> For the complete documentation index, see [llms.txt](https://docs.mydbsync.com/cloud-workflow/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mydbsync.com/cloud-workflow/ai/ai-agent-api-key-guides/amazon-bedrock-api-key.md).

# Amazon Bedrock API Key

Amazon Bedrock is a fully managed AWS service that provides access to foundation models from multiple providers (such as Anthropic Claude, Meta Llama, Amazon Nova, Amazon Titan, Mistral, and Cohere) through a unified API. Instead of a traditional API key, Amazon Bedrock uses AWS Identity and Access Management (IAM) access key credentials for authentication.

## Prerequisites

Before you begin, ensure that you have the following:

* An active AWS account with a valid payment method (Amazon Bedrock is a pay-as-you-go service).
* Permissions in that account to create IAM users, generate access keys, and manage Amazon Bedrock model access.
* A supported AWS region where Amazon Bedrock is available.

## Configure Amazon Bedrock

{% stepper %}
{% step %}
Sign in to the [AWS Management Console](https://console.aws.amazon.com/console/home) using your root or IAM user account.

<div align="left" data-with-frame="true"><figure><img src="/files/NG0B5ojvR7W06XE3EyKA" alt=""><figcaption></figcaption></figure></div>

If you don't have an AWS account, click **New to AWS? Sign up** and complete the sign-up process. You must provide a payment method.<br>
{% endstep %}

{% step %}
Use the region selector in the top-right corner of the console. Popular regions for Amazon Bedrock include `us-east-1`, `us-west-2`, `eu-west-1`, `ap-northeast-1`, and `ap-south-1`.

<div align="left" data-with-frame="true"><figure><img src="/files/MDtP8bU0XruRHBaFlRqm" alt="" width="213"><figcaption></figcaption></figure></div>

Because model availability varies by region, check the [Amazon Bedrock documentation](https://docs.aws.amazon.com/bedrock/latest/userguide/models-region-compatibility.html) for the latest list.
{% endstep %}

{% step %}
In the search bar, enter **IAM**, then click **IAM** under **Services**.

<div data-with-frame="true"><figure><img src="/files/5NJ9YRjeL90VZUynAW09" alt=""><figcaption></figcaption></figure></div>

1. In the IAM console, click **Users**, then click **Create user**.<br>

   <div data-with-frame="true"><figure><img src="/files/oad0fIb7khAyvhzqRoyn" alt=""><figcaption></figcaption></figure></div>
2. Enter a descriptive name for the user, such as `dbsync-bedrock`. Uncheck the **Provide user access to the AWS Management Console** checkbox, because this account is for API access only. Click **Next**.<br>

   <div data-with-frame="true"><figure><img src="/files/bOY5PqS7Ldiuhty4QL2w" alt=""><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}
Click **Attach policies directly**, then select `AmazonBedrockFullAccess`. Click **Next**.

<div data-with-frame="true"><figure><img src="/files/n9Ps10Zn87PpqebDXQ1F" alt=""><figcaption></figcaption></figure></div>

To follow the principle of least privilege, create a custom policy that grants only the `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream` permissions.
{% endstep %}

{% step %}
Click **Create user**.

<figure><img src="/files/hP7fBaFAwa2TUdvi0Kr7" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Click the newly created user. Then click the **Security credentials** tab, followed by **Create access key**.

<div data-with-frame="true"><figure><img src="/files/1H2F1OWusSKJwgf1CXy5" alt=""><figcaption></figcaption></figure></div>

1. Select **Application running outside AWS** as the use case. Click **Next**, then click **Create access key**.<br>

   <div data-with-frame="true"><figure><img src="/files/K182SFJ09Pne8Dy8bmGC" alt=""><figcaption></figcaption></figure></div>
2. Copy both the access key ID and the secret access key. Click **Done**.

{% hint style="warning" %}
The secret access key is displayed only once. If you lose it, delete the previous access key and create a new one. Never commit AWS credentials to source control or share them by email or chat.
{% endhint %}
{% endstep %}

{% step %}
Go to the DBSync Amazon Bedrock connector page. Enter the **AWS Access Key ID**, **AWS Secret Access Key**, and **AWS Region**.

<div data-with-frame="true"><figure><img src="/files/fcjuZJAhLhTfvY7cGwvE" alt=""><figcaption></figcaption></figure></div>

Click **Save Connection**, then click **Test Connection**.
{% endstep %}
{% endstepper %}