Amazon Bedrock — Inference on your account

With this integration, SecureAI’s large language model (LLM) calls for the families you choose run on your own AWS account, through Amazon Bedrock, instead of on SecureAI-managed providers. Usage is billed by AWS to your account, so it draws down your AWS commitment (EDP) and credits, and it uses your Bedrock quotas. SecureAI stays in the path of every request: DLP, model policies, data residency, and signed receipts apply exactly as they do with any other provider. Traffic goes through SecureAI’s gateway, which also inspects and redacts the model’s responses (streaming included) before they reach the user.

Not to be confused with the other AWS card. This page connects Bedrock as an inference provider (Admin → Integrations → AI providers). The AWS Bedrock card in the Cloud category inventories agents, models, identities, and costs in read-only mode and never sends a prompt; it is described in AWS — Discovery. Both use the same CloudFormation template and the same External ID, but each has its own role with different permissions.

How it works

You deploy an IAM role in your AWS account that only SecureAI’s principal can assume, and only when it presents your organization’s External ID.
For each call, SecureAI assumes that role and gets temporary credentials (they last one hour and renew automatically). No access key is stored.
SecureAI signs the request with AWS Signature V4 and sends it, through its gateway, to Amazon Bedrock Runtime in the Region you chose: Chat Completions for OpenAI-compatible models, and Anthropic’s Messages API for Claude.
The response comes back through the gateway, which applies DLP and issues the signed receipt.

SecureAI does not use Bedrock API keys (bearer tokens). That is why the integration works even if your organization blocks Bedrock API keys with an SCP, a guardrail AWS commonly recommends.

What runs on Bedrock and what does not

Runs on your Bedrock	Stays on SecureAI-managed providers
Chat and agents (models from the families you choose)	Embeddings (document and index search)
Grammar check, translation, Teams summaries and other background tasks, when their family runs on Bedrock or you choose Remap everything	Search re-ranking, document OCR
	Admin assistant, image generation, realtime voice
	Self-hosted models and the Claude Code proxy

Model families available on Bedrock:

Family	Models
Claude (Anthropic)	The Claude models Bedrock offers in your Region. Bedrock is SecureAI’s only bring-your-own-cloud lane that serves Claude: the Vertex AI and Azure AI Foundry lanes do not.
OpenAI	GPT‑5.x on Bedrock
gpt‑oss	For example `gpt-oss-120b`
DeepSeek	DeepSeek V3.x
Qwen	Bedrock’s Qwen models
Mistral	Mistral Large 3, Ministral 3, Magistral, Devstral

Not offered through Bedrock: Llama, Amazon Nova, DeepSeek‑R1, Mistral 7B, and Mixtral. On Bedrock those models only answer the Converse API, not the OpenAI-compatible surface SecureAI uses, so they stay on SecureAI-managed providers. Gemini is not on Bedrock.

How many cloud providers you can use

Plan	Inference providers enabled at the same time
Scale	1 (Google Vertex AI, Azure AI Foundry, or Amazon Bedrock)
Enterprise	Up to 3 — for example Vertex AI for Gemini, Foundry for GPT, and Bedrock for Claude

With more than one provider enabled, each one serves different model families: a family can be routed to only one provider, and only one provider can use Remap everything. SecureAI refuses a configuration that overlaps another one and tells you which family collides.

Prerequisites

An AWS account where the models you want to use are available to your account in the chosen Region.
For Claude: Anthropic’s use-case form submitted once in the Bedrock console (Model access / Model catalog → any Claude model). Approval is usually immediate. Without it, the connection test tells you so.
Some of the newest models (latest Claude, GPT‑5.x, Grok) may need AWS to enable them for your account. Until then, the test reports that the model is not available for your account.
Permission in AWS to create a CloudFormation stack with IAM roles (or to create an IAM role by hand).
Admin permission on the Integrations section of SecureAI.

Step 1. Copy SecureAI’s identity

Go to Admin → Integrations → AI providers and open Amazon Bedrock — Inference on your account.

Under Connection, leave Cross-account IAM role (recommended) selected. The drawer shows:

Item	What it is for
SecureAI principal	The ARN your role will trust. It is the only one that can assume it.
Your External ID	Unique to your organization. The role refuses any caller that does not present it, so no other SecureAI customer can use your role (protection against the confused deputy problem).

If you will also use AWS — Discovery, tick Also create the read-only discovery role: the same stack creates both roles.

