Amazon Bedrock Integration with OpenClaw via Converse API

OpenClaw can interact with Amazon Bedrock models through the Bedrock Converse streaming provider. Authentication relies on the AWS SDK default credential chain rather than an API key.

Getting started

Pick your preferred authentication method and complete the configuration steps.

Access keys / env vars

Best for: developer machines, CI, or hosts where you manage AWS credentials directly.

Set AWS credentials on the gateway host

export AWS_ACCESS_KEY_ID="EXAMPLE_AWS_ACCESS_KEY_ID"
export AWS_SECRET_ACCESS_KEY="..."
export AWS_REGION="us-east-1"
# Optional:
export AWS_SESSION_TOKEN="..."
export AWS_PROFILE="your-profile"
# Optional (Bedrock API key/bearer token):
export AWS_BEARER_TOKEN_BEDROCK="..."

Add a Bedrock provider and model to your config

No apiKey is necessary. Set up the provider using auth: "aws-sdk":

{
  models: {
    providers: {
      "amazon-bedrock": {
        baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
        api: "bedrock-converse-stream",
        auth: "aws-sdk",
        models: [
          {
            id: "us.anthropic.claude-opus-4-6-v1",
            name: "Claude Opus 4.6 (Bedrock)",
            reasoning: true,
            input: ["text", "image"],
            cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
            contextWindow: 200000,
            maxTokens: 8192,
          },
        ],
      },
    },
  },
  agents: {
    defaults: {
      model: { primary: "amazon-bedrock/us.anthropic.claude-opus-4-6-v1" },
    },
  },
}

Verify models are available

openclaw models list

Tip

When using env-marker authentication (AWS_ACCESS_KEY_ID, AWS_PROFILE, or AWS_BEARER_TOKEN_BEDROCK), OpenClaw automatically activates the implicit Bedrock provider for model discovery without any additional configuration.

EC2 instance roles (IMDS)

Best for: EC2 instances with an IAM role attached, using the instance metadata service for authentication.

Enable discovery explicitly

With IMDS, OpenClaw cannot identify AWS auth from env markers alone, so you need to explicitly opt in:

openclaw config set plugins.entries.amazon-bedrock.config.discovery.enabled true
openclaw config set plugins.entries.amazon-bedrock.config.discovery.region us-east-1

Optionally add an env marker for auto mode

To also make the env-marker auto-detection path functional (for instance, for openclaw status surfaces):

export AWS_PROFILE=default
export AWS_REGION=us-east-1

A fake API key is not required.

Verify models are discovered

openclaw models list

Warning

The IAM role attached to your EC2 instance must include these permissions:

• bedrock:InvokeModel
• bedrock:InvokeModelWithResponseStream
• bedrock:ListFoundationModels (for automatic discovery)
• bedrock:ListInferenceProfiles (for inference profile discovery)

Alternatively, attach the managed policy AmazonBedrockFullAccess.

Note

AWS_PROFILE=default is only needed if you specifically want an env marker for auto mode or status surfaces. The actual Bedrock runtime auth path relies on the AWS SDK default chain, so IMDS instance-role authentication works even without env markers.

Automatic model discovery

OpenClaw can automatically find Bedrock models that support streaming and text output. Discovery uses bedrock:ListFoundationModels and bedrock:ListInferenceProfiles, with results cached for 1 hour by default.

How the implicit provider gets enabled:

• When plugins.entries.amazon-bedrock.config.discovery.enabled is set to true, OpenClaw attempts discovery even without an AWS env marker present.
• If plugins.entries.amazon-bedrock.config.discovery.enabled is not set, OpenClaw only adds the implicit Bedrock provider automatically when it detects one of these AWS auth markers: AWS_BEARER_TOKEN_BEDROCK, AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY, or AWS_PROFILE.
• The actual Bedrock runtime auth path continues to use the AWS SDK default chain, so shared config, SSO, and IMDS instance-role authentication can function even when discovery required enabled: true to opt in.

Note

For explicit models.providers["amazon-bedrock"] entries, OpenClaw can still resolve Bedrock env-marker auth early from AWS env markers like AWS_BEARER_TOKEN_BEDROCK without forcing full runtime auth loading. The actual model-call auth path still uses the AWS SDK default chain.

Discovery config options

Configuration options are located under plugins.entries.amazon-bedrock.config.discovery:

{
  plugins: {
    entries: {
      "amazon-bedrock": {
        config: {
          discovery: {
            enabled: true,
            region: "us-east-1",
            providerFilter: ["anthropic", "amazon"],
            refreshInterval: 3600,
            defaultContextWindow: 32000,
            defaultMaxTokens: 4096,
          },
        },
      },
    },
  },
}

Context window and max-token limits

The Bedrock ListFoundationModels and GetFoundationModel APIs do not provide token limit metadata. They return only the model ID, name, supported modalities, and lifecycle status. OpenClaw includes a built-in lookup table with known context windows and output limits for widely used Bedrock models (Claude, Nova, Llama, Mistral, DeepSeek, and others), so session management, compaction thresholds, and context overflow detection work correctly for those models.

