AWS bedrock documentation change
Summary
Restructured the getting started guide into a quickstart format with step-by-step API usage examples. Added code samples for Responses API, Chat Completions API, Invoke API, and Converse API. Removed detailed AWS account setup/IAM role creation instructions and replaced with API key authentication.
Security assessment
The change introduces documentation about using long-term API keys for authentication (Step 2 and Step 4), which is a security feature. However, there's no evidence of addressing a specific vulnerability or security incident. The removal of IAM/MFA instructions simplifies onboarding but doesn't indicate a security fix.
Diff
diff --git a/bedrock/latest/userguide/getting-started.md b/bedrock/latest/userguide/getting-started.md index 9cfae5213..4338a5204 100644 --- a//bedrock/latest/userguide/getting-started.md +++ b//bedrock/latest/userguide/getting-started.md @@ -5 +5 @@ -Explore Amazon Bedrock features through the console or API +# Quickstart @@ -7 +7 @@ Explore Amazon Bedrock features through the console or API -# Get started with Amazon Bedrock +In this section, we will show you how to get started with Amazon Bedrock within a few minutes. We will use the OpenAI-compatible APIs: [Responses API](./bedrock-mantle.html) and [Chat Completions API](./inference-chat-completions.html), and the [Invoke](./inference-invoke.html) and [Converse API](./conversation-inference.html) to show you how run an inference request. See [Build](./build.html) for list of complete APIs. @@ -9 +9 @@ Explore Amazon Bedrock features through the console or API -Before you can use Amazon Bedrock, you must carry out the following steps: +**Step 1 - AWS Account:** If you have an AWS account already, skip this step and go to step 2. If you are new to AWS, sign up for an [AWS account](https://portal.aws.amazon.com/billing/signup) and follow instructions. @@ -11 +11 @@ Before you can use Amazon Bedrock, you must carry out the following steps: - * Sign up for an AWS account (if you don't already have one). +**Step 2 - API key:** Once you have an AWS account, you can create a long-term API key to authenticate your requests to Amazon Bedrock. To do that, go to the [Amazon Bedrock service in AWS Console](https://console.aws.amazon.com/bedrock/home#/api-keys/long-term/create) and generate a long term key. For more information, see the [API keys](./api-keys.html) section in the [Build](./build.html) chapter. @@ -13 +13 @@ Before you can use Amazon Bedrock, you must carry out the following steps: - * Create an AWS Identity and Access Management role with the necessary permissions for Amazon Bedrock. +**Step 3 - Get the SDK:** To use this getting started guide, you must have Python already installed. Then install the relevant software depending on the APIs you are using. @@ -14,0 +15 @@ Before you can use Amazon Bedrock, you must carry out the following steps: +Responses/Chat Completions API @@ -18 +19 @@ Before you can use Amazon Bedrock, you must carry out the following steps: -###### Note + pip install boto3 openai @@ -20 +21 @@ Before you can use Amazon Bedrock, you must carry out the following steps: -Beginning June 15, 2025 access to all Amazon Bedrock foundation models is enabled by default. For Anthropic models, first-time users may need to submit use case details before they can access the model. For more information, see [Access Amazon Bedrock foundation models](./model-access.html). +Invoke/Converse API @@ -22 +22,0 @@ Beginning June 15, 2025 access to all Amazon Bedrock foundation models is enable -If you're new to AWS and need to sign up for an AWS account, expand I'm new to AWS. Otherwise, skip that step and instead expand I already have an AWS account. @@ -24 +23,0 @@ If you're new to AWS and need to sign up for an AWS account, expand I'm new to A -If you do not have an AWS account, complete the following steps to create one. @@ -26 +25 @@ If you do not have an AWS account, complete the following steps to create one. -###### To sign up for an AWS account + pip install boto3 @@ -28 +27 @@ If you do not have an AWS account, complete the following steps to create one. - 1. Open [https://portal.aws.amazon.com/billing/signup](https://portal.aws.amazon.com/billing/signup). +**Step 4 - Set environment variables:** Configure your environment to use the API key for authentication. @@ -30 +29 @@ If you do not have an AWS account, complete the following steps to create one. - 2. Follow the online instructions. +Responses/Chat Completions API @@ -32 +30,0 @@ If you do not have an AWS account, complete the following steps to create one. -Part of the sign-up procedure involves receiving a phone call or text message and entering a verification code on the phone keypad. @@ -34 +31,0 @@ Part of the sign-up procedure involves receiving a phone call or text message an -When you sign up for an AWS account, an _AWS account root user_ is created. The root user has access to all AWS services and resources in the account. As a security best practice, assign administrative access to a user, and use only the root user to perform [tasks that require root user access](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#root-user-tasks). @@ -35,0 +33 @@ When you sign up for an AWS account, an _AWS account root user_ is created. The + OPENAI_API_KEY="<provide your long term key>" OPENAI_BASE_URL="https://bedrock-mantle.