Step 2. Create the role in your AWS account

CloudFormation (recommended)
Manual role (no CloudFormation)
IAM user access key

Deploy the SecureAI stack once in the AWS account where inference will run, in one of two ways:

Launch Stack in AWS (when your deployment offers it): opens the CloudFormation console with every parameter filled in. Tick the IAM acknowledgement and click Create stack.
Download template and create the stack from the console (Create stack → Upload a template file) with the principal and External ID from step 1, or with the AWS CLI command shown in the drawer. Copy it from the drawer: it already includes your values. It looks like this:

aws cloudformation deploy --stack-name SecureAI-Integration \
  --template-file secureai-integration.yaml \
  --capabilities CAPABILITY_NAMED_IAM --region us-east-1 \
  --parameter-overrides SecureAIPrincipalArn=<SecureAI principal ARN> \
    ExternalId=<External ID> EnableInference=true EnableDiscovery=true

The stack creates the SecureAI-BedrockInference role and, if you asked for it, the read-only SecureAI-Discovery role. It creates no access key.

Stack parameter	What it controls
`SecureAIPrincipalArn` / `ExternalId`	SecureAI’s identity from step 1.
`EnableInference`	Creates the inference role (default `true`).
`EnableDiscovery`	Creates the read-only discovery role (default `true`).
`AllowRevokeAccessKeys`	Discovery only: lets SecureAI deactivate and reactivate IAM access keys (default `false`).
`RoleNamePrefix`	Prefix of the role names (default `SecureAI`).

When the stack completes, copy the BedrockInferenceRoleArn output (CloudFormation → Stacks → SecureAI-Integration → Outputs).

If your organization does not allow CloudFormation, create the role by hand in IAM → Roles → Create role → Custom trust policy, named SecureAI-BedrockInference, with a maximum session duration of 1 hour.Trust policy (replace the values in <> with the ones from step 1):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "SecureAIWithExternalId",
      "Effect": "Allow",
      "Principal": { "AWS": "<SecureAI principal ARN>" },
      "Action": "sts:AssumeRole",
      "Condition": { "StringEquals": { "sts:ExternalId": "<External ID>" } }
    }
  ]
}

Permissions policy (inline; replace <account id> with your 12-digit account ID):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeModels",
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/*",
        "arn:aws:bedrock:*:<account id>:inference-profile/*",
        "arn:aws:bedrock:*:<account id>:application-inference-profile/*"
      ]
    },
    {
      "Sid": "ReadModelCatalog",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels",
        "bedrock:GetFoundationModel",
        "bedrock:ListInferenceProfiles",
        "bedrock:GetInferenceProfile"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ApplyYourGuardrails",
      "Effect": "Allow",
      "Action": "bedrock:ApplyGuardrail",
      "Resource": [
        "arn:aws:bedrock:*:<account id>:guardrail/*",
        "arn:aws:bedrock:*:<account id>:guardrail-profile/*"
      ]
    },
    {
      "Sid": "ListYourGuardrails",
      "Effect": "Allow",
      "Action": "bedrock:ListGuardrails",
      "Resource": "*"
    }
  ]
}

Copy the ARN of the role you created.

As an alternative, SecureAI accepts the access key of a dedicated IAM user (Access key ID and Secret access key). Give the user the same permissions policy as the manual role.

A long-lived access key is less safe than the role: it never expires, and anyone holding it can call Bedrock as you until you rotate it. SecureAI stores the secret encrypted and never shows it again. Temporary (ASIA…) keys are refused because they expire within hours. We recommend the role: if you switch to it later, SecureAI deletes the stored access key.

Why the resource Region is *. A cross-Region inference profile needs permission on the profile and on the model in every Region it may route to. You can narrow the model list in the policy if you want; the Region must stay broad for the profiles you use.

Step 3. Connect the account in SecureAI

Under Connection, fill in:

Field	What to enter
Role ARN	The `BedrockInferenceRoleArn` output (or the manual role’s ARN). With an access key: the Access key ID and Secret access key.
AWS Region	Where Bedrock receives your calls and where the model list is read (for example `us-east-1`, `eu-central-1`). Pick Other to type any Region Bedrock supports.
Inference scope	Geography (default), In-Region only, or Global. See Data residency.

Click Save. SecureAI assumes the role, shows your AWS account ID, and reads the Region’s catalog under Models available to your account: the Region’s foundation models and the cross-Region inference profiles. Nothing is routed yet: the integration is saved turned off so you can test it first.

If the model list shows an error, the role cannot read the catalog (bedrock:ListFoundationModels / bedrock:ListInferenceProfiles) in that Region. Inference still works with SecureAI’s built-in model ids (the connection test proves them), but automatic mapping is limited. If you change the Region, save again to re-read the models.

