@@ -6,7 +6,7 @@ description: Save an AWS identity once and use it across every AWS block, with a
 import { Callout } from '@/components/ui/callout'
 import { Step, Steps } from '@/components/ui/steps'
 
-An AWS credential holds one AWS identity for the whole workspace. Every AWS block (S3, DynamoDB, Lambda, SQS, Athena, CloudWatch, and the rest) signs in with a saved credential, so keys live in one place instead of in each block.
+An AWS credential holds one AWS identity for the whole workspace. Every AWS block (S3, DynamoDB, Lambda, SQS, Athena, CloudWatch, and the rest) signs in with a saved credential, so keys live in one place instead of in each block. The Agent, Router, and Evaluator blocks can also run AWS Bedrock models with a saved credential: choose **Saved AWS credential** under **AWS Authentication**.
 
 <Callout type="info">
 Blocks added before saved credentials, which take access keys typed into the block, are marked legacy and keep working exactly as they are. Upgrade one by replacing it with the current block and selecting a credential.
 
@@ -36,6 +36,8 @@ The model that runs the step. Defaults to `claude-sonnet-5-5`. Type or pick any
 
 For a custom cloud deployment, enter its provider prefix and model ID: `azure/my-deployment`, `azure-anthropic/my-deployment`, `bedrock/my-inference-profile`, or `vertex/my-gemini-model`. The prefix selects the provider and shows its credential fields even when the ID is absent from the catalog. Bedrock accepts full inference profile ARNs after `bedrock/`; Vertex uses the Gemini API and accepts Google model resource names. The deployment must support the selected provider's API. Custom IDs have no catalog pricing or token limits.
 
+For an AWS Bedrock model, set **AWS Authentication** to **Access keys** to type a key pair into the block, or to **Saved AWS credential** to sign with a workspace [AWS credential](/integrations/aws-credentials) (access keys, an assumed IAM role, or a keyless role). A saved credential is used on its own: if it cannot be used, the run fails rather than signing with other keys. Its identity needs `bedrock:InvokeModel`, plus `bedrock:InvokeModelWithResponseStream` for streamed runs. Sim calls catalog Claude models through a geographic inference profile (`us.`, `eu.`, or `au.`, picked from the block's **AWS Region**), so a policy scoped to specific resources must allow the inference profile and the foundation model in every Region that profile routes to, as AWS's [inference profile prerequisites](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-prereq.html) describe. An assumed or keyless role's session starts when the block runs and is not renewed during the run, so one run must finish within the credential's session duration. The Router and Evaluator blocks offer the same choice.
+
 Ollama Cloud, OpenRouter, Fireworks, Together AI, Baseten, Ollama, vLLM, and LiteLLM load their available models from the configured provider. New models appear through that discovery without a Sim catalog release. You can also enter a namespaced ID directly, such as `ollama-cloud/deepseek-v4.1-flash`, `openrouter/provider/model`, or `ollama/my-local-model`. Provider prefixes are case-insensitive; the model ID after the prefix keeps its original casing.
 
 #### Nebius Token Factory
 
@@ -4,6 +4,7 @@ import { getModelFallbackSubBlock, MODEL_FALLBACK_INPUTS } from '@/blocks/model-
 import type { BlockConfig } from '@/blocks/types'
 import { AuthMode, IntegrationType } from '@/blocks/types'
 import {
+  BEDROCK_SAVED_CREDENTIAL_INPUTS,
   getAgentModelOptions,
   getModelCapabilityCondition,
   getProviderCredentialSubBlocks,
@@ -136,7 +137,7 @@ Return ONLY the JSON array.`,
       options: getAgentModelOptions,
       commandSearchable: true,
     },
-    ...getProviderCredentialSubBlocks(),
+    ...getProviderCredentialSubBlocks({ bedrockSavedCredential: true }),
     {
       id: 'evaluationState',
       title: 'State',
@@ -559,6 +560,7 @@ Return ONLY the JSON array.`,
     bedrockAccessKeyId: { type: 'string', description: 'AWS Access Key ID for Bedrock' },
     bedrockSecretKey: { type: 'string', description: 'AWS Secret Access Key for Bedrock' },
     bedrockRegion: { type: 'string', description: 'AWS region for Bedrock' },
+    ...BEDROCK_SAVED_CREDENTIAL_INPUTS,
     responseFormat: {
       type: 'json',
       description: 'JSON response format schema',
 
