text
Copy
<Steps>
  <Step title="Set AWS credentials on the gateway host">
    ```bash}
    export AWS_ACCESS_KEY_ID="AKIA..."
    export AWS_SECRET_ACCESS_KEY="..."
    export AWS_REGION="us-east-1"
    # Optional:
    export AWS_SESSION_TOKEN="..."
    export AWS_PROFILE="your-profile"
    # Optional (Bedrock API key/bearer token):
    export AWS_BEARER_TOKEN_BEDROCK="..."
    ```
  </Step>

  <Step title="Add a Bedrock provider and model to your config">
    No `apiKey` is required. Configure the provider with `auth: "aws-sdk"`:

    ```json5}
    {
      models: {
        providers: {
          "amazon-bedrock": {
            baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
            api: "bedrock-converse-stream",
            auth: "aws-sdk",
            models: [
              {
                id: "us.anthropic.claude-opus-4-6-v1:0",
                name: "Claude Opus 4.6 (Bedrock)",
                reasoning: true,
                input: ["text", "image"],
                cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
                contextWindow: 200000,
                maxTokens: 8192,
              },
            ],
          },
        },
      },
      agents: {
        defaults: {
          model: { primary: "amazon-bedrock/us.anthropic.claude-opus-4-6-v1:0" },
        },
      },
    }
    ```
  </Step>

  <Step title="Verify models are available">
    ```bash}
    openclaw models list
    ```
  </Step>
</Steps>

<Tip>
  With env-marker auth (`AWS_ACCESS_KEY_ID`, `AWS_PROFILE`, or `AWS_BEARER_TOKEN_BEDROCK`), OpenClaw auto-enables the implicit Bedrock provider for model discovery without extra config.
</Tip>

text
Copy
<Steps>
  <Step title="Enable discovery explicitly">
    When using IMDS, OpenClaw cannot detect AWS auth from env markers alone, so you must opt in:

    ```bash}
    openclaw config set plugins.entries.amazon-bedrock.config.discovery.enabled true
    openclaw config set plugins.entries.amazon-bedrock.config.discovery.region us-east-1
    ```
  </Step>

  <Step title="Optionally add an env marker for auto mode">
    If you also want the env-marker auto-detection path to work (for example, for `openclaw status` surfaces):

    ```bash}
    export AWS_PROFILE=default
    export AWS_REGION=us-east-1
    ```

    You do **not** need a fake API key.
  </Step>

  <Step title="Verify models are discovered">
    ```bash}
    openclaw models list
    ```
  </Step>
</Steps>

<Warning>
  The IAM role attached to your EC2 instance must have the following permissions:

  * `bedrock:InvokeModel`
  * `bedrock:InvokeModelWithResponseStream`
  * `bedrock:ListFoundationModels` (for automatic discovery)
  * `bedrock:ListInferenceProfiles` (for inference profile discovery)

  Or attach the managed policy `AmazonBedrockFullAccess`.
</Warning>

<Note>
  You only need `AWS_PROFILE=default` if you specifically want an env marker for auto mode or status surfaces. The actual Bedrock runtime auth path uses the AWS SDK default chain, so IMDS instance-role auth works even without env markers.
</Note>