Data residency: inference scope

The inference scope decides where AWS may process prompts:

Scope	What SecureAI uses	Where prompts are processed
In-Region only	The Region’s foundation models	Only in the chosen Region; calls never leave it. Claude and GPT‑5.x are unavailable: Bedrock offers them only through cross-Region profiles.
Geography (default)	The cross-Region inference profile of your Region’s geography (`us.`, `eu.`, `apac.`, `jp.`, `au.`, `ca.`)	In any Region of that geography, never outside it. Keeps residency and unlocks Claude and GPT‑5.x.
Global	`global.` profiles	In any commercial AWS Region. Highest capacity, but it pins no residency: SecureAI’s residency policy treats it as unpinned.

SecureAI enforces your organization’s data-residency policy on the resulting geography. If you need residency, use Geography or In-Region only.

Your own Bedrock Guardrail (optional)

If your organization already uses Amazon Bedrock Guardrails, you can have SecureAI apply one of your guardrails to every call it makes on this connection. It is a second layer on top of SecureAI’s DLP: Bedrock evaluates the prompt and the reply with your own denied topics, content filters, word filters, sensitive-information filters and grounding checks. It applies to Claude and to the Chat Completions models alike (gpt-oss, DeepSeek, Mistral, Qwen, GPT‑5.x).

In the Bedrock console (Guardrails), create or choose the guardrail in the same Region you configured in SecureAI, and publish a version (Create version).
In SecureAI’s Amazon Bedrock panel, under Your Bedrock Guardrail (optional), click List my guardrails and pick the guardrail and the version. If the role cannot list them, type the guardrail id (or its ARN) and the version number.
Click Save, then Test connection: the test goes through the guardrail exactly like real traffic.

To remove it, choose None as the guardrail and save.

When…	Result
The guardrail lets the call through	The user gets the model’s reply, unchanged.
The guardrail blocks the prompt or the reply	The user gets the blocked message you configured in the guardrail. For API integrations, the reply comes with `finish_reason: "content_filter"`. Every intervention is logged (`SAI-BEDROCK-006`).
The role cannot apply the guardrail, or the version does not exist	The call is refused. It is never retried on SecureAI’s providers, even if you allowed fallback: that path cannot apply your guardrail.

Use a published version in production. DRAFT is the guardrail’s working copy: anyone editing it in the console changes what is applied here, without a new version. SecureAI allows it, but warns you.

Permissions. The role needs bedrock:ApplyGuardrail on your guardrails and, for the list, bedrock:ListGuardrails. SecureAI’s CloudFormation template includes both from this version on: if you deployed the stack earlier, update it with the new template (or add the two statements of the manual role’s policy). If the guardrail uses cross-Region inference, the template also covers its guardrail profiles.How it is applied. SecureAI sends the id and the version in the X-Amzn-Bedrock-GuardrailIdentifier and X-Amzn-Bedrock-GuardrailVersion headers, inside the Signature V4 signature of each request: nothing on the path can drop them without AWS refusing the call, and no user or integration can pick another guardrail. SecureAI does not turn on the guardrail trace, so the content that triggered it is not returned in the reply.AWS logs. If Bedrock model invocation logging is on, AWS stores the original content even when the guardrail masks it. Encrypt those logs with KMS and restrict access to them.

Claude prompt caching

On Claude models, SecureAI automatically uses Bedrock prompt caching so your account pays less and answers faster when a conversation reuses long context. There is nothing to configure.

SecureAI marks up to two cache points per request: the system prompt and the last long block of the conversation (a pasted document, a search context, a long tool result).
It marks them only when the content before them reaches the model’s token minimum (for example 1,024 on Claude Sonnet 4.6 and 4,096 on Claude Haiku 4.5). Short prompts are sent exactly as before.
The cache lasts 5 minutes from its last use. Reading from cache costs about 10% of an input token; writing it costs 25% more than a regular token, and only on content that reaches the minimum. It pays off from two calls with the same context in that window, which is the usual case in a conversation.
Each turn’s usage separates the tokens read from cache and the ones written, so you can see them in analytics and on your AWS bill.

Models other than Claude are not affected.

Step 4. Choose what runs on Bedrock

Under What runs on Amazon Bedrock there are two modes:

Only these model families: the families you tick run on your Bedrock; every other model keeps running on SecureAI-managed providers (or another connected cloud).
Remap everything to Amazon Bedrock: all LLM calls run on your Bedrock. Models with no Bedrock equivalent are served by a default model.