@@ -3,6 +3,7 @@ import { ChartBarIcon } from '@/components/icons'
 import { getModelFallbackSubBlock, MODEL_FALLBACK_INPUTS } from '@/blocks/model-fallbacks'
 import type { BlockConfig, ParamType } from '@/blocks/types'
 import {
+  BEDROCK_SAVED_CREDENTIAL_INPUTS,
   getModelOptions,
   getProviderCredentialSubBlocks,
   getSerializedModelProviderId,
@@ -170,7 +171,7 @@ export const EvaluatorBlock: BlockConfig = {
       defaultValue: 'claude-sonnet-5-5',
       options: getModelOptions,
     },
-    ...getProviderCredentialSubBlocks(),
+    ...getProviderCredentialSubBlocks({ bedrockSavedCredential: true }),
     getModelFallbackSubBlock(),
     {
       id: 'temperature',
@@ -277,6 +278,7 @@ export const EvaluatorBlock: BlockConfig = {
     },
     model: { type: 'string' as ParamType, description: 'AI model to use' },
     ...PROVIDER_CREDENTIAL_INPUTS,
+    ...BEDROCK_SAVED_CREDENTIAL_INPUTS,
     ...MODEL_FALLBACK_INPUTS,
     temperature: {
       type: 'number' as ParamType,
 
@@ -2,6 +2,7 @@ import { ConnectIcon } from '@/components/icons'
 import { getModelFallbackSubBlock, MODEL_FALLBACK_INPUTS } from '@/blocks/model-fallbacks'
 import { AuthMode, type BlockConfig } from '@/blocks/types'
 import {
+  BEDROCK_SAVED_CREDENTIAL_INPUTS,
   getModelOptions,
   getProviderCredentialSubBlocks,
   getSerializedModelProviderId,
@@ -163,7 +164,7 @@ export const RouterBlock: BlockConfig = {
       defaultValue: 'claude-sonnet-5-5',
       options: getModelOptions,
     },
-    ...getProviderCredentialSubBlocks(),
+    ...getProviderCredentialSubBlocks({ bedrockSavedCredential: true }),
     getModelFallbackSubBlock(),
     {
       id: 'temperature',
@@ -200,6 +201,7 @@ export const RouterBlock: BlockConfig = {
     prompt: { type: 'string', description: 'Routing prompt content' },
     model: { type: 'string', description: 'AI model to use' },
     ...PROVIDER_CREDENTIAL_INPUTS,
+    ...BEDROCK_SAVED_CREDENTIAL_INPUTS,
     ...MODEL_FALLBACK_INPUTS,
     temperature: {
       type: 'number',
@@ -254,7 +256,7 @@ export const RouterV2Block: BlockConfig = {
       defaultValue: 'claude-sonnet-5-5',
       options: getModelOptions,
     },
-    ...getProviderCredentialSubBlocks(),
+    ...getProviderCredentialSubBlocks({ bedrockSavedCredential: true }),
     getModelFallbackSubBlock(),
   ],
   tools: {
@@ -275,6 +277,7 @@ export const RouterV2Block: BlockConfig = {
     routes: { type: 'json', description: 'Route definitions with descriptions' },
     model: { type: 'string', description: 'AI model to use' },
     ...PROVIDER_CREDENTIAL_INPUTS,
+    ...BEDROCK_SAVED_CREDENTIAL_INPUTS,
     ...MODEL_FALLBACK_INPUTS,
   },
   outputs: {
 
