Using Amazon Bedrock with OpenClaw

Prerequisites

• ✓An AWS account with Amazon Bedrock access enabled in at least one region (for example, us-east-1).
• ✓IAM credentials or an EC2 instance role with permissions for bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, bedrock:ListFoundationModels, and bedrock:ListInferenceProfiles (or the AmazonBedrockFullAccess managed policy).
• ✓An OpenClaw gateway already installed and reachable where you can run the openclaw CLI and edit its config.
• ✓AWS CLI installed and configured if you plan to use the EC2 IAM role quick-setup path.

Steps

1. 1

   Export AWS credentials for Bedrock on the gateway host

   Start by making sure the OpenClaw gateway host has AWS credentials that the AWS SDK default chain can pick up. This step is critical because Bedrock auth does not use an API key; OpenClaw relies entirely on AWS env vars, shared config, or instance roles.

   If you skip this, discovery and model calls will fail even if your OpenClaw config looks correct.

   bashCopy

   export AWS_ACCESS_KEY_ID="AKIA..."
   export AWS_SECRET_ACCESS_KEY="..."
   export AWS_REGION="us-east-1"
   # Optional:
   export AWS_SESSION_TOKEN="..."
   export AWS_PROFILE="your-profile"
   # Optional (Bedrock API key/bearer token):
   export AWS_BEARER_TOKEN_BEDROCK="..."

2. 2

   Add the Amazon Bedrock provider and a model to OpenClaw

   Next, register the amazon-bedrock provider in your OpenClaw config and point it at the Bedrock Converse streaming API. You do not set an apiKey here because auth flows through the AWS SDK; instead you define the baseUrl, api type, and at least one model, then make that model the default for your agents.

   This gives you a stable, named model route even if you later enable automatic discovery.

   jsonCopy

   {
     models: {
       providers: {
         "amazon-bedrock": {
           baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
           api: "bedrock-converse-stream",
           auth: "aws-sdk",
           models: [
             {
               id: "us.anthropic.claude-opus-4-6-v1:0",
               name: "Claude Opus 4.6 (Bedrock)",
               reasoning: true,
               input: ["text", "image"],
               cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
               contextWindow: 200000,
               maxTokens: 8192,
             },
           ],
         },
       },
     },
     agents: {
       defaults: {
         model: { primary: "amazon-bedrock/us.anthropic.claude-opus-4-6-v1:0" },
       },
     },
   }

3. 3

   Enable automatic Bedrock model discovery

   Turn on discovery so OpenClaw can list Bedrock foundation models and inference profiles that support streaming and text output. Discovery uses bedrock:ListFoundationModels and bedrock:ListInferenceProfiles and caches results, so you get an up-to-date model catalog without hardcoding every ID.

   This is especially useful when AWS adds new models or profiles in your region.

   jsonCopy

   {
     plugins: {
       entries: {
         "amazon-bedrock": {
           config: {
             discovery: {
               enabled: true,
               region: "us-east-1",
               providerFilter: ["anthropic", "amazon"],
               refreshInterval: 3600,
               defaultContextWindow: 32000,
               defaultMaxTokens: 4096,
             },
           },
         },
       },
     },
   }

4. 4

   Configure EC2 instance roles for Bedrock (optional but recommended on AWS)

   If you run OpenClaw on EC2, use an IAM role instead of long-lived access keys. This step creates an EC2 role with AmazonBedrockFullAccess, attaches it to your instance, and then enables discovery with the openclaw CLI.

   It keeps credentials off disk and lets the AWS SDK use IMDS while still giving OpenClaw the env markers it needs for auto mode if you want them.

   bashCopy

   # 1. Create IAM role and instance profile
   aws iam create-role --role-name EC2-Bedrock-Access \
     --assume-role-policy-document '{
       "Version": "2012-10-17",
       "Statement": [{
         "Effect": "Allow",
         "Principal": {"Service": "ec2.amazonaws.com"},
         "Action": "sts:AssumeRole"
       }]
     }'
   
   aws iam attach-role-policy --role-name EC2-Bedrock-Access \
     --policy-arn arn:aws:iam::aws:policy/AmazonBedrockFullAccess
   
   aws iam create-instance-profile --instance-profile-name EC2-Bedrock-Access
   aws iam add-role-to-instance-profile \
     --instance-profile-name EC2-Bedrock-Access \
     --role-name EC2-Bedrock-Access
   
   # 2. Attach to your EC2 instance
   aws ec2 associate-iam-instance-profile \
     --instance-id i-xxxxx \
     --iam-instance-profile Name=EC2-Bedrock-Access
   
   # 3. On the EC2 instance, enable discovery explicitly
   openclaw config set plugins.entries.amazon-bedrock.config.discovery.enabled true
   openclaw config set plugins.entries.amazon-bedrock.config.discovery.region us-east-1
   
   # 4. Optional: add an env marker if you want auto mode without explicit enable
   echo 'export AWS_PROFILE=default' >> ~/.bashrc
   echo 'export AWS_REGION=us-east-1' >> ~/.bashrc
   source ~/.bashrc
   
   # 5. Verify models are discovered
   openclaw models list

5. 5

   Enable Bedrock embeddings for memory search

   Finally, wire Bedrock into OpenClaw’s memory search so your agents use Bedrock embeddings for retrieval. This is configured separately from inference and uses the same AWS SDK credential chain, so you do not need any extra keys.

   Start with the default Amazon Titan Embed model and adjust later if you need different dimensions or providers.

   jsonCopy

   {
     agents: {
       defaults: {
         memorySearch: {
           provider: "bedrock",
           model: "amazon.titan-embed-text-v2:0", // default
         },
       },
     },
   }

Configuration

Troubleshooting

openclaw config set plugins.entries.amazon-bedrock.config.discovery.enabled true
openclaw config set plugins.entries.amazon-bedrock.config.discovery.region us-east-1

{
  plugins: {
    entries: {
      "amazon-bedrock": {
        config: {
          guardrail: {
            guardrailIdentifier: "abc123", // guardrail ID or full ARN
            guardrailVersion: "1", // version number or "DRAFT"
            streamProcessingMode: "sync", // optional: "sync" or "async"
            trace: "enabled", // optional: "enabled", "disabled", or "enabled_full"
          },
        },
      },
    },
  },
}

Frequently asked questions