Automatic mapping. On save, SecureAI maps each SecureAI catalog model to the Bedrock id that serves it under your inference scope. For example, with Geography in a US Region:

SecureAI model	Bedrock id
`anthropic/claude-sonnet-4.6`	`us.anthropic.claude-sonnet-4-6`
`openai/gpt-oss-120b`	`openai.gpt-oss-120b-1:0`

Default Bedrock models (pick them from your account’s model list):

Tier	Used for
Fast	Background tasks (grammar, translation, Teams) and remapped internal calls
Standard	Models with no equivalent
Reasoning	Reasoning models with no equivalent
Vision	Requests with images or PDFs

Under Model → Bedrock id overrides you can send a catalog model to an exact Bedrock target: a model id, an inference profile id, or the ARN of an application inference profile. Overrides win over the automatic mapping and are used as-is, even outside the chosen scope; the residency policy is still enforced on the resulting geography. There are also two options:

Option	Off (default, recommended)	On
Allow fallback to SecureAI-managed models	If Bedrock fails or a model has no Bedrock id, the request is refused (fails closed) instead of being sent to another provider.	Those requests are retried once on SecureAI-managed providers. The retry is audited.
Apply user point quotas to Amazon Bedrock usage	Bedrock usage does not consume users’ monthly points.	Per-user point limits apply to Bedrock too.

Step 5. Test, review, and turn it on

Test connection sends a minimal request to each default model, through the same path real traffic uses (gateway, policies, and receipts included), and shows each result with its latency. If you have not chosen default models yet, it probes gpt-oss-120b, DeepSeek V3.2, and Claude Haiku 4.5 under your inference scope. The test is billed to your AWS account (cents).
Routing preview shows, for every catalog model, whether Your Amazon Bedrock (and with which id), another connected cloud, or SecureAI will serve it, and which models will be hidden from users.
When the test passes, turn on Route traffic to Amazon Bedrock and click Save. If you do not save, the switch does not stay on. If your plan allows no further cloud provider or the routing overlaps another one, SecureAI refuses it and says why.
The card turns green: Routing to Amazon Bedrock. If it is saved but off, it shows Configured · not routing to Bedrock.

Models served by your Bedrock show the Your Bedrock badge in the chat model selector; hovering it says they are served by your organization’s Amazon Bedrock.

What is billed, and to whom

LLM usage is billed by AWS to your account, with your EDP, discounts, and credits. Rate limits are your Bedrock quotas.
SecureAI shows the cost of those turns as a list-price estimate for analytics only; AWS’s actual figure may be lower.
Turns on Bedrock do not deduct points from users unless you turn on Apply user point quotas.

Security and compliance

No stored secrets. With the role, SecureAI stores no AWS credential: it gets one-hour temporary credentials and renews them automatically. If you use an access key, the secret is stored encrypted and never returned to the browser.
Scoped trust. The trust policy admits only SecureAI’s principal, and only with sts:ExternalId equal to your organization’s External ID.
Least privilege. The inference role can only invoke models (bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream), read the model catalog, and list and apply your account’s Bedrock Guardrails. It cannot read your data, your IAM, or your billing.
Compatible with your SCPs. SecureAI signs with Signature V4 and temporary credentials; it does not need Bedrock API keys.
The path stays protected. Every call goes through SecureAI’s SMLTP gateway: DLP on the prompt and on the response (streaming included), a per-request authorization token, and a verifiable signed receipt.
Fails closed. If the configuration cannot be read or the role cannot be assumed, the request is refused; it is not sent to another provider unless you allowed fallback.
Audit. Saving, testing, or disconnecting the integration is recorded in the activity log, never with the secret.

Disconnect and revoke

Disconnect (drawer footer) deletes the configuration. From then on, all traffic Bedrock served returns to SecureAI-managed providers. You can also turn off only Route traffic to Amazon Bedrock to pause routing while keeping the connection. To revoke SecureAI’s access in AWS, delete the stack (or the role). If you used an access key, deactivate or delete it in IAM.

