Amazon Bedrock (self-hosted)

On a self-hosted install, the AI assistant can use models in your own AWS account through Amazon Bedrock: OpenAI's GPT-6 Luna, or open models such as GLM-5, DeepSeek or gpt-oss. AWS bills you directly. No OpenAI account or key is needed, and on EC2 no key is stored at all: each request is signed with the server's IAM role.

Bedrock is only offered on self-hosted installs. On devops-agent.io you can still add Bedrock as an ordinary OpenAI-compatible endpoint with a Bedrock API key.

Which model

The two addresses, for Region us-east-1:

• bedrock-runtime: https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1. GPT-5.x and GPT-6 need the inference profile ID (us.… or global.…), not the bare openai.… ID.
• bedrock-mantle: https://bedrock-mantle.us-east-1.api.aws/v1, with the plain model ID.

GPT-6 Luna runs in us-east-1, us-east-2 and us-west-2. Your panel's server can be in any Region.

Step 1: model access in AWS

• Open models (GLM, DeepSeek, gpt-oss…): nothing to do.
• OpenAI's GPT models: Bedrock console → Model catalog → the model → accept the terms (free; you pay per use). Even then, AWS sometimes keeps the model closed for an account and every call answers "… is not available for this account". If that happens, open an AWS Support case asking them to enable the model for your account and Region.
• Quotas: Service Quotas → Amazon Bedrock. Each address has its own: Cross-region model inference tokens per minute for … for bedrock-runtime, [bedrock-mantle endpoint] Input / Output tokens per minute for … for bedrock-mantle. A quota of 0 means that address can't be used.

Step 2: an IAM role on the server

1. Create a role with trusted entity EC2, attach it to the instance (Actions → Security → Modify IAM role).
2. Set the instance's metadata hop limit to 2, or the app's container can't read the role:

   aws ec2 modify-instance-metadata-options --instance-id i-0123456789abcdef0 \
     --http-tokens required --http-put-response-hop-limit 2 --http-endpoint enabled
   

3. Keep AWS_ACCESS_KEY_ID out of the panel's .env: when it's set, it wins over the role.

Not on EC2? Use a long-term Bedrock API key instead (Authentication → Bedrock API key in the form).

Step 3: the role's permissions

Replace <ACCOUNT_ID> with your AWS account ID. Add the statement for the address you use, or both.

GPT-6 Luna on bedrock-runtime:

{
  "Effect": "Allow",
  "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
  "Resource": [
    "arn:aws:bedrock:us-east-1:<ACCOUNT_ID>:inference-profile/us.openai.gpt-6-luna",
    "arn:aws:bedrock:us-east-1::foundation-model/openai.gpt-6-luna",
    "arn:aws:bedrock:us-east-2::foundation-model/openai.gpt-6-luna",
    "arn:aws:bedrock:us-west-2::foundation-model/openai.gpt-6-luna",
    "arn:aws:bedrock:us-east-1:<ACCOUNT_ID>:project/default"
  ]
}

The us. profile can run a request in any of the three US Regions, so all three model ARNs are needed. project/default is required by the Responses API.

Models on bedrock-mantle (GLM-5, gpt-oss, DeepSeek…):

{
  "Effect": "Allow",
  "Action": "bedrock-mantle:CreateInference",
  "Resource": "arn:aws:bedrock-mantle:us-east-1:<ACCOUNT_ID>:project/default"
}

On bedrock-mantle the permission covers every model there, not one: control cost with an AWS Budget.

Bedrock in another AWS account: create a role there with the statements above, let the panel's role assume it (trust policy, and sts:AssumeRole on the panel's role), and enter it as Role to assume in the form.

Step 4: network

• Outbound 443 from the server to the address you use (bedrock-runtime.<region>.amazonaws.com or bedrock-mantle.<region>.api.aws) and to sts.<region>.amazonaws.com.
• No internet access: create VPC interface endpoints for bedrock-runtime and sts with private DNS on, and keep the default address. To enter an endpoint's own DNS name, use the name, never an IP: AWS's certificate only covers its hostnames.
• AWS Organizations: a service control policy can block Bedrock or a Region whatever the role allows. Ask your AWS admin.

Step 5: add the model in the panel

As the Owner: Settings → AI model → Add model.

The form has an AWS setup guide button with these steps, filled in for the Region and model you entered.

Press Test. It shows each step:

Automatic saves the API that passed: the Responses API for GPT models (reasoning together with tools), Chat Completions for the others. Then press Test and save.

When the Test fails

Good to know

• Conversations stored by AWS: on the Responses API, Bedrock keeps each conversation for 30 days by default. Chat Completions stores nothing.
• Billing: OpenAI's GPT models are billed through AWS Marketplace, where promotional credits may not apply. Open models are billed by AWS directly.
• Switching models later: add the new model and make it the default. New chats use it; an existing chat keeps its model until you change it with the model button at the top of that chat.