> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pullfrog.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Amazon Bedrock
> Run Pullfrog on models hosted in your own AWS account through Amazon Bedrock.
Route Pullfrog's model calls through [Amazon Bedrock](https://aws.amazon.com/bedrock/) in your own AWS account. Use it to spend AWS credits or an enterprise AWS commitment, keep inference inside AWS for compliance, or use provisioned throughput you already pay for.
Bedrock is bring-your-own-key only. AWS bills inference to your account, and Pullfrog never proxies Bedrock traffic.
## Setup
In the Pullfrog console, pick the **Amazon Bedrock** tile on the **Provider** card.
Click **Set up** on the tile and save one of these:
* A Bedrock API key, created under **API keys** in the [Bedrock console](https://console.aws.amazon.com/bedrock/home#/api-keys). It becomes `AWS_BEARER_TOKEN_BEDROCK`.
* An IAM access-key pair whose policy allows `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream`.
You can store the credential as a GitHub Actions secret instead and map it in the workflow's `env:` block.
Add `AWS_REGION` and `BEDROCK_MODEL_ID` to the `env:` block of `.github/workflows/pullfrog.yml`. Neither is secret.
```yaml theme={null}
- name: Run agent
uses: pullfrog/pullfrog@v0
with:
prompt: ${{ inputs.prompt }}
env:
AWS_REGION: us-east-1
BEDROCK_MODEL_ID: us.anthropic.claude-opus-5-5
# only when the credential is a GitHub Actions secret
AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}
```
Anthropic models only: before the first call, submit the one-time use-case form in the [Bedrock console](https://console.aws.amazon.com/bedrock/). Open **Model catalog**, pick an Anthropic model, and complete the form.
## Variables
| Name | Secret | Purpose |
| - | - | - |
| `AWS_BEARER_TOKEN_BEDROCK` | Yes | Bedrock API key. Use this or the access-key pair. |
| `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` | Yes | IAM access-key pair. |
| `AWS_SESSION_TOKEN` | Yes | Optional. Needed only with temporary STS credentials. |
| `AWS_REGION` | No | AWS region to call, for example `us-east-1`. |
| `BEDROCK_MODEL_ID` | No | Exact Bedrock model ID. Pullfrog runs it as written and never upgrades it. |
A credential stored in the console needs no `env:` line, because Pullfrog injects it into every run. A value set in the workflow wins over a stored one.
On an account that pays through [Pullfrog Router](/billing#pullfrog-router), store the credential in the Pullfrog console. Pullfrog decides how to fund a run before the runner starts, when GitHub Actions secrets are not visible to it, so a run whose credential exists only there falls back to the Router's default model.
## Model IDs
The model menu has a single **Amazon Bedrock** entry; `BEDROCK_MODEL_ID` names the actual model. Copy the ID from the **Programmatic Access** section of the model's card in [Bedrock's model list](https://docs.aws.amazon.com/bedrock/latest/userguide/model-cards.html). For example:
```bash theme={null}
us.anthropic.claude-opus-5-5 # Claude Opus 5.5, US cross-region inference profile
amazon.nova-pro-v1:0 # Amazon Nova Pro, in-region
openai.gpt-oss-120b-1:0 # gpt-oss-120b, in-region
```
Cross-region inference profiles carry a geography prefix such as `us.`, `eu.`, `jp.`, `au.` or `global.`. Pick the prefix that matches `AWS_REGION`, or use the bare in-region ID where the model card lists one. To change models, edit `BEDROCK_MODEL_ID` and commit.
## Routing
Pullfrog reads the model ID to choose the agent:
* **Anthropic models**, whose ID contains an `anthropic` segment, run on [Claude Code](https://code.claude.com/docs/en/amazon-bedrock). Pullfrog sets `CLAUDE_CODE_USE_BEDROCK=1` for Claude Code.
* **Every other model** runs on OpenCode's `amazon-bedrock` provider.
An application inference profile ARN routes to OpenCode unless its name contains an `anthropic` segment. For an Anthropic model behind such an ARN, set `PULLFROG_AGENT: claude` in the workflow `env:`.
## Troubleshooting
| Symptom | Fix |
| - | - |
| `BEDROCK_MODEL_ID env var is required when the model is set to "bedrock/byok"` | The repository uses Amazon Bedrock, but the workflow does not set `BEDROCK_MODEL_ID`. Add it to `env:`. |
| "Bedrock model selected but required configuration is missing" | The message lists each missing value: the credential, `AWS_REGION`, or `BEDROCK_MODEL_ID`. |
| `AccessDeniedException` on an Anthropic model | The account has not submitted the Anthropic use-case form. Submit it in the Bedrock console, then re-run. |
| `AccessDeniedException` on another model | The IAM policy behind the access keys lacks `bedrock:InvokeModel` or `bedrock:InvokeModelWithResponseStream` for that model. |
| `ValidationException` about the model ID | The ID is not valid in `AWS_REGION`. Check the model card's **Programmatic Access** section and match the geography prefix to the region. A model without on-demand throughput needs its inference profile ID. |
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.