AWS Bedrock

Resource type

The shape of the credential every script on this page expects.

Field	Type	Required	What it is
region	string	Yes	AWS Bedrock region (e.g., us-east-1)
apiKey	string	No	AWS bedrock API key (simplest, no need for awsAccessKeyId and awsSecretAccessKey)
awsAccessKeyId	string	No	AWS IAM access key ID (alternative to apiKey)
awsSecretAccessKey	string	No	AWS IAM secret access key (alternative to apiKey)
awsSessionToken	string	No	AWS IAM session token (alternative to apiKey). You will need to refresh this token periodically.
oidcRoleArn	string	No	ARN of an AWS IAM role Windmill assumes through its OIDC provider (alternative to apiKey and to IAM keys). Used only when neither apiKey nor the IAM key pair is set, and requires a region. Requires an enterprise license, and a role whose trust policy accepts your Windmill instance as an OIDC provider with audience sts.amazonaws.com. The token subject differs by caller: <email>::<workspace> from the AI chat, <email>::<path>::<flow_path>::<workspace> from an AI agent step, so a trust policy that conditions on sub must admit both.