# AWS Bedrock (https://www.librechat.ai/docs/configuration/pre_configured_ai/bedrock)

Head to the [AWS docs](https://docs.aws.amazon.com/bedrock/latest/userguide/getting-started.html) to sign up for AWS and setup your credentials.

You’ll also need to turn on model access for your account, which you can do by [following these instructions](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html).

## Authentication

Always set the Bedrock region LibreChat should use:

```bash filename=".env"
BEDROCK_AWS_DEFAULT_REGION=us-east-1
```

LibreChat supports the following authentication methods for Bedrock.

### AWS profile

```bash filename=".env"
BEDROCK_AWS_DEFAULT_REGION=us-east-1
BEDROCK_AWS_PROFILE=your-profile-name
```

Use this when you already have credentials in `~/.aws/config` or `~/.aws/credentials`, or when your profile uses AWS IAM Identity Center, role assumption, or `credential_process`.

`BEDROCK_AWS_PROFILE` is a LibreChat-specific setting that passes the selected profile to the AWS SDK credential provider chain for Bedrock. This scopes profile selection to Bedrock without changing credentials used by other integrations. The AWS-standard `AWS_PROFILE` environment variable is still supported by the AWS SDK default provider chain.

If your profile uses `credential_process`, secure the AWS config file and helper command. AWS warns that secret material written to `stderr` can be captured or logged by SDKs and tools.

### Default AWS credential provider chain

You can omit Bedrock-specific credentials and profile settings to let the AWS SDK for JavaScript resolve credentials automatically:

```bash filename=".env"
BEDROCK_AWS_DEFAULT_REGION=us-east-1
```

This is the preferred approach for deployments that use IAM roles or another AWS-native short-term credential source. The SDK checks supported credential providers in precedence order and stops at the first valid credentials it finds. Common sources include environment variables, IAM Identity Center/SSO, shared config and credentials files, web identity, ECS container credentials, EC2 instance metadata, and process credentials.

For example, if AWS-standard `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are set, those credentials can take precedence over profile-based credentials in `~/.aws/credentials` or `~/.aws/config`.

### Bedrock API key

Amazon Bedrock API keys authenticate Bedrock calls with bearer auth instead of SigV4-signed AWS credentials. In LibreChat, configure them with the Bedrock-scoped environment variable:

```bash filename=".env"
BEDROCK_AWS_DEFAULT_REGION=us-east-1
BEDROCK_AWS_BEARER_TOKEN=your_bedrock_api_key
```

`BEDROCK_AWS_BEARER_TOKEN` is LibreChat-specific. AWS documentation and raw AWS SDK/CLI examples use the AWS-standard `AWS_BEARER_TOKEN_BEDROCK` environment variable, but LibreChat intentionally uses a Bedrock-scoped name so the token only affects the Bedrock endpoint configuration. LibreChat passes this value to the AWS SDK as bearer auth.

To let users provide their own Bedrock API key from the LibreChat UI, set:

```bash filename=".env"
BEDROCK_AWS_DEFAULT_REGION=us-east-1
BEDROCK_AWS_BEARER_TOKEN=user_provided
```

Short-term Bedrock API keys inherit the permissions of the AWS principal used to generate them, are valid only in the AWS region where they were generated, and expire no later than 12 hours or the source session expiry. Long-term Bedrock API keys are recommended only for exploration and development. See the AWS docs for [using Bedrock API keys](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-use.html) and [generating Bedrock API keys](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-generate.html).

### Static Bedrock credentials

Use static Bedrock-specific environment variables only when profiles or IAM roles are not suitable:

```bash filename=".env"
BEDROCK_AWS_DEFAULT_REGION=us-east-1
BEDROCK_AWS_ACCESS_KEY_ID=your_access_key_id
BEDROCK_AWS_SECRET_ACCESS_KEY=your_secret_access_key
# BEDROCK_AWS_SESSION_TOKEN=your_session_token
```

If `BEDROCK_AWS_ACCESS_KEY_ID` and `BEDROCK_AWS_SECRET_ACCESS_KEY` are set, LibreChat passes them directly to the Bedrock client. They must be provided together, and they take precedence over `BEDROCK_AWS_PROFILE` and the SDK default provider chain for Bedrock.

If `BEDROCK_AWS_BEARER_TOKEN` is set, LibreChat uses bearer auth for Bedrock instead of static credentials, `BEDROCK_AWS_PROFILE`, or the SDK default provider chain.

For AWS credential behavior details, see the [AWS SDK for JavaScript credential provider chain](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/setting-credentials-node.html), the [AWS SDKs and Tools settings reference](https://docs.aws.amazon.com/sdkref/latest/guide/settings-reference.html), and the [AWS `credential_process` security notes](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html).

## Configuring models

- You can optionally specify which models you want to make available with `BEDROCK_AWS_MODELS`:

```bash filename=".env"
BEDROCK_AWS_MODELS=global.anthropic.claude-fable-5-1,global.anthropic.claude-fable-5,global.anthropic.claude-opus-5,global.anthropic.claude-opus-4-8,global.anthropic.claude-opus-4-7,global.anthropic.claude-sonnet-5,global.anthropic.claude-sonnet-4-6,meta.llama3-1-8b-instruct-v1:0
```

If omitted, LibreChat includes its known supported models automatically. Claude 4 and newer defaults use Bedrock cross-region inference profile IDs because their bare `anthropic.` foundation-model IDs do not support on-demand Converse requests. LibreChat uses `global.` profiles where available and `us.` for Claude Opus 4.1. Use `BEDROCK_AWS_MODELS` to select a different profile available to your account.