Troubleshooting

These are the reasons Test connection shows:

Reason	Likely cause	What to do
Credential	SecureAI could not assume the role: the stack is not deployed, the ARN is wrong, or the trust policy lacks SecureAI’s principal or your External ID. With an access key: the key is invalid.	Check the ARN and the stack (or the key pair).
Blocked by an SCP	A service control policy of your AWS organization denies the action	Ask your cloud team to allow `bedrock:InvokeModel` for this account and Region. The stack cannot fix it.
Permission denied	The role or user lacks `bedrock:InvokeModel` on that model	Update the SecureAI stack or extend the IAM policy.
Anthropic use-case form	Claude is not enabled for your account yet	Submit Anthropic’s form in the Bedrock console (Model access / Model catalog → a Claude model) and test again.
Model not entitled	AWS has not opened that model to your account or Region yet	Request it through your AWS account team; meanwhile, pick another model.
Model not available	The id is not offered in that Region or inference scope	Refresh the model list, pick another id, or widen the scope.
Quota	Bedrock throttled the requests	Retry later, or request a higher quota in Service Quotas.
Cannot apply the guardrail	The role lacks `bedrock:ApplyGuardrail` on the chosen guardrail	Update the SecureAI stack with the new template, or grant the permission on the guardrail.
Guardrail not found	The guardrail id or version does not exist in that Region	Pick it again from the list, or check the id and that the version is published.
Blocked by your SMLTP model policy	SecureAI’s policy does not allow the model	Add the model to the allowed policy.
Amazon Bedrock returned an error	A failure on AWS’s side	Retry; if it persists, check the AWS service status.
SMLTP Bedrock gateway unreachable / TLS error	A SecureAI infrastructure issue	Contact support. It does not depend on your AWS account.

Errors users may see in the chat:

Code	Meaning
`SAI-BEDROCK-001`	The chosen model has no Bedrock equivalent in your Region and inference scope, and fallback is off. Pick another model, widen the scope, or allow fallback.
`SAI-BEDROCK-002`	AWS credentials could not be obtained (the role cannot be assumed or the access key is invalid). Check the stack and the connection.
`SAI-VERTEX-005`	The cloud-inference configuration could not be read; the request was refused for safety. Retry in a few seconds.

Current limitations

Llama, Amazon Nova, DeepSeek‑R1, Mistral 7B, and Mixtral are not served through Bedrock (on Bedrock they only answer the Converse API).
With In-Region only, Claude and GPT‑5.x are unavailable.
Claude on Bedrock: every request gets its signed receipt, but the audit evidence does not yet bind the retained response to that receipt (the “response bound to receipt” flag is not available for these turns).
Embeddings, re-ranking, OCR, the admin assistant, image generation, and realtime voice stay on SecureAI-managed providers.

AWS — Discovery — inventory of Bedrock agents, models, identities, and cost.
Google Vertex AI — Inference on your account
Azure AI Foundry — Inference on your account
Cloud AI Providers Overview
Signed receipts

Getting Started

Security, SMLTP & DLP

AI Gateway

Identity & Access (SSO)

AI Discovery (Shadow AI)

Endpoint Agent

Integrations: Cloud AI & IDEs

Integrations: Files (Drive & SharePoint)

Integrations: SIEMs, Network & MCP

Amazon Bedrock — Inference on your account

Amazon Bedrock — Inference on your account

How it works

What runs on Bedrock and what does not

How many cloud providers you can use

Prerequisites

Step 1. Copy SecureAI’s identity

Step 2. Create the role in your AWS account

Step 3. Connect the account in SecureAI

Data residency: inference scope

Your own Bedrock Guardrail (optional)

Claude prompt caching

Step 4. Choose what runs on Bedrock

Step 5. Test, review, and turn it on

What is billed, and to whom

Security and compliance

Disconnect and revoke

Troubleshooting

Current limitations

​Amazon Bedrock — Inference on your account

​How it works

​What runs on Bedrock and what does not

​How many cloud providers you can use

​Prerequisites

​Step 1. Copy SecureAI’s identity

​Step 2. Create the role in your AWS account

​Step 3. Connect the account in SecureAI

​Data residency: inference scope

​Your own Bedrock Guardrail (optional)

​Claude prompt caching

​Step 4. Choose what runs on Bedrock

​Step 5. Test, review, and turn it on

​What is billed, and to whom

​Security and compliance

​Disconnect and revoke

​Troubleshooting

​Current limitations

​Related

Amazon Bedrock — Inference on your account

How it works

What runs on Bedrock and what does not

How many cloud providers you can use

Prerequisites

Step 1. Copy SecureAI’s identity

Step 2. Create the role in your AWS account

Step 3. Connect the account in SecureAI

Data residency: inference scope

Your own Bedrock Guardrail (optional)

Claude prompt caching

Step 4. Choose what runs on Bedrock

Step 5. Test, review, and turn it on

What is billed, and to whom

Security and compliance

Disconnect and revoke

Troubleshooting

Current limitations

Related