Skip to content

Commit 1a76159

Browse files
committed
docs(bedrock): cover inference-profile IAM scope and role session lifetime
1 parent 626cdac commit 1a76159

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

  • apps/docs/content/docs/workflows/blocks

‎apps/docs/content/docs/workflows/blocks/agent.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ The model that runs the step. Defaults to `claude-sonnet-5-5`. Type or pick any
3636

3737
For a custom cloud deployment, enter its provider prefix and model ID: `azure/my-deployment`, `azure-anthropic/my-deployment`, `bedrock/my-inference-profile`, or `vertex/my-gemini-model`. The prefix selects the provider and shows its credential fields even when the ID is absent from the catalog. Bedrock accepts full inference profile ARNs after `bedrock/`; Vertex uses the Gemini API and accepts Google model resource names. The deployment must support the selected provider's API. Custom IDs have no catalog pricing or token limits.
3838

39-
For an AWS Bedrock model, set **AWS Authentication** to **Access keys** to type a key pair into the block, or to **Saved AWS credential** to sign with a workspace [AWS credential](/integrations/aws-credentials) (access keys, an assumed IAM role, or a keyless role). A saved credential is used on its own: if it cannot be used, the run fails rather than signing with other keys. Its identity needs `bedrock:InvokeModel`, plus `bedrock:InvokeModelWithResponseStream` for streamed runs, on the model or inference profile in the block's **AWS Region**. The Router and Evaluator blocks offer the same choice.
39+
For an AWS Bedrock model, set **AWS Authentication** to **Access keys** to type a key pair into the block, or to **Saved AWS credential** to sign with a workspace [AWS credential](/integrations/aws-credentials) (access keys, an assumed IAM role, or a keyless role). A saved credential is used on its own: if it cannot be used, the run fails rather than signing with other keys. Its identity needs `bedrock:InvokeModel`, plus `bedrock:InvokeModelWithResponseStream` for streamed runs. Sim calls catalog Claude models through a geographic inference profile (`us.`, `eu.`, or `au.`, picked from the block's **AWS Region**), so a policy scoped to specific resources must allow the inference profile and the foundation model in every Region that profile routes to, as AWS's [inference profile prerequisites](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-prereq.html) describe. An assumed or keyless role's session starts when the block runs and is not renewed during the run, so one run must finish within the credential's session duration. The Router and Evaluator blocks offer the same choice.
4040

4141
Ollama Cloud, OpenRouter, Fireworks, Together AI, Baseten, Ollama, vLLM, and LiteLLM load their available models from the configured provider. New models appear through that discovery without a Sim catalog release. You can also enter a namespaced ID directly, such as `ollama-cloud/deepseek-v4.1-flash`, `openrouter/provider/model`, or `ollama/my-local-model`. Provider prefixes are case-insensitive; the model ID after the prefix keeps its original casing.
4242

0 commit comments

Comments
 (0)