<your-region>.api.aws/v1" @@ -36,0 +35 @@ When you sign up for an AWS account, an _AWS account root user_ is created. The +Invoke/Converse API @@ -39 +37,0 @@ When you sign up for an AWS account, an _AWS account root user_ is created. The -AWS sends you a confirmation email after the sign-up process isn complete. At any time, you can view your current account activity and manage your account by going to [https://aws.amazon.com/](https://aws.amazon.com/) and choosing **My Account**. @@ -41 +39 @@ AWS sends you a confirmation email after the sign-up process isn complete. At an -###### Secure your AWS account root user + AWS_BEARER_TOKEN_BEDROCK="<provide your long term key>" @@ -43 +41 @@ AWS sends you a confirmation email after the sign-up process isn complete. At an - 1. Sign in to the [AWS Management Console](https://console.aws.amazon.com/) as the account owner by choosing **Root user** and entering your AWS account email address. On the next page, enter your password. +**Step 5 - Run your first inference request:** Amazon Bedrock supports [100+ foundation models](./models.html). Choose a model, and then use the following Python code to run your first inference request. Save the file as `bedrock-first-request.py` @@ -45 +43 @@ AWS sends you a confirmation email after the sign-up process isn complete. At an -For help signing in by using root user, see [Signing in as the root user](https://docs.aws.amazon.com/signin/latest/userguide/console-sign-in-tutorials.html#introduction-to-root-user-sign-in-tutorial) in the _AWS Sign-In User Guide_. +Responses API @@ -47 +44,0 @@ For help signing in by using root user, see [Signing in as the root user](https: - 2. Turn on multi-factor authentication (MFA) for your root user. @@ -49 +45,0 @@ For help signing in by using root user, see [Signing in as the root user](https: -For instructions, see [Enable a virtual MFA device for your AWS account root user (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-virt-mfa-for-root.html) in the _IAM User Guide_. @@ -50,0 +47 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use + from openai import OpenAI @@ -51,0 +49 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use + client = OpenAI() @@ -52,0 +51,5 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use + response = client.responses.create( + model="openai.gpt-oss-120b", + input="Can you explain the features of Amazon Bedrock?" + ) + print(response) @@ -54 +57 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use -###### Create a user with administrative access +Chat Completions API @@ -56 +58,0 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use - 1. Enable IAM Identity Center. @@ -58 +59,0 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use -For instructions, see [Enabling AWS IAM Identity Center](https://docs.aws.amazon.com//singlesignon/latest/userguide/get-set-up-for-idc.html) in the _AWS IAM Identity Center User Guide_. @@ -60 +61 @@ For instructions, see [Enabling AWS IAM Identity Center](https://docs.aws.amazon - 2. In IAM Identity Center, grant administrative access to a user. + from openai import OpenAI @@ -62 +63 @@ For instructions, see [Enabling AWS IAM Identity Center](https://docs.aws.amazon -For a tutorial about using the IAM Identity Center directory as your identity source, see [ Configure user access with the default IAM Identity Center directory](https://docs.aws.amazon.com//singlesignon/latest/userguide/quick-start-default-idc.html) in the _AWS IAM Identity Center User Guide_. + client = OpenAI() @@ -63,0 +65,5 @@ For a tutorial about using the IAM Identity Center directory as your identity so + response = client.chat.completions.create( + model="openai.gpt-oss-120b", + messages=[{"role": "user", "content": "Can you explain the features of Amazon Bedrock?"}] + ) + print(response) @@ -64,0 +71 @@ For a tutorial about using the IAM Identity Center directory as your identity so +Invoke API @@ -67 +73,0 @@ For a tutorial about using the IAM Identity Center directory as your identity so -###### Sign in as the user with administrative access @@ -69 +75,2 @@ For a tutorial about using the IAM Identity Center directory as your identity so - * To sign in with your IAM Identity Center user, use the sign-in URL that was sent to your email address when you created the IAM Identity Center user. + import json + import boto3 @@ -71 +78,10 @@ For a tutorial about using the IAM Identity Center directory as your identity so -For help signing in using an IAM Identity Center user, see [Signing in to the AWS access portal](https://docs.aws.amazon.com/signin/latest/userguide/iam-id-center-sign-in-tutorial.html) in the _AWS Sign-In User Guide_. + client = boto3.client('bedrock-runtime', region_name='us-east-1') + response = client.invoke_model( + modelId='anthropic.claude-opus-4-6-v1', + body=json.dumps({ + 'anthropic_version': 'bedrock-2023-05-31', + 'messages': [{ 'role': 'user', 'content': 'Can you explain the features of Amazon Bedrock?'