|
1 | 1 | --- |
2 | 2 | title: "AWS Bedrock" |
3 | 3 | sidebarTitle: "API Key" |
4 | | -description: "Set up AWS Bedrock with CodinIT using Bedrock API Keys. Simplest setup for individual developers to access frontier models." |
| 4 | +description: "Set up AWS Bedrock with CodinIT using API Keys to access frontier models like Claude and Amazon Nova." |
5 | 5 | --- |
6 | 6 |
|
7 | | -### Overview |
| 7 | +Access leading AI models through AWS Bedrock with simplified API Key setup. |
8 | 8 |
|
9 | | -- **AWS Bedrock:** A fully managed service that offers access to leading generative AI models (e.g., Anthropic Claude, Amazon Nova) through AWS.\ |
10 | | - [Learn more about AWS Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/what-is-bedrock.html). |
11 | | -- **CodinIT:** A VS Code extension that acts as a coding assistant by integrating with AI models—empowering developers to generate code, debug, and analyze data. |
12 | | -- **Developer Focus:** This guide is tailored for individual developers that want to enable access to frontier models via AWS Bedrock with a simplified setup using API Keys. |
| 9 | +**Website:** [https://docs.aws.amazon.com/bedrock/](https://docs.aws.amazon.com/bedrock/latest/userguide/what-is-bedrock.html) |
13 | 10 |
|
14 | | ---- |
15 | | - |
16 | | -### Step 1: Prepare Your AWS Environment |
17 | | - |
18 | | -#### 1.1 Individual user setup - Create a Bedrock API Key |
| 11 | +## Setup Steps |
19 | 12 |
|
20 | | -For more detailed instructions check the [documentation](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html). |
| 13 | +### 1. Create Bedrock API Key |
21 | 14 |
|
22 | | -1. **Sign in to the AWS Management Console:**\ |
23 | | - [AWS Console](https://aws.amazon.com/console) |
24 | | -2. **Access Bedrock Console:** |
25 | | - - [Bedrock Console](https://console.aws.amazon.com/bedrock) |
26 | | - - Create a new Long Lived API Key. This API Key will have by default the `AmazonBedrockLimitedAccess` IAM policy |
27 | | - [View AmazonBedrockLimitedAccess Policy Details](https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html#managed-policies) |
| 15 | +1. **Sign in:** [AWS Console](https://aws.amazon.com/console) |
| 16 | +2. **Access Bedrock:** Go to [Bedrock Console](https://console.aws.amazon.com/bedrock) |
| 17 | +3. **Create API Key:** Create a new Long Lived API Key |
| 18 | + - Default policy: `AmazonBedrockLimitedAccess` |
| 19 | + - [View policy details](https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html#managed-policies) |
28 | 20 |
|
29 | | -#### 1.2 Create or Modify the Policy |
| 21 | +### 2. Configure IAM Permissions |
30 | 22 |
|
31 | | -To ensure CodinIT can interact with AWS Bedrock, your IAM user or role needs specific permissions. While the `AmazonBedrockLimitedAccess` managed policy provides comprehensive access, for a more restricted and secure setup adhering to the principle of least privilege, the following minimal permissions are sufficient for CodinIT's core model invocation functionality: |
| 23 | +**Minimal permissions required:** |
| 24 | +```json |
| 25 | +{ |
| 26 | + "Version": "2012-10-17", |
| 27 | + "Statement": [{ |
| 28 | + "Effect": "Allow", |
| 29 | + "Action": [ |
| 30 | + "bedrock:InvokeModel", |
| 31 | + "bedrock:InvokeModelWithResponseStream", |
| 32 | + "bedrock:CallWithBearerToken" |
| 33 | + ], |
| 34 | + "Resource": "*" |
| 35 | + }] |
| 36 | +} |
| 37 | +``` |
32 | 38 |
|
33 | | -- `bedrock:InvokeModel` |
34 | | -- `bedrock:InvokeModelWithResponseStream` |
35 | | -- `bedrock:CallWithBearerToken` |
| 39 | +Create custom policy and attach to IAM user associated with your API key. |
36 | 40 |
|
37 | | -You can create a custom IAM policy with these permissions and attach it to your IAM user or role. |
| 41 | +**Important:** |
| 42 | +- For model listing in CodinIT, add `bedrock:ListFoundationModels` permission |
| 43 | +- For AWS Marketplace models (e.g., Anthropic Claude), use `AmazonBedrockLimitedAccess` policy |
