Internal documentation — not for public distribution
Protocol Health Club © 2026

AWS Bedrock

Claude AI via AWS Bedrock — auth, models, and invocation patterns.

PropertyValue
Auth typeBedrock API Key (Bearer token — not IAM)
Regionus-east-1
Endpointhttps://bedrock-runtime.us-east-1.amazonaws.com
Env varAWS_BEARER_TOKEN_BEDROCK

Models

ModelIDPipeline useLatency
Claude Haiku 4.5us.anthropic.claude-haiku-4-5-20251001-v1:0Fast tasks, OCR~1s
Claude Sonnet 4.6us.anthropic.claude-sonnet-4-6Biomarker extraction~2s
Claude Opus 4.7us.anthropic.claude-opus-4-7Clinical analysis~1–3s

Auth Note — Bedrock API Keys vs IAM

Bedrock API keys are a newer AWS feature — they are not IAM credentials. The key is used as a Bearer token:

Authorization: Bearer <AWS_BEARER_TOKEN_BEDROCK>

The key ID (BedrockAPIKey-gru7-at-302524629360) is a label — only the secret/token is used in requests. Keys can be set to expire in 1 day to no expiration. Confirm with admin that the key is set to "no expiration".

Textract cannot use this token. Textract requires standard IAM credentials. We use Claude vision for OCR instead.

Invocation Pattern (Converse API)

url = f"https://bedrock-runtime.us-east-1.amazonaws.com/model/{model_id}/converse"

response = requests.post(url,
    headers={
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json",
    },
    json={
        "system": [{"text": system_prompt}],
        "messages": [{"role": "user", "content": [{"text": user_prompt}]}],
        "inferenceConfig": {"maxTokens": 4096},
    }
)

result = response.json()
text   = result["output"]["message"]["content"][0]["text"]
tokens = result["usage"]  # inputTokens, outputTokens