Authentication

​

Authentication Methods

1. Create an IAM user (or choose an existing IAM user) following these steps.
2. Add required permission for this user. The following policy grants permission to invoke all model in your available regions (To check the list of available regions for different models, refer to AWS Bedrock).
   1. JSON

      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Sid": "InvokeAllModels",
            "Action": [
              "bedrock:InvokeModel",
              "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": ["arn:aws:bedrock:*::foundation-model/*"]
          },
          {
            "Effect": "Allow",
            "Sid": "RerankModels",
            "Action": ["bedrock:Rerank"],
            "Resource": "*"
          }
        ]
      }
      
      The RerankModels statement is only required if you plan to use Bedrock reranker models through the Rerank API. AWS requires both bedrock:Rerank and bedrock:InvokeModel on the reranker model. Drop this statement if you are not using rerank models.
3. Create an access key for this user as per this doc.
4. Use this access key and secret while adding the model account to authenticate requests to the Bedrock model.

1. You can also directly specify a role that can be assumed by the service account attached to the pods running AI Gateway.
2. Read more about how assumed roles work here.

​

Using Bedrock Guardrails

1. Create a Guardrail in AWS. More information at this link - https://aws.amazon.com/bedrock/guardrails
2. Copy the Guardrails ID and the version number
3. While calling a AWS bedrock model through TFY AI Gateway, pass the following object along with it:
   Extra Params

    "guardrailConfig": {
       "guardrailIdentifier": "your-guardrail-id",
       "guardrailVersion": "1"
     }
   
4. This should ensure the response will have guardrails enforced. Consider this input where the guardrail is configured to censor PII like name, email etc.:
   sample input

   {
     "model": "internal-bedrock/claude-3",
     "messages": [
       {
         "role": "user",
         "content": "What are some ideas for email for Elon Musk?"
       }
     ],
     "guardrailConfig": {
       "guardrailIdentifier": "xyz-123-768",
       "guardrailVersion": "1"
     }
   }
   
5. Sample output:
   expected output

   {
       "id": "1741339101780",
       "object": "chat.completion",
       "created": 1741339101,
       "model": "",
       "provider": "aws",
       "choices": [
           {
               "index": 0,
               "message": {
                   "role": "assistant",
                   "content": "Here are some ideas for email addresses for {NAME}:\n\n1. {EMAIL}\n2. {EMAIL}\n3. {EMAIL}\n4. {EMAIL}\n5. {EMAIL}\n6. {EMAIL} (or any relevant year)\n7. {EMAIL}\n8. {EMAIL}\n9. {EMAIL}\n10. {EMAIL}\n11. {EMAIL}\n12. {EMAIL}\n13. {EMAIL}\n14. {EMAIL}\n15. {EMAIL}\n\nWhen creating an email address, consider the following tips:\n\n1. Keep it professional if it's for work purposes.\n2. Make it easy to spell and remember.\n3. Avoid using numbers or special characters unless necessary.\n4. Consider using a combination of first name, last name, or initials.\n5. You can use different email addresses for personal and professional purposes.\n\nRemember to replace \"example.com\" with the actual domain you'll be using for your email address."
               },
               "finish_reason": "guardrail_intervened"
           }
       ],
       "usage": {
           "prompt_tokens": 25,
           "completion_tokens": 320,
           "total_tokens": 345
       }
   }
   
6. If you’re using a library like Langchain, you might have to pass the extra param in a parameter like extra_body as required by the library. For example, refer this Langchain OpenAI class doc.