| 44 | +- For Anthropic models, submit First Time Use (FTU) form via [Playground](https://console.aws.amazon.com/bedrock/home#/text-generation-playground) |
38 | 45 |
|
39 | | -1. In the AWS IAM console, create a new policy. |
40 | | -2. Use the JSON editor to add the following policy document: |
41 | | - ```json |
42 | | - { |
43 | | - "Version": "2012-10-17", |
44 | | - "Statement": [ |
45 | | - { |
46 | | - "Effect": "Allow", |
47 | | - "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:CallWithBearerToken"], |
48 | | - "Resource": "*" // For enhanced security, scope this to specific model ARNs if possible. |
49 | | - } |
50 | | - ] |
51 | | - } |
52 | | - ``` |
53 | | -3. Name the policy (e.g., `CodinITBedrockInvokeAccess`) and attach it to the IAM user associated with the key you created. The IAM user and the API key have the same prefix. |
| 46 | +### 3. Choose Region |
54 | 47 |
|
55 | | -**Important Considerations:** |
56 | | - |
57 | | -- **Model Listing in CodinIT:** The minimal permissions (`bedrock:InvokeModel`, `bedrock:InvokeModelWithResponseStream`) are sufficient for CodinIT to _use_ a model if you specify the model ID directly in CodinIT's settings. If you rely on CodinIT to dynamically list available Bedrock models, you might need additional permissions like `bedrock:ListFoundationModels`. |
58 | | -- **AWS Marketplace Subscriptions:** For third-party models (e.g., Anthropic Claude), the **`AmazonBedrockLimitedAccess`** policy grants you the necessary permissions to subscribe via the AWS Marketplace. There is no explicit access to be enabled. For Anthropic models you are still required to submit a First Time Use (FTU) form via the Console. If you get the following message in the CodinIT chat `[ERROR] Failed to process response: Model use case details have not been submitted for this account. Fill out the Anthropic use case details form before using the model.` then open the [Playground in the AWS Bedrock Console](https://console.aws.amazon.com/bedrock/home?#/text-generation-playground), select any Anthropic model and fill in the form (you might need to send a prompt first) |
59 | | - |
60 | | ---- |
61 | | - |
62 | | -### Step 2: Verify Regional and Model Access |
63 | | - |
64 | | -#### 2.1 Choose and Confirm a Region |
65 | | - |
66 | | -1. **Select a Region:**\ |
67 | | - AWS Bedrock is available in multiple regions (e.g., US East, Europe, Asia Pacific). Choose the region that meets your latency and compliance needs.\ |
68 | | - [AWS Global Infrastructure](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/) |
69 | | -2. **Verify Model Access:** |
70 | | - - **Note:** Some models are only accessible via an [Inference Profile](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-support.html). In such case check the box "Cross Region Inference". |
71 | | - |
72 | | ---- |
| 48 | +Select region for latency/compliance needs: |
| 49 | +- `us-east-1` (N. Virginia) |
| 50 | +- `us-west-2` (Oregon) |
| 51 | +- `eu-west-1` (Ireland) |
| 52 | +- `ap-southeast-1` (Singapore) |
73 | 53 |
|
74 | | -### Step 3: Configure the CodinIT VS Code Extension |
| 54 | +**Note:** Some models require [Inference Profile](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-support.html) - check "Cross Region Inference" box if needed. |
75 | 55 |
|
76 | | -#### 3.1 Install and Open CodinIT |
| 56 | +### 4. Configure CodinIT |
77 | 57 |
|
78 | | -1. **Install VS Code:**\ |
79 | | - Download from the [VS Code website](https://code.visualstudio.com). |
80 | | -2. **Install the CodinIT Extension:** |
81 | | - - Open VS Code. |
82 | | - - Go to the Extensions Marketplace (`Ctrl+Shift+X` or `Cmd+Shift+X`). |
83 | | - - Search for **CodinIT** and install it. |
| 58 | +1. Install CodinIT extension in VS Code |
| 59 | +2. Click settings icon (⚙️) |
| 60 | +3. Select **AWS Bedrock** as API Provider |
| 61 | +4. Enter your **API Key** |
| 62 | +5. Specify **AWS Region** (e.g., `us-east-1`) |
| 63 | +6. Select **Model** (e.g., `anthropic.claude-3-5-sonnet-20241022-v2:0`) |
| 64 | +7. Save and test |
84 | 65 |
|
85 | | -#### 3.2 Configure CodinIT Settings |
