE_USE_BEDROCK=1 for Claude Code.
Every other model runs on OpenCode’s amazon-bedrock provider.

An application inference profile ARN routes to OpenCode unless its name contains an anthropic segment. For an Anthropic model behind such an ARN, set PULLFROG_AGENT: claude in the workflow env:.

Mantle endpoint

Pullfrog calls Bedrock’s standard bedrock-runtime endpoint. AWS also serves models on a second endpoint, bedrock-mantle, and a few models run only there, such as Claude Mythos 5. To run an Anthropic model on Mantle, set CLAUDE_CODE_USE_MANTLE and use the model’s Mantle ID:

env:
  AWS_REGION: us-east-1
  BEDROCK_MODEL_ID: anthropic.claude-mythos-5
  CLAUDE_CODE_USE_MANTLE: "1"

Credential. Use the same credential you stored for Amazon Bedrock. Mantle has its own IAM actions: grant bedrock-mantle:CreateInference, plus bedrock-mantle:CallWithBearerToken when the credential is a Bedrock API key.
Model ID. Copy it from the bedrock-mantle row of the model card’s Programmatic Access table. A Mantle ID starts with anthropic. and has no geography prefix and no -v1:0-style suffix. With CLAUDE_CODE_USE_MANTLE set, any ID of that shape goes to Mantle, and every other ID still goes to bedrock-runtime. One consequence: anthropic.claude-opus-5-5 goes to Mantle even though bedrock-runtime serves the same ID in-region in eu-west-2.
Region. Mantle has no cross-region inference profiles and serves each model in fewer regions, so check the model card’s bedrock-mantle availability before choosing AWS_REGION.
Anthropic models only. Other models run on OpenCode through bedrock-runtime, so the Amazon Bedrock option cannot reach a non-Anthropic model that only Mantle serves.

Troubleshooting

Symptom	Fix
”`BEDROCK_MODEL_ID` must be set when the model is `bedrock/byok`”	The repository uses Amazon Bedrock, but the workflow does not set `BEDROCK_MODEL_ID`. Add it to `env:`.
”Amazon Bedrock is missing required settings”	The message lists each missing value: the credential, `AWS_REGION`, or `BEDROCK_MODEL_ID`.
`AccessDeniedException` on an Anthropic model	The account has not submitted the Anthropic use-case form. Submit it in the Bedrock console, then re-run.
`AccessDeniedException` on another model	The IAM policy behind the access keys lacks `bedrock:InvokeModel` or `bedrock:InvokeModelWithResponseStream` for that model.
`ValidationException` about the model ID	The ID is not valid in `AWS_REGION`. Check the model card’s Programmatic Access section and match the geography prefix to the region. A model without on-demand throughput needs its inference profile ID.
`AccessDeniedException` with a credential created for Mantle	Its IAM identity has only `bedrock-mantle:` permissions, and Pullfrog calls `bedrock-runtime` by default. Grant `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream`, plus `bedrock:CallWithBearerToken` for a Bedrock API key, or run the model on the Mantle endpoint.
A model that only Mantle serves fails on its first call	`CLAUDE_CODE_USE_MANTLE` is not set, so the request went to `bedrock-runtime`. Add it to `env:`.
`403` from Mantle	An error naming a `bedrock-mantle:` action means the IAM identity lacks that action. An error that names no action means the AWS account has not been granted that model on Mantle. Contact your AWS account team.

Get started

Working with Pullfrog

Models and billing

Administration

Reference

Setup

Variables

Model IDs

Routing

Mantle endpoint

Troubleshooting

​Setup

​Variables

​Model IDs

​Routing

​Mantle endpoint

​Troubleshooting

Setup

Variables

Model IDs

Routing

Mantle endpoint

Troubleshooting