`bedrock://`¶

AWS Bedrock — Anthropic Claude, Meta Llama, Cohere Command, Mistral, Amazon Nova, AI21 Jurassic and others served through Amazon's runtime under one API. Uses Bedrock's Converse API (a unified shape across foundation models) with AWS SigV4 request signing — no API key, just standard AWS credentials.

Reach for bedrock:// when you need:

Claude (or another vendor's model) with AWS IAM and VPC residency.
A single billing relationship across multiple model families.
Cross-region failover via the same scheme by varying region.

URI shape¶

bedrock://chat?model=<bedrock-model-id>&region=<aws-region>&accessKey=<id>&secretKey=<key>&sessionToken=<token>

Parameters¶

Param	Type	Default	Producer/Consumer/Both	Description
`model`	string	`anthropic.claude-3-sonnet-20240229-v1:0`	Producer	Bedrock model id. Full list in the AWS docs. Use either base models (`anthropic.claude-...`) or inference-profile ARNs.
`region`	string	`us-east-1`	Producer	AWS region — drives both the endpoint hostname (`bedrock-runtime.<region>.amazonaws.com`) and the SigV4 region scope.
`accessKey`	string	required	Producer	AWS access key id. Endpoint construction fails if unset.
`secretKey`	string	required	Producer	AWS secret access key. Endpoint construction fails if unset.
`sessionToken`	string	(empty)	Producer	Optional STS session token for assumed-role credentials. When set, `X-Amz-Security-Token` is included in the signed headers.
`temperature`	float	`0.7`	Producer	Sampling temperature; passed inside `inferenceConfig`.
`maxTokens`	int	`4096`	Producer	Cap on output tokens (`inferenceConfig.maxTokens`).

Operation defaults to chat and is the only supported value. Producer-only.

Headers¶

Reads:

Header	Effect
`systemPrompt`	Emulated as a two-turn prefix (user → assistant "Understood.") since the Converse API on this code path doesn't take a top-level system message.

Sets:

Header	Description
`bedrock.model`	Bedrock model id used.
`bedrock.finishReason`	`end_turn`, `max_tokens`, `tool_use`, etc.
`bedrock.usage.inputTokens`	From the Converse response.
`bedrock.usage.outputTokens`	From the Converse response.
`bedrock.usage.totalTokens`	Sum of input + output.

Examples¶

Talk to Claude 3 Sonnet on Bedrock:

- id: bedrock-claude
  from: direct://ask
  steps:
    - to: bedrock://chat?model=anthropic.claude-3-sonnet-20240229-v1:0&region=us-east-1&accessKey=${AWS_ACCESS_KEY_ID}&secretKey=${AWS_SECRET_ACCESS_KEY}

Use temporary STS credentials (e.g. on ECS / IRSA — but you pass the already-resolved triple in):

- to: bedrock://chat?model=meta.llama3-1-70b-instruct-v1:0&region=us-west-2&accessKey=${TMP_AK}&secretKey=${TMP_SK}&sessionToken=${TMP_TOKEN}

Behavior notes¶

SigV4 signing is hand-rolled in the component — no AWS SDK dependency. It signs Authorization, X-Amz-Date, X-Amz-Content-Sha256, and X-Amz-Security-Token (when present). The service name is bedrock and the canonical URI matches the request path.
No credential chain. This component does not read ~/.aws/credentials, env vars (AWS_ACCESS_KEY_ID etc.), or the EC2/IRSA/IMDS metadata endpoint. You must thread credentials through URI params (typically via ${...} config substitution).
System prompts are emulated, not native, because the Converse API on this raw HTTP path expects messages-only. If you need first-class system instructions, use Bedrock's system field via the agent component with the Bedrock LLM provider.
Endpoint: https://bedrock-runtime.<region>.amazonaws.com/model/<modelId>/converse.
No streaming. Convert to ConverseStream requires SSE handling not implemented on this scheme.
120s timeout. No retries.

Source¶

pkg/component/bedrock/bedrock.go
pkg/component/bedrock/bedrock_test.go

bedrock://¶