| 66 | +## Security Best Practices |
86 | 67 |
|
87 | | -1. **Open CodinIT Settings:** |
88 | | - - Click on the settings ⚙️ to select your API Provider. |
89 | | -2. **Select AWS Bedrock as the API Provider:** |
90 | | - - From the API Provider dropdown, choose **AWS Bedrock**. |
91 | | -3. **Enter Your AWS API Key:** |
92 | | - - Input your **API Key** |
93 | | - - Specify the correct **AWS Region** (e.g., `us-east-1` or your enterprise-approved region). |
94 | | -4. **Select a Model:** |
95 | | - - Choose an on-demand model (e.g., **anthropic.claude-3-5-sonnet-20241022-v2:0**). |
96 | | -5. **Save and Test:** |
97 | | - - Click **Done/Save** to apply your settings. |
98 | | - - Test the integration by sending a simple prompt (e.g., "Generate a Python function to check if a number is prime."). |
| 68 | +1. **Secure access:** Prefer AWS SSO/federated roles over long-lived API keys when possible |
| 69 | +2. **Network security:** Consider [AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-services-overview.html) |
| 70 | +3. **Monitoring:** Enable CloudTrail for API logging and CloudWatch for metrics |
| 71 | +4. **Cost management:** Use AWS Cost Explorer and set billing alerts |
| 72 | +5. **Regular audits:** Review IAM roles and CloudTrail logs periodically |
99 | 73 |
|
100 | | ---- |
101 | | - |
102 | | -### Step 4: Security, Monitoring, and Best Practices |
103 | | - |
104 | | -1. **Secure Access:** |
105 | | - - Prefer AWS SSO/federated roles over long-lived API Key when possible. |
106 | | - - [AWS IAM Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) |
107 | | -2. **Enhance Network Security:** |
108 | | - - Consider setting up [AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-services-overview.html) to securely connect to Bedrock. |
109 | | -3. **Monitor and Log Activity:** |
110 | | - - Enable AWS CloudTrail to log Bedrock API calls. |
111 | | - - Use CloudWatch to monitor metrics like invocation count, latency, and token usage. |
112 | | - - Set up alerts for abnormal activity. |
113 | | -4. **Handle Errors and Manage Costs:** |
114 | | - - Implement exponential backoff for throttling errors. |
115 | | - - Use AWS Cost Explorer and set billing alerts to track usage.\ |
116 | | - [AWS Cost Management](https://docs.aws.amazon.com/cost-management/latest/userguide/what-is-aws-cost-management.html) |
117 | | -5. **Regular Audits and Compliance:** |
118 | | - - Periodically review IAM roles and CloudTrail logs. |
119 | | - - Follow internal data privacy and governance policies. |
120 | | - |
121 | | ---- |
122 | | - |
123 | | -### Conclusion |
124 | | - |
125 | | -By following these steps, you can quickly integrate AWS Bedrock with the CodinIT VS Code extension to accelerate development: |
126 | | - |
127 | | -1. **Prepare Your AWS Environment:** Create a Bedrock API Key with the necessary permissions. |
128 | | -2. **Verify Region and Model Access:** Confirm that your selected region supports your required models. |
129 | | -3. **Configure CodinIT in VS Code:** Install and set up CodinIT with your AWS API Key and choose an appropriate model. |
130 | | -4. **Implement Security and Monitoring:** Use best practices for IAM, network security, monitoring, and cost management. |
131 | | - |
132 | | -For further details, consult the [AWS Bedrock Documentation](https://docs.aws.amazon.com/bedrock/latest/userguide/what-is-bedrock.html). Happy coding! |
133 | | - |
134 | | ---- |
| 74 | +## Notes |
135 | 75 |
|
136 | | -_This guide will be updated as AWS Bedrock and CodinIT evolve. Always refer to the latest documentation and internal policies for up-to-date practices._ |
| 76 | +- **Pricing:** Usage-based, see [AWS Bedrock Pricing](https://aws.amazon.com/bedrock/pricing/) |
| 77 | +- **Compliance:** HIPAA and SOC 2 Type II compliant |
| 78 | +- **Documentation:** [AWS Bedrock User Guide](https://docs.aws.amazon.com/bedrock/latest/userguide/what-is-bedrock.html) |
| 79 | +- **IAM Best Practices:** [AWS IAM Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) |
0 commit comments