Skip to main content
Bring Your Own Key (BYOK) lets workspaces on Scale and above plans run LLM inference through their own AWS Bedrock credentials instead of platform credits. Usage bills to your AWS account, and you choose which regions serve inference.

​
Why BYOK

  • Unlimited usage — your own Bedrock quotas apply, not platform credit limits.
  • Cost control — charges land on your AWS bill, where you already have budgets and cost allocation tags.
  • Data residency — route inference through US-only, EU-only, or APAC-only inference profiles.
  • Compliance — you control where inference happens and who can audit it.
  • No model management — CloudThinker selects Claude Sonnet 4.5 or Opus 4.5 automatically per task.

​
Prerequisites

  • Scale, Scale +, or Enterprise plan — see Pricing & Plans
  • AWS account with Amazon Bedrock access enabled
  • IAM credentials (access key ID and secret access key) with Bedrock invoke permissions
  • Model access for both Claude Sonnet 4.5 and Claude Opus 4.5 in your AWS account
CloudThinker authenticates with AWS IAM credentials: an access key ID, a secret access key, and an optional session token for temporary credentials. Direct Bedrock API keys are planned but not yet supported.
Long-term credentials (AKIA prefix) support automatic session token refresh. Temporary credentials (ASIA prefix) cannot be refreshed — reconfigure when they expire.

​
Request Claude model access

Claude models require a one-time use case form in the Bedrock console before you can invoke them. See the AWS Bedrock model access documentation for details.
1

Open Model access in the Bedrock console

Log in to the AWS Console, open Amazon Bedrock, and click Model access in the left navigation.
2

Modify model access

Click Modify model access and enable both:
  • Claude Sonnet 4.5 (anthropic.claude-sonnet-4-5-20250929-v1:0)
  • Claude Opus 4.5 (anthropic.claude-opus-4-5-20251101-v1:0)
3

Submit use case details

Complete the form with your use case description, expected usage patterns, and compliance requirements if applicable.Success state: the Model access page shows both models as access granted — typically immediately after submission.
Request access to both Sonnet 4.5 and Opus 4.5. CloudThinker switches between them based on task requirements.

​
Create IAM credentials

Your IAM user needs permission to invoke both models. Create one with the AWS CLI, or via the AWS Console.
1

Create the IAM user

2

Create the policy file

3

Attach the policy

4

Create access keys

Save the AccessKeyId and SecretAccessKey from the output — you’ll enter these in CloudThinker.
5

Verify the credentials

Success state: get-caller-identity returns the bedrock-byok-user ARN.
These commands require an AWS profile with IAM administrative permissions (iam:CreateUser, iam:PutUserPolicy, iam:CreateAccessKey).

​
Connect Bedrock in CloudThinker

1

Open BYOK settings

Go to Settings → BYOK Settings and choose AWS Bedrock as the provider.
2

Enter credentials

Provide your Access Key ID (AKIA or ASIA prefix), Secret Access Key, and — only for temporary credentials — a Session Token.
3

Select an inference profile

Pick Global, US, EU, or APAC depending on your data residency needs.
4

Test and save

Click Test Connection to confirm the credentials are valid and both models are reachable, then click Save.Success state: the test passes for both Sonnet 4.5 and Opus 4.5.
Credentials are encrypted at rest and never exposed in API responses or logs.

​
Inference profiles

Bedrock inference profiles control which AWS regions can serve your requests. For region coverage, see the AWS inference profile documentation.

​
How it works

  • Model selection — CloudThinker picks the appropriate Claude model per task; you never select models manually. See the supported foundation models list.
  • Workspace inheritance — the workspace owner configures BYOK once; every member inherits it. All member LLM usage routes through the owner’s AWS account, and the owner manages the credentials centrally.

​
Fallback behavior

CloudThinker can retry a failed BYOK call on platform-managed Bedrock credentials, but this is opt-in per workspace and disabled by default for Enterprise and BYOC plans. With fallback off, a failed call surfaces the error — no request leaves your credential boundary.

​
When fallback triggers (if enabled)

A BYOK call falls back to the platform path only when all three are true:
  1. The error is retryable — credential expiration, throttling, transient 5xx — not a content or policy violation.
  2. The operation is marked fallback-eligible (most read operations; never autonomous write actions in production).
  3. The workspace’s fallback policy is Allow.
A fallback re-sends the request to the platform-managed Bedrock account in the same region as the original call — never a different jurisdiction. Every fallback emits an audit event (original error code, serving endpoint, user, workspace, model, token count) in Admin Settings → Audit log, exportable to your SIEM via webhooks.

​
Set the fallback policy

1

Open the fallback policy

Go to Admin Settings → BYOK → Fallback policy.
2

Choose a policy

3

Lock it at the org level (optional)

Toggle Enforce across all workspaces so workspace admins can’t change the policy locally. Only org owners with the byok:admin permission can flip this toggle.
Strict mode trade-off: if BYOK credentials are misconfigured or revoked, agent operations fail until you fix them. Plan for credential rotation and quota management, and set up notifications on BYOK health.

​
What inference calls send

Regardless of policy, each BYOK call sends the agent’s system prompt and tool definitions, the relevant conversation history, and any retrieved context (topology, memory, runbooks). It never sends raw cloud credentials, other workspaces’ data, or — when tokenization is configured in Admin Settings → Data Protection — customer PII.

​
Troubleshooting

  • Verify you submitted the use case form in the Bedrock console
  • Check that both Sonnet 4.5 and Opus 4.5 are enabled on the Model access page
  • Wait a few minutes after submission for access to propagate
  • Verify the policy includes bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream
  • Check the model and inference-profile ARNs match the models and profile you use
  • Test the permissions directly in the AWS Console
  • Verify the access key ID and secret access key are correct and not rotated or revoked
  • For temporary credentials, confirm the session token hasn’t expired
  • Test with aws sts get-caller-identity
  • Verify both Sonnet 4.5 and Opus 4.5 are accessible and covered by your IAM policy
  • Ensure Bedrock is enabled in your AWS account
  • Check the region selection matches your model access
  • Verify the workspace owner has configured BYOK and it’s enabled in settings
  • Confirm the owner’s plan is Scale, Scale +, or Enterprise
  • Check the owner’s credentials are still valid
  • Long-term credentials (AKIA) refresh automatically
  • Temporary credentials (ASIA) can’t be refreshed — reconfigure with new credentials
  • Check the session_token_expires_at timestamp in the configuration

Pricing & Plans

Which plans include BYOK and what each tier covers

Usage

Track credit and LLM usage across your workspace

Notifications

Alert on BYOK credential health before it blocks work

Webhooks

Export audit events to your SIEM