🔑 Amazon Bedrock API Keys: Simplified Authentication for Developers

Amazon Bedrock now offers two types of API Keys to simplify programmatic authentication, each designed for different use cases:

🟢 Short-term API Keys (Recommended)

• Duration: Up to 12 hours or remaining console session time
• Technology: Pre-signed URLs with AWS Signature Version 4
• Permissions: Inherit the same permissions as the generating identity
• Generation: Bedrock console, Python package aws-bedrock-token-generator
• Security: Lower risk due to short duration

🟡 Long-term API Keys (For development)

• Duration: From 1 day up to 36,600 days (or never expires)
• Association: Linked to specific IAM users
• Limit: Maximum 2 keys per IAM user
• Auto-policy: AmazonBedrockLimitedAccess automatically attached to user
• Security: Higher risk – requires regular rotation

🛠️ How to Generate Long-term API Keys

Prerequisites

1. Existing IAM user
2. Required IAM permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceSpecificCredential",
                "iam:ListServiceSpecificCredentials",
                "iam:UpdateServiceSpecificCredential",
                "iam:DeleteServiceSpecificCredential",
                "iam:ResetServiceSpecificCredential"
            ],
            "Resource": "arn:aws:iam::*:user/username"
        }
    ]
}

🖥️ Method 1: AWS Console

1. Navigate to IAM Console → Users
2. Select the IAM user
3. Security credentials tab
4. API keys for Amazon Bedrock section → Generate API Key

1. Configure expiration (1, 5, 30, 90, 365 days or custom) – For long-term API key

1. IMPORTANT! Download/copy the key immediately – you cannot retrieve it later

⌨️ Method 2: AWS CLI

To generate an Amazon Bedrock long-term API key using the AWS CLI, use Generating a long-term API Key for Amazon Bedrock (AWS CLI)steps.

💻 Code Implementation

import requests

# Configuration
url = "https://bedrock-runtime.us-east-1.amazonaws.com/model/anthropic.claude-3-sonnet-20240229-v1:0/invoke"

payload = {
    "messages": [
        {
            "role": "user", 
            "content": [{"type": "text", "text": "Hello, Bedrock!"}]
        }
    ],
    "max_tokens": 1000,
    "anthropic_version": "bedrock-2023-05-31"
}

headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer YOUR_BEDROCK_API_KEY"
}

response = requests.post(url, json=payload, headers=headers)
print(response.json())

🌐 Environment Variable Setup

# Set as environment variable
export AWS_BEARER_TOKEN_BEDROCK=your-api-key-here

# Or use in applications
import os
api_key = os.getenv('AWS_BEARER_TOKEN_BEDROCK')

Use Amazon Bedrock API in your favorite SDK.

🎯 When to Use Each Type?

📊 Key Benefits

✅ Simplified Authentication – No complex signature calculations

✅ Flexible Duration – Choose expiration that fits your needs

✅ Enhanced Security – Service-specific credentials limit scope

✅ Existing IAM Controls – Respects all current permissions

Have you tried the new API Keys yet? Share your experience in the comments! 🚀