Connect AWS Bedrock

If you’re building on AWS, you already know the drill: IAM roles, regions, and a dozen services that all need to talk to each other. The good news? Hermes Agent now treats Amazon Bedrock as a first-class citizen. That means you get the full Bedrock ecosystem — IAM authentication, Guardrails, cross-region inference profiles, and every foundation model — without fighting a separate API for each one.

How Hermes routes your models

Here’s the clever part. Hermes doesn’t force every model through the same door. Instead, it picks the best API for each model family:

Model family	API route	Why
Anthropic Claude	Anthropic SDK (`AnthropicBedrock`)	Prompt caching, thinking budgets, adaptive thinking — features not exposed via Converse
OpenAI GPT-6 (Astra, Sol, Luna), GPT-6.1 Sol, GPT-5.6 (Sol, Terra, Luna), GPT-5.5 with a bare `openai.*` ID	Bedrock Mantle OpenAI Responses endpoint (`bedrock-mantle.<region>.api.aws/openai/v1`)	Bedrock Mantle serves the bare in-Region ID. `bedrock-runtime` does not accept it
The same OpenAI models with a `us.` or `global.` inference-profile ID	Native Converse API (`bedrock-runtime`)	Cross-Region profiles exist only on `bedrock-runtime`, and the model cards list Converse as supported there
Everything else (Nova, DeepSeek, Llama, GPT-OSS, …)	Native Converse API (`bedrock-runtime`)	Full Bedrock feature set: Guardrails, inference profiles, streaming

The best part? All three routes share the same AWS credential chain and region resolution. No separate configuration needed. Requests to the Mantle endpoint are authenticated with AWS_BEARER_TOKEN_BEDROCK when set, or SigV4-signed via the standard boto3 credential chain otherwise.

What you need to get started

Before you dive in, make sure you have:

AWS credentials — any source supported by the boto3 credential chain:
- IAM instance role (EC2, ECS, Lambda — zero config)
- AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY environment variables
- AWS_PROFILE for SSO or named profiles
- aws configure for local development
boto3 — install with cd ~/.hermes/hermes-agent && python -c "import pm; pm.sync_venv(['bedrock'], explicit=True)". Python dependency commands on this page use a PM-prepared source checkout; after a dependency change, reactivate the checkout and restart Hermes.
IAM permissions — at minimum:
- bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream (for inference)
- bedrock:ListFoundationModels and bedrock:ListInferenceProfiles (for model discovery)
- bedrock:GetInferenceProfile — only needed if model.default is an application inference profile ARN, so Hermes can size the context window from the wrapped model

Pro tip for EC2 / ECS / Lambda: Just attach an IAM role with AmazonBedrockFullAccess and you’re done. No API keys, no .env configuration — Hermes detects the instance role automatically.

Quick start

Getting up and running takes about a minute:

# Install with Bedrock support
cd ~/.hermes/hermes-agent && python -c "import pm; pm.sync_venv(['bedrock'], explicit=True)"

# Select Bedrock as your provider
hermes model
# → Choose "More providers..." → "AWS Bedrock"
# → Select your region and model

# Start chatting
hermes chat

After running hermes model, your ~/.hermes/config.yaml will look something like this:

model:
  default: us.anthropic.claude-sonnet-4-6
  provider: bedrock
  base_url: https://bedrock-runtime.us-east-2.amazonaws.com

bedrock:
  region: us-east-2

Configuration essentials

Region — Set it in any of these ways (highest priority first):

bedrock.region in config.yaml
AWS_REGION environment variable
AWS_DEFAULT_REGION environment variable
Default: us-east-1

Guardrails — Want to apply Amazon Bedrock Guardrails to all model invocations? Just add this:

bedrock:
  region: us-east-2
  guardrail:
    guardrail_identifier: "abc123def456"  # From the Bedrock console
    guardrail_version: "1"                # Version number or "DRAFT"
    stream_processing_mode: "async"       # "sync" or "async"
    trace: "disabled"                     # "enabled", "disabled", or "enabled_full"

Guardrails are attached on the Converse route and on the Claude route, so prompt caching and thinking are preserved. A blocked request shows up as a content-filter refusal rather than model text, and stream_processing_mode only applies to Converse. Note that AWS doesn’t apply Guardrails to the Mantle Responses endpoint used by bare openai.gpt-* IDs (AWS docs). Use a Converse-served model, such as a us. or global. OpenAI inference profile, when a guardrail is required.

