AWS Bedrock - Tembo Docs

Use an AWS Bedrock connection to run supported models with credentials from your AWS account.

Prerequisites

A running self-hosted deployment and administrator access to your Tembo organization.
The minimum required variables configured for your instance.
An AWS access key ID and secret access key with permission to invoke the Bedrock models you plan to use.
Bedrock model access enabled in the AWS Region where you will run inference.
Outbound HTTPS access from your Tembo instance to the Amazon Bedrock endpoints for that Region.

Configure AWS Bedrock in `config.json`

Add the following Convict dot-notation keys to /var/lib/tembo/config.json:

{
  "anthropic.useBedrock": true,
  "aws.bedrockApiKey": "<your_bedrock_api_key>",
  "aws.region": "<your_aws_region>"
}

Key	Description
`anthropic.useBedrock`	Routes Tembo’s small Anthropic model through AWS Bedrock.
`aws.bedrockApiKey`	AWS Bedrock bearer token used for API key authentication. Keep this value secret.
`aws.region`	AWS Region where your Bedrock models are enabled, such as `us-east-1`.

Merge these keys into the existing configuration instead of replacing the entire file. After saving, restart the API service:

sudo systemctl restart tembo-ts-api

If your deployment supplies AWS credentials through its runtime identity, such as an EC2 instance profile, you can omit aws.bedrockApiKey. Tembo then uses the runtime AWS credentials for SigV4 authentication.

Configure workspace Bedrock credentials

To let workspace members select Bedrock as the inference provider for supported models:

Sign in to your self-hosted Tembo instance as an organization administrator.
Open Settings → Models → API Keys → AWS Bedrock.
Enter your AWS Access Key ID, AWS Secret Access Key, and AWS Region.
Save the connection.

Tembo stores these credentials at the workspace level and uses them when a selected model runs through AWS Bedrock.

Verify the connection

In Settings → Models, enable a model available through your Bedrock account and select Bedrock as its inference provider. Start a session with that model and send a test prompt. If the request fails, confirm that the credentials are active, the configured Region matches the Region where model access is enabled, and the AWS identity has permission to invoke the selected model.

AWS Bedrock model availability varies by Region and AWS account. A model must be available to your account in the Region configured in Tembo.

​Prerequisites

​Configure AWS Bedrock in config.json

​Configure workspace Bedrock credentials

​Verify the connection

Prerequisites

Configure AWS Bedrock in `config.json`

Configure workspace Bedrock credentials

Verify the connection