For discovered models not found in that table, defaultContextWindow and defaultMaxTokens are used as fallbacks. If a model you rely on is missing accurate limits, add an explicit models.providers["amazon-bedrock"].models entry to override them.

Quick setup (AWS path)

This walkthrough creates an IAM role, attaches Bedrock permissions, links the instance profile, and activates OpenClaw discovery on the EC2 host.

# 1. Create IAM role and instance profile
aws iam create-role --role-name EC2-Bedrock-Access \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "ec2.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }]
  }'

aws iam attach-role-policy --role-name EC2-Bedrock-Access \
  --policy-arn arn:aws:iam::aws:policy/AmazonBedrockFullAccess

aws iam create-instance-profile --instance-profile-name EC2-Bedrock-Access
aws iam add-role-to-instance-profile \
  --instance-profile-name EC2-Bedrock-Access \
  --role-name EC2-Bedrock-Access

# 2. Attach to your EC2 instance
aws ec2 associate-iam-instance-profile \
  --instance-id i-xxxxx \
  --iam-instance-profile Name=EC2-Bedrock-Access

# 3. On the EC2 instance, enable discovery explicitly
openclaw config set plugins.entries.amazon-bedrock.config.discovery.enabled true
openclaw config set plugins.entries.amazon-bedrock.config.discovery.region us-east-1

# 4. Optional: add an env marker if you want auto mode without explicit enable
echo 'export AWS_PROFILE=default' >> ~/.bashrc
echo 'export AWS_REGION=us-east-1' >> ~/.bashrc
source ~/.bashrc

# 5. Verify models are discovered
openclaw models list

Advanced configuration

Inference profiles

OpenClaw discovers regional and global inference profiles as well as foundation models. When a profile maps to a known foundation model, it inherits that model's capabilities (context window, max tokens, reasoning, vision) and the appropriate Bedrock request region is injected automatically. This means cross-region Claude profiles work without manual provider overrides. Global cross-region profiles (global.*) appear first in openclaw models list because they typically provide better capacity and automatic failover.

Inference profile IDs take the form us.anthropic.claude-opus-4-6-v1 (regional) or anthropic.claude-opus-4-6-v1 (global). If the backing model is already present in the discovery results, the profile inherits its full capability set; otherwise safe defaults are applied.

No additional setup is required. As long as discovery is active and the IAM principal has bedrock:ListInferenceProfiles, profiles show up alongside foundation models in openclaw models list.

Service tier

Certain Bedrock models accept a service_tier parameter to optimize for cost or latency. The following tiers are available:

Set serviceTier (or service_tier) through agents.defaults.params for Bedrock model requests, or per model in agents.defaults.models["<model-key>"].params:

{
  agents: {
    defaults: {
      params: {
        serviceTier: "flex", // applies to all models
      },
      models: {
        "amazon-bedrock/mistral.mistral-large-3-675b-instruct": {
          params: {
            serviceTier: "priority", // per-model override
          },
        },
      },
    },
  },
}

Valid values are default, flex, priority, and reserved. Claude Fable 5, Opus 5, and Sonnet 5 support only the default tier; OpenClaw issues a warning and ignores flex, priority, or reserved when requested for those models. For other models, not every tier is supported. Requesting an unsupported tier returns a Bedrock validation error, and the error message can be misleading (for example "The provided model identifier is invalid" rather than indicating the tier is the issue). If you encounter this error, verify that the model supports the requested tier.

Claude Opus 5, 4.8, and 4.7 temperature

Bedrock does not accept the temperature parameter for Claude Opus 5, Opus 4.8, or Opus 4.7. OpenClaw automatically strips temperature from any matching Bedrock reference, which covers foundation model IDs, named inference profiles, application inference profiles whose underlying model resolves to Opus 5, 4.8, or 4.7 via bedrock:GetInferenceProfile, and dotted opus-4.7/opus-4.8 variants that include optional region prefixes (us., eu., ap., apac., au., jp., global.). No configuration is needed, and the removal applies both to the request options object and the inferenceConfig payload field.

Claude Opus 5

On the Messages-API Bedrock endpoint, use amazon-bedrock/anthropic.claude-opus-5, or a regional or global inference profile like global.anthropic.claude-opus-5 when it shows up in Bedrock discovery. OpenClaw enforces the 1,000,000-token context window, a 128,000-token output limit, image input support, prompt caching, refusal-safe streaming, and native xhigh/max effort levels.

