AWS Bedrock

Head to the AWS docs to sign up for AWS and setup your credentials.

You’ll also need to turn on model access for your account, which you can do by following these instructions.

Authentication

Always set the Bedrock region LibreChat should use:

BEDROCK_AWS_DEFAULT_REGION=us-east-1

LibreChat supports the following authentication methods for Bedrock.

AWS profile

BEDROCK_AWS_DEFAULT_REGION=us-east-1
BEDROCK_AWS_PROFILE=your-profile-name

Use this when you already have credentials in ~/.aws/config or ~/.aws/credentials, or when your profile uses AWS IAM Identity Center, role assumption, or credential_process.

BEDROCK_AWS_PROFILE is a LibreChat-specific setting that passes the selected profile to the AWS SDK credential provider chain for Bedrock. This scopes profile selection to Bedrock without changing credentials used by other integrations. The AWS-standard AWS_PROFILE environment variable is still supported by the AWS SDK default provider chain.

If your profile uses credential_process, secure the AWS config file and helper command. AWS warns that secret material written to stderr can be captured or logged by SDKs and tools.

Default AWS credential provider chain

You can omit Bedrock-specific credentials and profile settings to let the AWS SDK for JavaScript resolve credentials automatically:

BEDROCK_AWS_DEFAULT_REGION=us-east-1

This is the preferred approach for deployments that use IAM roles or another AWS-native short-term credential source. The SDK checks supported credential providers in precedence order and stops at the first valid credentials it finds. Common sources include environment variables, IAM Identity Center/SSO, shared config and credentials files, web identity, ECS container credentials, EC2 instance metadata, and process credentials.

For example, if AWS-standard AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set, those credentials can take precedence over profile-based credentials in ~/.aws/credentials or ~/.aws/config.

Bedrock API key

Amazon Bedrock API keys authenticate Bedrock calls with bearer auth instead of SigV4-signed AWS credentials. In LibreChat, configure them with the Bedrock-scoped environment variable:

BEDROCK_AWS_DEFAULT_REGION=us-east-1
BEDROCK_AWS_BEARER_TOKEN=your_bedrock_api_key

BEDROCK_AWS_BEARER_TOKEN is LibreChat-specific. AWS documentation and raw AWS SDK/CLI examples use the AWS-standard AWS_BEARER_TOKEN_BEDROCK environment variable, but LibreChat intentionally uses a Bedrock-scoped name so the token only affects the Bedrock endpoint configuration. LibreChat passes this value to the AWS SDK as bearer auth.

To let users provide their own Bedrock API key from the LibreChat UI, set:

BEDROCK_AWS_DEFAULT_REGION=us-east-1
BEDROCK_AWS_BEARER_TOKEN=user_provided

Short-term Bedrock API keys inherit the permissions of the AWS principal used to generate them, are valid only in the AWS region where they were generated, and expire no later than 12 hours or the source session expiry. Long-term Bedrock API keys are recommended only for exploration and development. See the AWS docs for using Bedrock API keys and generating Bedrock API keys.

Static Bedrock credentials

Use static Bedrock-specific environment variables only when profiles or IAM roles are not suitable:

BEDROCK_AWS_DEFAULT_REGION=us-east-1
BEDROCK_AWS_ACCESS_KEY_ID=your_access_key_id
BEDROCK_AWS_SECRET_ACCESS_KEY=your_secret_access_key
# BEDROCK_AWS_SESSION_TOKEN=your_session_token

If BEDROCK_AWS_ACCESS_KEY_ID and BEDROCK_AWS_SECRET_ACCESS_KEY are set, LibreChat passes them directly to the Bedrock client. They must be provided together, and they take precedence over BEDROCK_AWS_PROFILE and the SDK default provider chain for Bedrock.

If BEDROCK_AWS_BEARER_TOKEN is set, LibreChat uses bearer auth for Bedrock instead of static credentials, BEDROCK_AWS_PROFILE, or the SDK default provider chain.