- Claude Fable/Mythos-class models on Bedrock are inference-profile only. Use a profile ID such as `global.anthropic.claude-fable-5-1`, and enable Anthropic data sharing in the Bedrock console or Data Retention API before invoking them. Fable 5.1 has a 1M-token context window, 128K-token maximum output, adaptive thinking, and prompt-cache support.

- Claude Opus 5 has a 1M-token context window and 128K-token maximum output. Adaptive thinking is enabled unless explicitly disabled. When thinking is disabled, LibreChat limits `xhigh` or `max` effort to `high` so Bedrock accepts the request.

- Claude Sonnet 5 has a 1M-token context window and 128K-token maximum output. LibreChat applies adaptive thinking to foundation, cross-region inference-profile (for example, `us.anthropic.claude-sonnet-5`), and bare application inference-profile IDs. Turning thinking off sends an explicit disabled setting so that choice persists when a conversation is reloaded.

- See all Bedrock model IDs here:
  - **[https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html#model-ids-arns](https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html#model-ids-arns)**

## Additional Configuration

You can further configure the Bedrock endpoint in your [`librechat.yaml`](/docs/configuration/librechat_yaml/) file:

```yaml
endpoints:
  bedrock:
    availableRegions:
      - 'us-east-1'
      - 'us-west-2'
    streamRate: 35
    titleModel: 'anthropic.claude-3-haiku-20240307-v1:0'
    guardrailConfig:
      guardrailIdentifier: 'abc123xyz'
      guardrailVersion: '1'
      trace: 'enabled'
      streamProcessingMode: 'sync'
```

- `streamRate`: (Optional) Set the rate of processing each new token in milliseconds.
  - This can help stabilize processing of concurrent requests and provide smoother frontend stream rendering.

- `titleModel`: (Optional) Specify the model to use for generating conversation titles.
  - Recommended: `anthropic.claude-3-haiku-20240307-v1:0`.
  - Omit or set as `current_model` to use the same model as the chat.

- `availableRegions`: (Optional) Specify the AWS regions you want to make available.
  - If provided, users will see a dropdown to select the region. If not selected, the default region is used.
  - ![image](https://github.com/user-attachments/assets/6f3c5e82-9c6b-4643-8487-07db1061ba49)

- `guardrailConfig`: (Optional) Configure AWS Bedrock Guardrails for content filtering.
  - `guardrailIdentifier`: The guardrail ID or ARN from your AWS Bedrock Console.
  - `guardrailVersion`: The guardrail version number (e.g., `"1"`) or `"DRAFT"`.
  - `trace`: (Optional) Enable trace logging: `"enabled"`, `"disabled"`, or `"enabled_full"`.
  - `streamProcessingMode`: (Optional) Set stream processing mode: `"sync"` or `"async"` (defaults to `"sync"`).
  - See [AWS Bedrock Guardrails documentation](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-how.html) for creating and managing guardrails.

## Inference Profiles

AWS Bedrock inference profiles let you create custom routing configurations for foundation models, enabling cross-region load balancing, cost allocation, and compliance controls. You can map model IDs to custom inference profile ARNs in your `librechat.yaml`:

```yaml
endpoints:
  bedrock:
    inferenceProfiles:
      'us.anthropic.claude-3-7-sonnet-20250219-v1:0': '${BEDROCK_CLAUDE_37_PROFILE}'
```

For the full guide on creating profiles, configuring LibreChat, setting up logging, and troubleshooting, see **[Bedrock Inference Profiles](/docs/configuration/pre_configured_ai/bedrock_inference_profiles)**.

For the YAML field reference, see **[AWS Bedrock Object Structure](/docs/configuration/librechat_yaml/object_structure/aws_bedrock#inferenceprofiles)**.

## Document Uploads

Bedrock supports uploading documents directly to the provider via the `Upload to Provider` option in the file attachment dropdown menu. Documents are sent to the Bedrock Converse API as native document attachments.

**Supported formats:** PDF, CSV, DOC, DOCX, XLS, XLSX, HTML, TXT, and Markdown (.md)

**Limitations:**

- The default maximum file size is **4.5 MB**.
- When `fileConfig` does not set a smaller limit, Claude 4+ PDFs and Amazon Nova PDFs or DOCX files can be up to **32 MB**.
- File names are automatically sanitized to conform to Bedrock's naming requirements (alphanumeric, spaces, hyphens, parentheses, square brackets; max 200 characters)

For more information on file upload options, see the [OCR for Documents](/docs/features/ocr#5-upload-files-to-provider-direct) documentation.

## Notes

- The following models are not supported due to lack of streaming capability:
  - ai21.j2-mid-v1

- The following models are not supported due to lack of conversation history support:
  - ai21.j2-ultra-v1
  - cohere.command-text-v14
  - cohere.command-light-text-v14

- AWS Bedrock endpoint supports all [Shared Endpoint Settings](/docs/configuration/librechat_yaml/object_structure/shared_endpoint_settings) via the `librechat.yaml` configuration file, including `streamRate`, `titleModel`, `titleMethod`, `titlePrompt`, `titlePromptTemplate`, and `titleEndpoint`