verapli
Sign inJoin free
Menu

Guides · ai · Verification-gated

Amazon Bedrock - model access and API keys

In commercial Regions most Bedrock models switch on automatically the first time you call them, provided the calling identity has AWS Marketplace subscribe permissions and the account has a valid payment method. Anthropic models also need a one-time first-time-use (use case) form. Optionally generate a Bedrock API key.

Researched · not yet run liveLast researched 25 October 2026 · Amazon Web Services · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

Model access is decided per AWS account (accounts in one AWS Organization can differ). The Anthropic use-case form is filed once per account, or once at the Organization's management account and inherited by member accounts.

Have ready

  • aws/account-and-iam: An activated AWS account with a valid payment method and a non-root identity.
  • A valid payment method on the AWS account that can be used for AWS Marketplace purchases. [1]Needed for: Make the first call to the model
  • A company website for the Anthropic use-case form (individuals may give a portfolio, GitHub profile or project URL). [1]Needed for: Submit the Anthropic first-time-use form (Anthropic models only)
  • Company name, industry, whether users are internal or external, and a description of the use case (up to 8,192 characters). [1]Needed for: Submit the Anthropic first-time-use form (Anthropic models only)

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Choose a Region where the model is offered

    Check the model card for supported Regions; long-term API keys and some access settings are Region-bound.

    • Guided by hand

  2. Give the calling identity AWS Marketplace permissions

    Attach a policy allowing aws-marketplace:Subscribe, Unsubscribe and ViewSubscriptions (or AmazonBedrockFullAccess) to the role or user that will make the first call. Only needed the first time a model is used in the account.

    • Official API
    • After: Choose a Region where the model is offered

  3. Submit the Anthropic first-time-use form (Anthropic models only)optional

    Open an Anthropic model in the Model catalog (or the Anthropic provider page) and fill in the use-case form, or call PutUseCaseForModelAccess. You submit it yourself. Skip if the Organization's management account already did.

    • verapli co-pilot
    • Human step: You press submit
    • After: Give the calling identity AWS Marketplace permissions
    The provider says
    In most cases access is granted as soon as the form is submitted, but the agreement can sit in PENDING; AWS emails when it is set up. [1]
    If something goes wrong (2)
    • AccessDeniedException right after submitting the form.: Call GetFoundationModelAvailability and wait for agreementAvailability AVAILABLE (PENDING means still being set up). [1]
    • Works in one Region but not in an opt-in Region.: The form must be filled again in opt-in Regions. [1]

    Where: https://console.aws.amazon.com/bedrock/home#/providers/anthropic

  4. Make the first call to the model

    Open the model in the playground or call InvokeModel/Converse. Bedrock starts the Marketplace subscription in the background. By using a third-party model for the first time you accept its EULA.

    • Official API
    • Human step: You accept the terms
    • After: Give the calling identity AWS Marketplace permissions
    The provider says
    Subscription setup takes up to 15 minutes; after fixing missing permissions allow up to 2 minutes. [1]
    If something goes wrong (2)
    • AccessDeniedException on first call.: Check the identity has the aws-marketplace permissions, the account has a valid payment method, the Anthropic form is done (for Claude), and any IAM condition (e.g. aws:SourceIp) is satisfied by the calling host. [1]
    • All prerequisites met and the model is in the Region, but still AccessDeniedException.: Some models need extra account-level access; contact AWS Sales. [1]

  5. Generate a Bedrock API key (optional)optional

    In Bedrock > API keys, generate a short-term key (up to 12 hours, recommended) or a long-term key with an expiry (exploration only; it creates an IAM user). verapli captures it into your env file as AWS_BEARER_TOKEN_BEDROCK.

    • verapli co-pilot
    • Human step: You press submit
    • After: Make the first call to the model

    verapli captures AWS_BEARER_TOKEN_BEDROCK here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (1)
    • Error: Credential should be scoped to a valid region.: Long-term keys only work in the Region they were made in; switch Region in the console and generate one there. [2]

    Where: https://console.aws.amazon.com/bedrock/

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can cost moneyThe rules say

First call accepts the model EULA

Invoking a third-party model for the first time counts as agreeing to its End User License Agreement. To review first, block bedrock:InvokeModel with IAM/SCP and allow it after review. Plain-English summary, not legal advice. [1]

Worth knowingThe rules say

Denying aws-marketplace:Subscribe alone does not stop the first invocation; deny bedrock:InvokeModel to block a model. [1]

Can cost moneyThe rules say

Long-term Bedrock API keys are meant for exploration only; use short-term keys in production and limit key age. [2]

What you end up with

Env varSecretFormatWhat it is
AWS_BEARER_TOKEN_BEDROCKsecretopaque bearer tokenBedrock API key sent as a bearer token.
BEDROCK_MODEL_IDnot secretus.anthropic.claude-…Model or inference profile id to call.

For agents

The same entry as JSON: /api/v1/entries/aws/bedrock-model-access · requirements /api/v1/requirements/aws/bedrock-model-access · terms /api/v1/terms/aws/bedrock-model-access.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Amazon Bedrock - model access and API keys, and how long will it take?"
  → tools/call requirements { "provider_id": "aws/bedrock-model-access" }

Sources

  1. Request access to models - Amazon Bedrock User Guide Access enabled by default on first invocation in commercial Regions; Model access page only for GovCloud; prerequisites (aws-marketplace:Subscribe/Unsubscribe/ViewSubscriptions, Anthropic First Time Use form, valid payment method); setup up to 15 minutes, up to 2 minutes after fixing permissions; FTU needs a use-case description and website URL (portfolio/GitHub acceptable for individuals); FTU once per account or org management account, again in opt-in Regions; agreement can be PENDING with AccessDeniedException until AVAILABLE, email sent when done; GetFoundationModelAvailability; invoking a 3P model accepts its EULA; some models need extra access via AWS Sales; deny bedrock:InvokeModel to block access. · accessed 25 October 2026 · official
  2. API keys - Amazon Bedrock User Guide Short-term keys (up to 12 hours, recommended for production) and long-term keys (creates an IAM user, exploration only, Region-bound); AWS_BEARER_TOKEN_BEDROCK; deactivate/reset/delete compromised keys; limit key age with iam:ServiceSpecificCredentialAgeDays. · accessed 25 October 2026 · official
  3. Amazon Bedrock Serverless Third-Party Model License Agreements Third-party model EULAs that apply on first use (linked from the model access page; not read in full). · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. Amazon Web Services is not affiliated with verapli.