Bedrock

bedrock

YAML config

providers:
  - id: bedrock:anthropic.claude-3-5-sonnet-20240620-v1:0
    config:
      apiKey: ${BEDROCK_API_KEY}

TypeScript usage

import { createProvider } from "@evalguard/core";

const provider = createProvider("bedrock", process.env.BEDROCK_API_KEY);
const response = await provider.complete({
  model: "anthropic.claude-3-5-sonnet-20240620-v1:0",
  messages: [{ role: "user", content: "Hello" }],
});

Authentication

Set BEDROCK_API_KEY in your environment. EvalGuard validates the key on first call and surfaces typed errors for 401 / 403 / rate-limit responses (with Retry-After parsing).

Setup walkthrough

  1. 1. Enable model access in your AWS account: AWS Console → Bedrock → Model access. Each model family (Anthropic Claude, Meta Llama, Mistral, Cohere, Amazon Nova) requires explicit opt-in.
  2. 2. Create an IAM user or role with `bedrock:InvokeModel` and `bedrock:Converse` permissions for the models you've enabled.
  3. 3. Get credentials: access key + secret access key (long-lived) OR an STS session token (preferred for prod — assume an IAM role).
  4. 4. Configure: `providers: [{id: 'bedrock:anthropic.claude-3-5-sonnet-20240620-v1:0', config: {accessKeyId, secretAccessKey, region: 'us-east-1'}}]`. For STS, pass `sessionToken` as well.
  5. 5. Smoke test: model IDs use the full Bedrock model identifier (`anthropic.claude-3-5-sonnet-20240620-v1:0`, NOT `claude-3-5-sonnet-latest`).

Gotchas

  • Model access is per-region AND per-model. Claude Sonnet enabled in us-east-1 doesn't auto-enable in eu-west-1.
  • The Converse API unifies wire format across model families but feature support varies — Llama 3.x doesn't support tool calling, Cohere Command R+ does. Check Bedrock's per-model support matrix.
  • 529-equivalent for Bedrock is `ServiceUnavailableException` or `ThrottlingException` with a long backoff. EvalGuard's ProviderError surfaces the AWS `__type` field for precise classification.
  • SigV4 signing requires a working clock. NTP-skewed runners (>5 min off) get 403 'Signature expired'. Common on container-fresh CI runners.
  • Streaming uses AWS event-stream binary format (NOT SSE). EvalGuard's stream() for Bedrock is deferred to phase 5b — fall back to chat() with maxTokens chunking until then.

Cost note

Anthropic via Bedrock: same per-token rate as Anthropic direct ($3/M input, $15/M output for Sonnet). Difference: pay on AWS bill, get AWS volume discounts. Provisioned Throughput is available for high-volume — quote via AWS Sales.

Recommended models

Eval / judge
anthropic.claude-3-haiku-20240307-v1:0 — cheapest + fast
Agent / tool-use
anthropic.claude-3-5-sonnet-20240620-v1:0 — best tool calling
Vision
anthropic.claude-3-5-sonnet-20240620-v1:0 — strong image OCR

Hand-written · 2026-05-21