From 7d60cbf09b1e2dc6558b355117cb15611357be13 Mon Sep 17 00:00:00 2001 From: Yevhenii Shcherbina Date: Thu, 25 Jun 2026 12:23:58 -0400 Subject: [PATCH] docs: document Bedrock IAM role assumption (#26703) Document the optional Role ARN field on Bedrock providers, which has the gateway assume an IAM role via STS before calling Bedrock. Covers the permissions the assumed role requires and the trust policy. --------- Co-authored-by: Claude Opus 4.8 (1M context) --- docs/ai-coder/ai-gateway/providers.md | 32 ++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/docs/ai-coder/ai-gateway/providers.md b/docs/ai-coder/ai-gateway/providers.md index 8d21ab4c9c..183c9d5931 100644 --- a/docs/ai-coder/ai-gateway/providers.md +++ b/docs/ai-coder/ai-gateway/providers.md @@ -93,7 +93,7 @@ with AWS credentials rather than a registered API key. Configure: Do not attach API keys to a Bedrock provider. -AI Gateway resolves AWS credentials one of two ways: +AI Gateway resolves AWS credentials one of three ways: - **AWS SDK default credential chain (recommended).** When no explicit credentials are configured, the AWS SDK resolves them automatically @@ -105,6 +105,11 @@ AI Gateway resolves AWS credentials one of two ways: and `bedrock:InvokeModelWithResponseStream` for the configured models. - **Static credentials.** Provide an access key and secret for an IAM user with the same Bedrock permissions. +- **Assumed IAM role.** Set a **Role ARN** to have the gateway assume + that role before calling Bedrock, signing requests with the resulting + temporary credentials. This works on top of either of the above base + identities and supports cross-account Bedrock access. See + [Assuming an IAM role](#assuming-an-iam-role). #### Obtaining static Bedrock credentials @@ -133,6 +138,31 @@ user and generate a static access key: [AI Providers API](../../reference/api/aiproviders.md), along with the region (or base URL) and model identifiers. +#### Assuming an IAM role + +Set the optional **Role ARN** field to have the gateway assume an IAM +role before calling Bedrock. The base identity (static credentials or the +default credential chain) signs an STS `AssumeRole` call, and the +temporary credentials it returns sign Bedrock requests. The field is +optional: a provider with no Role ARN authenticates with its base +identity directly, exactly as described above. + +To use role assumption: + +1. **Create the IAM role** in the target account and grant it + `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream` for + the configured models. The base identity does not need Bedrock + permissions itself; the assumed role does. + +2. **Configure the role's trust policy** to allow the gateway's base + identity to assume it. + +3. **Enter the Role ARN** when you add or edit the Bedrock provider. It must be a + valid IAM role ARN, for example `arn:aws:iam::123456789012:role/BedrockRole`. + +Each provider assumes a single role. To use several roles, configure one +provider per role. + ### GitHub Copilot GitHub Copilot offers three plans: Individual, Business, and Enterprise,