Skip to content
AI Cloud Gateway
Documentation menu

Your AWS account

Requests run in your AWS account through an IAM role you create with one CloudFormation stack. Each subscription connects one AWS account. Setup steps are in the Quickstart.

What the stack creates

One IAM role, named AICloudGatewayRouter- followed by a short suffix. Only AI Cloud Gateway can assume it, and only with the External ID unique to your subscription. It can:

  • invoke Bedrock models and inference profiles (bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream);
  • list and describe them, read-only, so the dashboard can show which models you have enabled;
  • apply and read Amazon Bedrock Guardrails (bedrock:ApplyGuardrail, bedrock:GetGuardrail), used only if you turn a guardrail on.

It cannot read or change anything else in your account, and has no AWS Marketplace permissions. Sessions last at most one hour.

Enable more models

Amazon Nova, Meta Llama and OpenAI gpt-oss work on first use. Anthropic Claude models need a one-time AWS Marketplace subscription in your account:

  1. Sign in as an administrator (with aws-marketplace:Subscribe).
  2. In the Bedrock console, in the connected region, open Model catalog and enable each model the dashboard lists. AWS may ask a short use-case form for Anthropic models.
  3. After a few minutes, choose Test again in the dashboard.

A request pinned to a model that is not enabled fails with 403 bedrock_model_not_enabled.

Quotas

Bedrock quotas are your account's. If one model is throttled, the request moves to the next; if all are, you get 429 bedrock_throttled. Raise quotas in AWS Service Quotas.

Disconnect

Delete the stack. Calls then fail with 403 bedrock_access_denied.

Full guide: aws-account.md on GitHub