}], + 'max_tokens': 1024 + }) + ) + print(json.loads(response['body'].read())) @@ -72,0 +89 @@ For help signing in using an IAM Identity Center user, see [Signing in to the AW +Converse API @@ -76,23 +93 @@ For help signing in using an IAM Identity Center user, see [Signing in to the AW -To learn more about IAM, see [Identity and access management for Amazon Bedrock](./security-iam.html) and the [IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/). - -After you have created an administrative user, proceed to I already have an AWS account to set up permissions for Amazon Bedrock. - -Use IAM to create a role for with the necessary permissions to use Amazon Bedrock. You can then add users to this role to grant the permissions. - -###### To create an Amazon Bedrock role - - 1. Create a role with a name of your choice by following the steps at [Creating a role to delegate permissions to an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html) in the IAM User Guide. When you reach the step to attach a policy to the role, attach the [AmazonBedrockFullAccess](./security-iam-awsmanpol.html) AWS managed policy. - - 2. Create a new policy to allow your role to manage access to Amazon Bedrock models. From the following list, select the link that corresponds to your method of choice and follow the steps. Use the following JSON object as the policy. - - * [Creating IAM policies (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) - - * [Creating IAM policies (AWS CLI)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-cli.html) - - * [Creating IAM policies (AWS API)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-api.html) - -JSON - - -**** - + import boto3 @@ -99,0 +95,4 @@ JSON + client = boto3.client('bedrock-runtime', region_name='us-east-1') + response = client.converse( + modelId='anthropic.claude-opus-4-6-v1', + messages=[ @@ -101,11 +100,2 @@ JSON - "Version":"2012-10-17", - "Statement": [ - { - "Sid": "MarketplaceBedrock", - "Effect": "Allow", - "Action": [ - "aws-marketplace:ViewSubscriptions", - "aws-marketplace:Unsubscribe", - "aws-marketplace:Subscribe" - ], - "Resource": "*" + 'role': 'user', + 'content': [{'text': 'Can you explain the features of Amazon Bedrock?'}] @@ -114,28 +104,2 @@ JSON - } - - - 3. Attach the policy that you created in the last step to your Amazon Bedrock role by following the steps at [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html). - - - - -###### To add users to the Amazon Bedrock role - - 1. For users to access an IAM role, you must add them to the role. You can add both users in your account or from other accounts. To grant users permissions to switch to the Amazon Bedrock role that you created, follow the steps at [Granting a user permissions to switch roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html) and specify the Amazon Bedrock role as the `Resource`. - -###### Note - -If you need to create more users in your account so that you can give them access to the Amazon Bedrock role, follow the steps in [Creating an IAM user in your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html). - - 2. After you've granted a user permissions to use the Amazon Bedrock role, provide the user with role name and ID or alias of the account to which the role belongs. Then, guide the user through how to switch to the role by following the instructions at [Providing information to the user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html#roles-usingrole-giveuser). - - - - -## Explore Amazon Bedrock features through the console or API - -After requesting access to the foundation models that you want to use, you'll be ready to explore the different capabilities offered by Amazon Bedrock. - -If you want to familiarize yourself more with Amazon Bedrock first, you can continue to the following pages: - - * To learn how to run basic prompts and generate model responses using the **Playgrounds** in the Amazon Bedrock console, continue to [Get started in the Amazon Bedrock console](./getting-started-console.html). + ) + print(response) @@ -143 +107 @@ If you want to familiarize yourself more with Amazon Bedrock first, you can cont - * To learn how to set up access to Amazon Bedrock operations through the Amazon Bedrock API and test out some API calls, continue to [Get started with the API](./getting-started-api.html). +Execute the code with Python by using the command: @@ -145 +108,0 @@ If you want to familiarize yourself more with Amazon Bedrock first, you can cont - * To learn about the software development kits (SDKs) supported by Amazon Bedrock, continue to [Using Amazon Bedrock with an AWS SDK](./sdk-general-information-section.html). @@ -146,0 +110 @@ If you want to familiarize yourself more with Amazon Bedrock first, you can cont + python3 bedrock-first-request.py @@ -147,0 +112 @@ If you want to familiarize yourself more with Amazon Bedrock first, you can cont +You should see the output of your inference request. @@ -148,0 +114 @@ If you want to familiarize yourself more with Amazon Bedrock first, you can cont +To learn more about using other APIs and endpoints, please refer to [Build](./build.html).