Adaptive thinking is set to high by default. /think off turns thinking off, while /think xhigh|max leaves adaptive thinking active. OpenClaw drops custom sampling parameters and unsupported non-default service tiers.

Claude Fable 5

In us-east-1, use amazon-bedrock/anthropic.claude-fable-5, or regional inference IDs such as us.anthropic.claude-fable-5. OpenClaw applies Fable's 1M context window, 128K output limit, always-on adaptive thinking, and supported effort mapping. /think off and /think minimal are mapped to low; temperature and forced tool choice controls are removed, following the same approach as the Opus 4.7 and 4.8 routes. Streaming output is held until Bedrock returns a terminal status, preventing mid-stream refusals from exposing partial text.

AWS requires an explicit provider_data_share data-retention opt-in before Fable becomes available. Prompts and completions are shared with Anthropic and kept for up to 30 days for trust and safety. Review and configure Bedrock data retention before enabling the model.

Claude Mythos 5

Claude Mythos 5 is available through Bedrock only for accounts that have the required limited-access approval. OpenClaw recognizes the foundation model anthropic.claude-mythos-5 and regional or global inference profiles such as us.anthropic.claude-mythos-5.

OpenClaw enforces the 1,000,000-token context window, a 128,000-token output limit, image input, prompt caching, refusal-safe streaming, and native effort levels. Adaptive thinking is always active: /think off and /think minimal map to low, while xhigh and max remain available. Custom sampling and forced tool choice values are dropped.

Claude Sonnet 5

AWS documents Sonnet 5 for both the bedrock-runtime and bedrock-mantle endpoints. OpenClaw recognizes the Bedrock foundation model anthropic.claude-sonnet-5 and regional or global inference profiles such as us.anthropic.claude-sonnet-5. It applies the 1,000,000-token context window, a 128,000-token output limit, image input, native effort levels, prompt caching, and refusal-safe streaming.

Bedrock keeps adaptive thinking enabled for Sonnet 5. OpenClaw defaults to high; /think off and /think minimal map to low because this route cannot disable thinking. Custom temperature and forced tool choice values are omitted while adaptive thinking is active.

Guardrails

You can apply Amazon Bedrock Guardrails to all Bedrock model invocations by adding a guardrail object to the amazon-bedrock plugin config. Guardrails allow you to enforce content filtering, topic denial, word filters, sensitive information filters, and contextual grounding checks.

{
  plugins: {
    entries: {
      "amazon-bedrock": {
        config: {
          guardrail: {
            guardrailIdentifier: "abc123", // guardrail ID or full ARN
            guardrailVersion: "1", // version number or "DRAFT"
            streamProcessingMode: "sync", // optional: "sync" or "async"
            trace: "enabled", // optional: "enabled", "disabled", or "enabled_full"
          },
        },
      },
    },
  },
}

guardrailIdentifier and guardrailVersion are required.

Warning

Beyond the standard invoke permissions, the IAM principal the gateway uses must also include the bedrock:ApplyGuardrail action.

Embeddings for memory search

Bedrock can also function as the embedding engine for memory search. This setup is independent of the inference provider. To enable it, assign memory.search.provider the value "bedrock":

{
  memory: {
    search: {
      provider: "bedrock",
      model: "amazon.titan-embed-text-v2:0", // default
    },
  },
}

Bedrock embeddings rely on the same AWS SDK credential chain as inference, including instance roles, SSO, access keys, shared config, and web identity. No API key is required.

Supported embedding models are Amazon Titan Embed (v1, v2), Amazon Nova Embed, Cohere Embed (v3, v4), and TwelveLabs Marengo. The Memory configuration reference -- Bedrock page lists every supported model and available dimension sizes.

Notes and caveats

• Your AWS account or region must have model access enabled for Bedrock.
• Automatic model discovery requires the bedrock:ListFoundationModels and bedrock:ListInferenceProfiles permissions.
• When using auto mode, set a supported AWS auth environment variable on the gateway host. To authenticate via IMDS or shared config without environment variables, configure plugins.entries.amazon-bedrock.config.discovery.enabled: true.
• OpenClaw resolves credentials in this priority: AWS_BEARER_TOKEN_BEDROCK, then AWS_ACCESS_KEY_ID together with AWS_SECRET_ACCESS_KEY, then AWS_PROFILE, and finally the default AWS SDK chain.
• Whether reasoning is available depends on the model; consult the Bedrock model card for the latest details.
• As an alternative, you can place an OpenAI-compatible proxy in front of Bedrock, configure it as an OpenAI provider, and use a managed key flow.

Related

• Model selection, Picking providers, model references, and configuring failover.

• Memory search, Configuring Bedrock embeddings for memory search.

• Memory config reference, Complete list of Bedrock embedding models and dimension settings.

• Troubleshooting, General troubleshooting steps and frequently asked questions.