Amazon Bedrock

Connect Amazon Bedrock to LLM-assisted labeling.

Before you begin

To use Anthropic models (such as Claude Sonnet or Claude Opus), Amazon Bedrock requires you to submit your use case details before granting access to their models on Bedrock. Please refer to the Claude Documentation for more information.

Create an Amazon Bedrock access policy

Create an IAM policy that grants permission to call Amazon Bedrock models. This is the only permission required for the extension.

1. Open the IAM page in AWS.

2. Go to Policies.

3. Click Create policy.

   
4. Switch to the JSON tab and paste the following:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowInvokeModels",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*"
    }
  ]
}

Set up AWS credentials

Provide AWS credentials that include the policy created above. Choose one of the following options:

Approach	Best for	How credentials work
IAM User	Quick setup, personal use	Long-lived access keys you generate once
IAM Role	Production, shared environments	Temporary keys

IAM User

Create a dedicated IAM user and generate permanent access keys.

1. Open the IAM page in AWS.

2. Go to Users, then click Create user.

3. Attach the policy created earlier (either directly or through a group).

   
4. Go to the Security credentials tab.

5. Under Access keys, click Create access key.

6. Copy the Access Key ID and Secret Access Key.

IAM Role (Recommended)

IAM roles use temporary credentials that expire automatically, making them more secure for production use. This approach requires the AWS CLI.

1. Open the IAM in AWS.

2. Go to Roles, then click Create role.

3. Attach the policy you created earlier.

4. Generate temporary credentials:

   1. Install and configure the AWS CLI (if you haven't already):

      1. Install the AWS CLI →

      2. Configure your CLI credentials →

   2. Ensure your CLI credentials have permission to assume the role.

   3. Generate temporary credentials by running the following command. Replace ACCOUNT_ID with your 12-digit AWS account ID.

aws sts assume-role \\
  --role-arn arn:aws:iam::ACCOUNT_ID:role/BedrockRole \\
  --role-session-name bedrock-session

You'll get a response like this:

{
  "Credentials": {
    "AccessKeyId": "ASIA...",
    "SecretAccessKey": "...",
    "SessionToken": "...",
    "Expiration": "2026-02-12T12:00:00Z"
  }
}

These credentials are temporary. When they expire (check the Expiration timestamp), run the assume-role command again and update the extension with the new values.

Start prediction

You should now have the required credentials. Copy the values from the response, enter them into the extension, then click Predict labels.

Access Key ID	AccessKeyId from the response
Secret Access Key	SecretAccessKey from the response
Session Token	SessionToken from the response, empty if you are using IAM User