For AWS credential behavior details, see the AWS SDK for JavaScript credential provider chain, the AWS SDKs and Tools settings reference, and the AWS credential_process security notes.

Configuring models

You can optionally specify which models you want to make available with BEDROCK_AWS_MODELS:

BEDROCK_AWS_MODELS=anthropic.claude-fable-5,anthropic.claude-opus-4-8,anthropic.claude-opus-4-7,anthropic.claude-sonnet-4-6,meta.llama3-1-8b-instruct-v1:0

Note: If omitted, all known, supported model IDs will be included automatically.

Claude Fable/Mythos-class models on Bedrock are inference-profile only. Use a profile ID such as us.anthropic.claude-fable-5, and enable Anthropic data sharing in the Bedrock console or Data Retention API before invoking them.
See all Bedrock model IDs here:
- https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html#model-ids-arns

Additional Configuration

You can further configure the Bedrock endpoint in your librechat.yaml file:

endpoints:
  bedrock:
    availableRegions:
      - 'us-east-1'
      - 'us-west-2'
    streamRate: 35
    titleModel: 'anthropic.claude-3-haiku-20240307-v1:0'
    guardrailConfig:
      guardrailIdentifier: 'abc123xyz'
      guardrailVersion: '1'
      trace: 'enabled'
      streamProcessingMode: 'sync'

streamRate: (Optional) Set the rate of processing each new token in milliseconds.
- This can help stabilize processing of concurrent requests and provide smoother frontend stream rendering.
titleModel: (Optional) Specify the model to use for generating conversation titles.
- Recommended: anthropic.claude-3-haiku-20240307-v1:0.
- Omit or set as current_model to use the same model as the chat.
availableRegions: (Optional) Specify the AWS regions you want to make available.
- If provided, users will see a dropdown to select the region. If not selected, the default region is used.
guardrailConfig: (Optional) Configure AWS Bedrock Guardrails for content filtering.
- guardrailIdentifier: The guardrail ID or ARN from your AWS Bedrock Console.
- guardrailVersion: The guardrail version number (e.g., "1") or "DRAFT".
- trace: (Optional) Enable trace logging: "enabled", "disabled", or "enabled_full".
- streamProcessingMode: (Optional) Set stream processing mode: "sync" or "async" (defaults to "sync").
- See AWS Bedrock Guardrails documentation for creating and managing guardrails.

Inference Profiles

AWS Bedrock inference profiles let you create custom routing configurations for foundation models, enabling cross-region load balancing, cost allocation, and compliance controls. You can map model IDs to custom inference profile ARNs in your librechat.yaml:

endpoints:
  bedrock:
    inferenceProfiles:
      'us.anthropic.claude-3-7-sonnet-20250219-v1:0': '${BEDROCK_CLAUDE_37_PROFILE}'

For the full guide on creating profiles, configuring LibreChat, setting up logging, and troubleshooting, see Bedrock Inference Profiles.

For the YAML field reference, see AWS Bedrock Object Structure.

Document Uploads

Bedrock supports uploading documents directly to the provider via the Upload to Provider option in the file attachment dropdown menu. Documents are sent to the Bedrock Converse API as native document attachments.

Supported formats: PDF, CSV, DOC, DOCX, XLS, XLSX, HTML, TXT, and Markdown (.md)

Limitations:

Maximum file size per document: 4.5 MB
File names are automatically sanitized to conform to Bedrock's naming requirements (alphanumeric, spaces, hyphens, parentheses, square brackets; max 200 characters)

For more information on file upload options, see the OCR for Documents documentation.

Notes

The following models are not supported due to lack of streaming capability:
- ai21.j2-mid-v1
The following models are not supported due to lack of conversation history support:
- ai21.j2-ultra-v1
- cohere.command-text-v14
- cohere.command-light-text-v14
AWS Bedrock endpoint supports all Shared Endpoint Settings via the librechat.yaml configuration file, including streamRate, titleModel, titleMethod, titlePrompt, titlePromptTemplate, and titleEndpoint

AWS Bedrock

On this page