Configure Amazon Bedrock as Cynative's LLM Provider

Run Cynative with AWS Bedrock-hosted models. Uses the AWS credential chain — no API key needed. Configure region, model ID, and cross-region inference.

Cynative supports Amazon Bedrock through two Bifrost providers: bedrock (the standard Bedrock Converse API) and bedrock_mantle (the newer Bedrock Mantle endpoint at bedrock-mantle.<region>.api.aws, which exposes Claude via the native Anthropic Messages API and OpenAI/Gemma models via an OpenAI-compatible API).

Neither provider requires a separate API key — they authenticate using the standard AWS credential chain. This makes Bedrock a natural fit for Cynative running inside AWS (EC2, ECS, Lambda) with an IAM role, or locally with a named profile.

Bedrock

Quick start

export AWS_PROFILE=my-profile          # or AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY
export CYNATIVE_LLM_PROVIDER=bedrock
export CYNATIVE_LLM_MODEL=anthropic.claude-opus-4-v1:0
export CYNATIVE_LLM_BEDROCK_REGION=us-east-1
cynative -p "enumerate all EC2 instances and their attached security groups"

No ~/.cynative/config.yaml file is required.

YAML configuration

Flat form (equivalent to the env-var quick start):

llm:
  provider: bedrock
  model: anthropic.claude-opus-4-v1:0
  bedrock:
    region: us-east-1

Full keys[] form (for explicit static credentials, role ARN, or multi-key routing):

llm:
  provider: bedrock
  model: anthropic.claude-opus-4-v1:0
  keys:
    - value: ""                      # Bedrock uses AWS credentials, not an API key
      models: ["*"]
      weight: 1.0
      bedrock_key_config:
        region: us-east-1

Authentication

Bifrost picks up AWS credentials from the standard chain — in order:

1. AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY environment variables.
2. Named profile (AWS_PROFILE or the default profile in ~/.aws/credentials).
3. IAM role attached to the running instance or task (instance metadata / ECS task role).

No api_key field or CYNATIVE_LLM_API_KEY is used for Bedrock.

Environment variable reference

Environment variable	YAML equivalent	Description
CYNATIVE_LLM_PROVIDER	llm.provider	Must be bedrock.
CYNATIVE_LLM_MODEL	llm.model	Bedrock model id (e.g. anthropic.claude-opus-4-v1:0).
CYNATIVE_LLM_BEDROCK_REGION	llm.bedrock.region	AWS region for the Bedrock endpoint (e.g. us-east-1).
CYNATIVE_LLM_NETWORK_CONFIG_DEFAULT_REQUEST_TIMEOUT_IN_SECONDS	llm.network_config.default_request_timeout_in_seconds	Per-request timeout in seconds. Cynative default: 300.
CYNATIVE_LLM_NETWORK_CONFIG_MAX_RETRIES	llm.network_config.max_retries	Retry attempts on 429/5xx errors. Cynative default: 3.
CYNATIVE_LLM_REASONING_EFFORT	llm.reasoning_effort	Reasoning effort level (passed through to the underlying model).
CYNATIVE_LLM_REASONING_MAX_TOKENS	llm.reasoning_max_tokens	Explicit reasoning token budget.

---

Bedrock Mantle

Bedrock Mantle is Amazon’s newer inference surface served at bedrock-mantle.<region>.api.aws. It exposes:

• Claude models via the native Anthropic Messages API.
• OpenAI-family (gpt-*) and Gemma models via the OpenAI-compatible API.

Bifrost selects the correct API path automatically based on the model id. The model id is sent verbatim to the endpoint, with support for an optional leading region/ addressing prefix.

Quick start

export AWS_PROFILE=my-profile          # or AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY
export CYNATIVE_LLM_PROVIDER=bedrock_mantle
export CYNATIVE_LLM_MODEL=anthropic.claude-opus-4-8
export CYNATIVE_LLM_BEDROCK_MANTLE_REGION=us-east-1
cynative -p "..."

No ~/.cynative/config.yaml file is required. With no api_key set, requests are SigV4-signed using credentials from the standard AWS chain.

YAML configuration

Flat form (equivalent to the env-var quick start):

llm:
  provider: bedrock_mantle
  model: anthropic.claude-opus-4-8
  bedrock_mantle:
    region: us-east-1

Full keys[] form:

llm:
  provider: bedrock_mantle
  model: anthropic.claude-opus-4-8
  keys:
    - value: ""                      # empty → SigV4 via AWS credentials
      models: ["*"]
      weight: 1.0
      bedrock_mantle_key_config:
        region: us-east-1

Authentication

Bedrock Mantle supports two authentication modes:

• AWS credentials (SigV4). Leave api_key unset. Bifrost signs each request for the bedrock-mantle service using the standard AWS credential chain.
• Bedrock Mantle API key. Set api_key (or CYNATIVE_LLM_API_KEY) to a Bedrock Mantle API key. It is sent as Authorization: Bearer and SigV4 signing is skipped.

The region is resolved from (in order): a region/ prefix on the model id, the bedrock_mantle.region config field, or falls back to us-east-1.

Environment variable reference

Environment variable	YAML equivalent	Description
CYNATIVE_LLM_PROVIDER	llm.provider	Must be bedrock_mantle.
CYNATIVE_LLM_MODEL	llm.model	Model id (e.g. anthropic.claude-opus-4-8). Optionally prefix with region/.
CYNATIVE_LLM_BEDROCK_MANTLE_REGION	llm.bedrock_mantle.region	AWS region (e.g. us-east-1). Falls back to us-east-1 if unset.
CYNATIVE_LLM_API_KEY	llm.api_key	Optional Bedrock Mantle API key; if set, disables SigV4 signing.
CYNATIVE_LLM_NETWORK_CONFIG_DEFAULT_REQUEST_TIMEOUT_IN_SECONDS	llm.network_config.default_request_timeout_in_seconds	Per-request timeout in seconds. Cynative default: 300.
CYNATIVE_LLM_NETWORK_CONFIG_MAX_RETRIES	llm.network_config.max_retries	Retry attempts on 429/5xx errors. Cynative default: 3.

Prompt caching

Claude models served through both bedrock and bedrock_mantle participate in Cynative’s automatic prompt-caching. Cache breakpoints are injected on the tool schemas, system prompt, and recent conversation turns. See the prompt caching section in the overview for details.

Links

• Amazon Bedrock documentation
• Bifrost Bedrock provider source
• Bifrost Bedrock Mantle provider source