Overview

Kamiwaza can proxy Amazon Bedrock models through the same OpenAI-compatible APIs used by locally hosted models. Administrators register Bedrock as an external endpoint, deploy it through the normal model lifecycle, and expose familiar /v1/models and /v1/chat/completions routes to application teams.

The Bedrock integration currently supports:

• Meta Llama 3 instruct models
• Amazon Nova models, including streaming chat responses and image inputs
• Anthropic Claude models through the Bedrock Messages API

Prerequisites

Before registering a Bedrock endpoint, make sure:

• Kamiwaza is reachable via HTTPS.
• Your AWS account has Bedrock access enabled in the region you plan to use.
• The target model ID or inference profile is enabled in that AWS account.
• Outbound HTTPS traffic from the Kamiwaza control plane to the Bedrock runtime endpoint is allowed.
• You have either AWS credentials or a Bedrock credential secret that can invoke the target model.

Quick Start (UI)

1. In Kamiwaza, go to Models and click Add external inference endpoint.
2. Select AWS Bedrock from the Service dropdown.
3. Enter the endpoint details:
   • Display Name: Friendly name shown in the UI
   • Model ID or Inference Profile ID / ARN: A Bedrock model ID such as meta.llama3-70b-instruct-v1:0 or amazon.nova-premier-v1:0, or an inference profile ARN such as arn:aws:bedrock:us-east-1:############:inference-profile/us.amazon.nova-premier-v1:0
   • AWS Region: The region where the Bedrock model or profile is available
   • Endpoint URL (optional): Override the Bedrock runtime URL if needed
   • Inference Profile ARN (optional): Optional if the model ID field already contains the ARN
   • Credential Secret or URN: A secret URN or inline credential payload
   • Extra Body JSON: Optional model-native default parameters; the UI defaults to {}
4. Click Save Endpoint.
5. Deploy the new model from the Models list.

Credentials

The Credential Secret or URN field supports:

1. A Kamiwaza secret URN (recommended), such as urn:li:secret:bedrock-creds
2. Inline JSON credentials, which Kamiwaza will store securely on save
3. A raw bearer token or Bedrock API key if your Bedrock setup uses token-based authentication

For standard AWS credentials, the secret value should look like:

{
  "aws_access_key_id": "AKIA...",
  "aws_secret_access_key": "...",
  "aws_session_token": "..."
}

Request Shaping and extra_body

The Extra Body JSON field is optional. In most cases, leave it as {} and send request controls such as max_tokens, temperature, and top_p at call time.

When extra_body is set:

• Kamiwaza merges it into every Bedrock request as a set of defaults.
• Per-request OpenAI-style fields win over values from extra_body.
• For Amazon Nova models, those overrides are applied inside Nova's nested inferenceConfig.
• For Claude models, Kamiwaza automatically adds the required anthropic_version value and a default max_tokens if you omit them.

Model Family Behavior

Kamiwaza keeps the public API shape consistent across supported Bedrock model families:

Multimodal Input

For Claude and Nova deployments, you can send OpenAI-style multimodal chat payloads to the normal /v1/chat/completions route. Nova image inputs currently work with inline data: URLs and native Nova image blocks; arbitrary external image URLs are not fetched by Kamiwaza for Nova requests.

Example request body:

{
  "messages": [
    {
      "role": "user",
      "content": [
        {
          "type": "image_url",
          "image_url": {
            "url": "data:image/png;base64,<base64-image-bytes>"
          }
        },
        {
          "type": "text",
          "text": "What is shown in this image?"
        }
      ]
    }
  ],
  "max_tokens": 128,
  "temperature": 0
}

For Nova, Kamiwaza automatically reshapes that payload into the Bedrock messages-v1 schema and places media before the text prompt inside the user turn, which matches Nova's expected ordering.

Operational notes

• Credentials are stored using Kamiwaza’s encrypted secret store. Rotate the AWS keys on the same cadence as other cloud credentials.
• Region can be supplied explicitly or inferred from a Bedrock runtime endpoint URL or inference profile ARN.
• Error handling surfaces Bedrock response codes directly in the UI and API responses.
• For environments that require VPC endpoints or private connectivity, ensure the control plane network has a permitted path to Bedrock before registering the model.

Next steps

• Pair the Bedrock deployment with the ReBAC validation checklist to ensure access controls are enforced across your hosted APIs.
• Contact Kamiwaza Support if you need help enabling specific Bedrock models, inference profiles, or private network connectivity.