@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest'
+import { TranslateBlock } from '@/blocks/blocks/translate'
+
+const toolParams = (params: Record<string, unknown>) => {
+  const build = TranslateBlock.tools.config?.params
+  if (!build) throw new Error('TranslateBlock.tools.config.params is missing')
+  return build({ context: 'Hello', targetLanguage: 'French', ...params })
+}
+
+describe('Translate Bedrock credential', () => {
+  it('sends the saved AWS credential with a Bedrock model call', () => {
+    expect(
+      toolParams({
+        model: 'bedrock/my-inference-profile',
+        bedrockAuthMode: 'credential',
+        bedrockCredential: 'aws-cred',
+      })
+    ).toMatchObject({ model: 'bedrock/my-inference-profile', bedrockCredential: 'aws-cred' })
+  })
+
+  it('refuses a Bedrock model call set to a saved AWS credential with none selected', () => {
+    expect(() =>
+      toolParams({
+        model: 'bedrock/my-inference-profile',
+        bedrockAuthMode: 'credential',
+        bedrockCredential: '',
+      })
+    ).toThrow('Select an AWS credential for Bedrock')
+  })
+
+  it('ignores a leftover Bedrock credential choice once the model is not on Bedrock', () => {
+    const params = toolParams({ model: 'gpt-4o', bedrockAuthMode: 'credential' })
+
+    expect(params).toMatchObject({ model: 'gpt-4o' })
+    expect(params.bedrockCredential).toBeUndefined()
+  })
+})
@@ -1,10 +1,13 @@
 import { TranslateIcon } from '@/components/icons'
 import { AuthMode, type BlockConfig, IntegrationType } from '@/blocks/types'
 import {
+  BEDROCK_SAVED_CREDENTIAL_INPUTS,
   getModelOptions,
   getProviderCredentialSubBlocks,
+  getSelectedBedrockCredential,
   PROVIDER_CREDENTIAL_INPUTS,
 } from '@/blocks/utils'
+import { findProviderFromModel } from '@/providers/models'
 
 const getTranslationPrompt = (targetLanguage: string) =>
   `Translate the following text into ${targetLanguage || 'English'}. Output ONLY the translated text with no additional commentary, explanations, or notes.`
@@ -52,7 +55,7 @@ export const TranslateBlock: BlockConfig = {
       required: true,
       options: getModelOptions,
     },
-    ...getProviderCredentialSubBlocks(),
+    ...getProviderCredentialSubBlocks({ bedrockSavedCredential: true }),
     {
       id: 'systemPrompt',
       title: 'System Prompt',
@@ -80,13 +83,19 @@ export const TranslateBlock: BlockConfig = {
         bedrockAccessKeyId: params.bedrockAccessKeyId,
         bedrockSecretKey: params.bedrockSecretKey,
         bedrockRegion: params.bedrockRegion,
+        bedrockCredential:
+          typeof params.model === 'string' &&
+          findProviderFromModel(params.model.trim()) === 'bedrock'
+            ? getSelectedBedrockCredential(params)
+            : undefined,
       }),
     },
   },
   inputs: {
     context: { type: 'string', description: 'Text to translate' },
     targetLanguage: { type: 'string', description: 'Target language' },
     ...PROVIDER_CREDENTIAL_INPUTS,
+    ...BEDROCK_SAVED_CREDENTIAL_INPUTS,
     systemPrompt: { type: 'string', description: 'Translation instructions' },
   },
   outputs: {
 
@@ -59,9 +59,12 @@ vi.mock('@/stores/providers/store', () => ({
 vi.mock('@/lib/oauth/utils', () => oauthUtilsMock)
 
 import { S3Icon } from '@/components/icons'
+import { evaluateSubBlockCondition } from '@/lib/workflows/subblocks/visibility'
 import type { BlockConfig } from '@/blocks/types'
 import {
   getApiKeyCondition,
+  getProviderCredentialSubBlocks,
+  getSelectedBedrockCredential,
   getSerializedModelProviderId,
   parseOptionalBooleanInput,
   parseOptionalJsonInput,
@@ -102,6 +105,96 @@ describe('requiresProviderFamilyCredentials', () => {
   })
 })
 
