Amazon Bedrock

Authentication Methods#

Nexus supports 3 authentication methods for Amazon Bedrock:

IAM (Recommended for AWS environments)#

• Automatically authorizes Nexus through an IAM Role attached to the environment

• Use when running on AWS infrastructure (EC2, EKS)

To connect Nexus to Bedrock using IAM, create an IAM Role with the AmazonBedrockLimitedAccess policy. Optionally, you can attach the AmazonBedrockFullAccess and AmazonBedrockMarketplaceAccess policies.

Once created, attach the IAM Role to the environment that Nexus is running in. For example, attach the IAM Role to your Nexus EC2 instance or EKS service account.

Access Key (for non-AWS environments)#

• Manual credential management using an Access Key ID and Secret Access Key

• Recommended for accessing Bedrock from non-AWS environments

To connect Nexus to Bedrock using Access Keys, create an IAM User with the AmazonBedrockLimitedAccess policy. Optionally, you can attach the AmazonBedrockFullAccess and AmazonBedrockMarketplaceAccess policies.

Once created, go to your IAM User's Security Credentials tab. Create a new Access Key and copy the Access Key ID and Secret Access Key.

Provide these credentials to Nexus using one of the following methods:

• Add them to your Nexus .env file as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

• Add them to your AWS CLI config in ~/.aws/credentials

• Enter them directly in the Nexus Bedrock configuration UI

Bedrock API Key (for non-AWS environments)#

• New method to access Bedrock generated from the AWS Bedrock Console

• Recommended for accessing Bedrock from non-AWS environments

To connect Nexus to Bedrock using an API Key, navigate to the Bedrock console, select API keys and create a Long-term API key. AWS will automatically create a new IAM User with the AmazonBedrockLimitedAccess policy.

Submit your API key to Nexus through the Nexus Bedrock configuration UI.

When using an IAM role, the role credentials must be attached to the Nexus environment. When using Access Keys or a Bedrock API Key, you must provide the credentials in the Nexus LLM configuration UI.

Guide#

Set up your Authentication Method#

Determine if IAM, Access Keys, or a Bedrock API Key is the best authentication method for your environment.

Click the above accordions to learn more about each method and how to set them up.

Enable Desired Models#

Navigate to the Model Catalog and decide the models you want to use with Nexus.

If you don't already have access to your desired models, you can request access through the Bedrock Console.

If your models are not enabled, you will not be able to see them in Nexus! Ensure your models are available before continuing.

Navigate to Language Models#

Access the Admin Panel from your user profile icon, then navigate to Configuration → Language Models.

Configure Bedrock Provider#

Select AWS Bedrock from the available providers.

Give your provider a Display Name.

Determine your AWS region and enter it in AWS Region Name.

Certain models are only available in specific regions or through cross-region inference profiles. Nexus will automatically determine what is available in your region.

Depending on your authentication method, fill out AWS Access Key ID and AWS Secret Access Key or AWS Bedrock API Key.

Once your region and credentials are set, click the Fetch Available Model for Region button.

If you do not click the Fetch Available Model for Region button, you will see all Bedrock models listed even if you cannot use them.

Choose Visible Models#

In the Advanced Options, you will see a list of all models available from this provider. You may choose which models are visible to your users in Nexus.

Setting visible models is useful when a provider publishes multiple models and versions of the same model.

Designate Provider Access#

Lastly, decide whether the provider should be public to all users in Nexus.

If set to private, the provider's models will be available to Admins and User Groups you explicitly assign the provider to.