Model discovery — Hermes auto-discovers available models via the Bedrock control plane. You can customize what shows up:

bedrock:
  discovery:
    enabled: true
    provider_filter: ["anthropic", "amazon"]  # Only show these providers
    refresh_interval: 3600                     # Cache for 1 hour

Smart features under the hood

Prompt caching — Hermes automatically applies prompt caching on the Bedrock Converse API path by inserting cachePoint markers after the system prompt, tool definitions, and the latest message. Markers are only added for models on a known-good allowlist (Anthropic Claude and Amazon Nova model IDs) to avoid ValidationException errors. No configuration needed — cache reads and writes show up in usage accounting.

Context-window probing — For models whose context window isn’t in Hermes’ static table, Hermes can probe the real limit by sending oversized requests at fixed tiers (~1.3M and ~2.2M tokens) and parsing the maximum reported in Bedrock’s length-validation error. Stale cached entries that under-report a model’s window are dropped automatically. When neither the probe nor the static table knows a model, Hermes uses a 128,000-token fallback and logs a WARNING naming the model. Set model.context_length in config.yaml to the model’s real window.

Application inference profiles — If your model.default is an application inference profile ARN (something like arn:aws:bedrock:us-west-2:123456789012:application-inference-profile/abcdef123456), the ARN itself doesn’t name a model, so Hermes calls bedrock:GetInferenceProfile in that ARN’s region and sizes the context window from the model the profile wraps. Without that permission, a 128,000-token default applies and a warning names the profile — you can also set model.context_length explicitly to override either way.

Available models

Bedrock models use inference profile IDs for on-demand invocation. The hermes model picker shows these automatically, with recommended models at the top:

Model	ID	Notes
Claude Sonnet 4.6	`us.anthropic.claude-sonnet-4-6`	Recommended — best balance of speed and capability
Claude Opus 4.6	`us.anthropic.claude-opus-4-6-v1`	Most capable
Claude Haiku 4.5	`us.anthropic.claude-haiku-4-5-20251001-v1:0`	Fastest Claude
OpenAI GPT-6 Astra	`openai.gpt-6-astra`	Most capable OpenAI model, 1,050,000-token window
OpenAI GPT-6.1 Sol	`openai.gpt-6.1-sol`	1M-token window. Mantle in-Region access is `us-east-1` only
OpenAI GPT-6 Sol	`openai.gpt-6-sol`	Coding and agentic work, 1,050,000-token window
OpenAI GPT-6 Luna	`openai.gpt-6-luna`	Focused, high-volume tasks, 1,050,000-token window
OpenAI GPT-5.6 Sol	`openai.gpt-5.6-sol`	1,050,000-token window
OpenAI GPT-5.6 Terra	`openai.gpt-5.6-terra`	Balanced, 1,050,000-token window
OpenAI GPT-5.6 Luna	`openai.gpt-5.6-luna`	Fast, affordable, 1,050,000-token window
OpenAI GPT-5.5	`openai.gpt-5.5`	Mantle only, no inference profiles
Amazon Nova Pro	`us.amazon.nova-pro-v1:0`	Amazon’s flagship
Amazon Nova Micro	`us.amazon.nova-micro-v1:0`	Fastest, cheapest
DeepSeek V3.2	`deepseek.v3.2`	Strong open model
Llama 4 Scout 17B	`us.meta.llama4-scout-17b-instruct-v1:0`	Meta’s latest

Models prefixed with us. use cross-region inference profiles, which provide better capacity and automatic failover across AWS regions. Models prefixed with global. route across all available regions worldwide.

OpenAI models have two endpoint forms. The bare openai.* ID is in-Region and Hermes sends it to Bedrock Mantle’s Responses endpoint in the configured region. The us.openai.* and global.openai.* IDs are cross-Region inference profiles. Hermes sends them to bedrock-runtime through the Converse API, the same path as other inference profiles. Each AWS model card lists the profiles a model offers and the regions Mantle serves it in.

That’s it — you’re ready to build on Bedrock with Hermes. Whether you’re running on EC2 with zero config or juggling multiple AWS profiles, Hermes handles the heavy lifting so you can focus on what matters: your actual application.

Keep reading: Hermes on Azure Foundry — On the Microsoft side, Hermes on Azure Foundry is the equivalent hosted route.