+describe('Bedrock credential fields', () => {
+  const BEDROCK_FIELDS = [
+    'bedrockAuthMode',
+    'bedrockCredential',
+    'bedrockManualCredential',
+    'bedrockAccessKeyId',
+    'bedrockSecretKey',
+    'bedrockRegion',
+  ]
+
+  const visibleBedrockFields = (
+    values: Record<string, unknown>,
+    subBlocks = getProviderCredentialSubBlocks({ bedrockSavedCredential: true })
+  ) =>
+    subBlocks
+      .filter((subBlock) => BEDROCK_FIELDS.includes(subBlock.id))
+      .filter((subBlock) => evaluateSubBlockCondition(subBlock.condition, values))
+      .map((subBlock) => subBlock.id)
+
+  it('keeps showing access keys, and no credential picker, on a block saved before auth modes', () => {
+    expect(visibleBedrockFields({ model: 'bedrock/my-inference-profile' })).toEqual([
+      'bedrockAuthMode',
+      'bedrockAccessKeyId',
+      'bedrockSecretKey',
+      'bedrockRegion',
+    ])
+  })
+
+  it('swaps the access keys for the AWS credential picker when a saved credential is chosen', () => {
+    expect(
+      visibleBedrockFields({ model: 'bedrock/my-inference-profile', bedrockAuthMode: 'credential' })
+    ).toEqual(['bedrockAuthMode', 'bedrockCredential', 'bedrockManualCredential', 'bedrockRegion'])
+  })
+
+  it('shows no Bedrock field for a model of another provider', () => {
+    expect(visibleBedrockFields({ model: 'gpt-4o', bedrockAuthMode: 'credential' })).toEqual([])
+  })
+
+  it('offers no saved credential, and keeps the access keys, for a block that cannot forward one', () => {
+    expect(
+      visibleBedrockFields(
+        { model: 'bedrock/my-inference-profile', bedrockAuthMode: 'credential' },
+        getProviderCredentialSubBlocks()
+      )
+    ).toEqual(['bedrockAccessKeyId', 'bedrockSecretKey', 'bedrockRegion'])
+  })
+})
+
+describe('getSelectedBedrockCredential', () => {
+  it('returns the trimmed saved credential a block signs Bedrock calls with', () => {
+    expect(
+      getSelectedBedrockCredential({ bedrockAuthMode: 'credential', bedrockCredential: ' cred-1 ' })
+    ).toBe('cred-1')
+  })
+
+  it('refuses a block set to a saved credential whose ID resolves blank', () => {
+    expect(() =>
+      getSelectedBedrockCredential({ bedrockAuthMode: 'credential', bedrockCredential: '' })
+    ).toThrow('Select an AWS credential for Bedrock')
+    expect(() => getSelectedBedrockCredential({ bedrockAuthMode: 'credential' })).toThrow(
+      'Select an AWS credential for Bedrock'
+    )
+  })
+
+  it('returns nothing for a block on access keys or saved before auth modes', () => {
+    expect(
+      getSelectedBedrockCredential({ bedrockAuthMode: 'access_keys', bedrockCredential: 'cred-1' })
+    ).toBeUndefined()
+    expect(getSelectedBedrockCredential({})).toBeUndefined()
+  })
+
+  it('signs with a credential exactly when the block shows and serializes the credential picker', () => {
+    const picker = getProviderCredentialSubBlocks({ bedrockSavedCredential: true }).find(
+      (subBlock) => subBlock.id === 'bedrockCredential'
+    )
+    const cases: Record<string, unknown>[] = [
+      { bedrockCredential: 'cred-1' },
+      { bedrockAuthMode: '', bedrockCredential: 'cred-1' },
+      { bedrockAuthMode: 'access_keys', bedrockCredential: 'cred-1' },
+      { bedrockAuthMode: 'credential', bedrockCredential: 'cred-1' },
+    ]
+    for (const values of cases) {
+      const withModel = { model: 'bedrock/my-inference-profile', ...values }
+      expect(getSelectedBedrockCredential(values) !== undefined, JSON.stringify(values)).toBe(
+        evaluateSubBlockCondition(picker?.condition, withModel)
+      )
+    }
+  })
+})
+
 describe('getApiKeyCondition / shouldRequireApiKeyForModel', () => {
   const evaluateCondition = (model: string): boolean => {
     const conditionFn = getApiKeyCondition()