> ## Documentation Index
> Fetch the complete documentation index at: https://ona.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Bedrock (OpenAI API)

> Set up OpenAI GPT-5.6 global inference profiles through AWS Bedrock Runtime

<Note>Available on the Enterprise plan. OpenAI model routing must be enabled for your organization. [Contact sales](https://ona.com/contact/sales) to learn more.</Note>

<Note>
  AWS Bedrock (OpenAI API) is supported only on **AWS EC2 Runners**.
</Note>

Use AWS Bedrock's OpenAI-compatible API when Codex Agent should run GPT-5.6 models through Bedrock Runtime with your organization's Bedrock API key.

AWS Bedrock (OpenAI API) is separate from [AWS Bedrock Mantle](/docs/ona/agents/llm-providers/bedrock-mantle) and the deprecated [AWS Bedrock integration for Anthropic models](/docs/ona/agents/llm-providers/bedrock).

To track spend on your BYOK model usage, see the [AI cost usage API](/docs/ona/billing/cost-usage-api).

## Prerequisites

* Your organization has OpenAI model routing enabled.
* You have an AWS EC2 runner configured in Ona.
* Your AWS account has access to the required OpenAI GPT-5.6 models in Bedrock.
* You have a Bedrock API key. See [Generate an Amazon Bedrock API key](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html).

## Understand endpoints and model profiles

The endpoint hostname identifies the AWS region that receives the request:

```text theme={null}
https://bedrock-runtime.<region>.amazonaws.com/openai/v1/responses
```

Ona uses the corresponding global inference-profile identifier for the selected GPT-5.6 model:

```text theme={null}
global.openai.gpt-5.6-sol
global.openai.gpt-5.6-terra
global.openai.gpt-5.6-luna
```

The `global.` prefix is part of the model identifier. It does not replace the region in the hostname. AWS routes global inference-profile requests across supported commercial AWS regions.

## Add the integration with the UI

1. Go to the [Runners settings page](https://app.ona.com/settings/runners).
2. Select the AWS EC2 runner where you want to configure Bedrock.
3. Scroll to **LLM Providers**.
4. Click **Configure**.
5. Select **AWS Bedrock (OpenAI API)**.
6. Enter the AWS region for the Bedrock Runtime endpoint, such as `us-east-1`.
7. Paste your Bedrock API key into **API Key**.
8. Click **Create Integration**.

Ona generates the regional endpoint and sends the Bedrock API key as an HTTP bearer token. The API key is encrypted at rest and is not exposed inside environments.

If your organization uses a custom dashboard domain, open the runner settings on that domain instead of `app.ona.com`.

## Add the integration with the CLI

```bash theme={null}
gitpod runner config llm-integration create \
  <runner-id> \
  SUPPORTED_MODEL_OPENAI_AUTO \
  https://bedrock-runtime.<region>.amazonaws.com/openai/v1/responses \
  <bedrock-api-key>
```

To verify the integration:

```bash theme={null}
gitpod runner config llm-integration list
```

## Verify the integration

1. Create a new environment with the configured AWS EC2 runner.
2. Start Codex Agent.
3. Confirm that the agent can answer a simple code question.
4. Check your AWS Bedrock usage to confirm that requests use an OpenAI GPT-5.6 global inference profile.

## FAQ

<Accordion title="Why does a global model profile use a regional endpoint?">
  The regional hostname selects the Bedrock Runtime API endpoint that receives the request. The `global.` model prefix tells AWS to use global cross-region inference for that model.
</Accordion>

<Accordion title="Can I use IAM credentials instead of a Bedrock API key?">
  No. This Ona integration uses Bedrock API-key bearer authentication. The deprecated Anthropic integration uses runner IAM credentials with the native Bedrock API and is configured separately.
</Accordion>

## Troubleshooting

<Accordion title="AWS Bedrock (OpenAI API) is not shown">
  This option is available only on AWS EC2 runners when OpenAI model routing is enabled for your organization. It is not shown on GCP runners.
</Accordion>

<Accordion title="Authentication fails">
  Confirm that the key is an active Bedrock API key and that its permissions allow access to the selected OpenAI GPT-5.6 model. Do not paste AWS access-key credentials into the API key field.
</Accordion>

<Accordion title="Bedrock rejects model requests">
  Confirm that the configured AWS region supports the OpenAI GPT-5.6 global inference profile and that the Bedrock API key has permission to use it. Check the AWS Bedrock service status if requests continue to fail.
</Accordion>