> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Bring Your Own Key (BYOK)

> Route LLM inference through your own AWS Bedrock account for unlimited usage, cost control, and data residency

Bring Your Own Key (BYOK) lets workspaces on Scale and above plans run LLM inference through their own AWS Bedrock credentials instead of platform credits. Usage bills to your AWS account, and you choose which regions serve inference.

***

## Why BYOK

* **Unlimited usage** — your own Bedrock quotas apply, not platform credit limits.
* **Cost control** — charges land on your AWS bill, where you already have budgets and cost allocation tags.
* **Data residency** — route inference through US-only, EU-only, or APAC-only [inference profiles](#inference-profiles).
* **Compliance** — you control where inference happens and who can audit it.
* **No model management** — CloudThinker selects Claude Sonnet 4.5 or Opus 4.5 automatically per task.

***

## Prerequisites

* **Scale, Scale +, or Enterprise plan** — see [Pricing & Plans](/guide/billing/pricing)
* **AWS account** with Amazon Bedrock access enabled
* **IAM credentials** (access key ID and secret access key) with Bedrock invoke permissions
* **Model access** for both Claude Sonnet 4.5 and Claude Opus 4.5 in your AWS account

CloudThinker authenticates with AWS IAM credentials: an access key ID, a secret access key, and an optional session token for temporary credentials. Direct Bedrock API keys are planned but not yet supported.

<Info>
  Long-term credentials (AKIA prefix) support automatic session token refresh. Temporary credentials (ASIA prefix) cannot be refreshed — reconfigure when they expire.
</Info>

***

## Request Claude model access

Claude models require a one-time use case form in the Bedrock console before you can invoke them. See the [AWS Bedrock model access documentation](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html) for details.

<Steps>
  <Step title="Open Model access in the Bedrock console">
    Log in to the [AWS Console](https://console.aws.amazon.com/), open [Amazon Bedrock](https://console.aws.amazon.com/bedrock/), and click **Model access** in the left navigation.
  </Step>

  <Step title="Modify model access">
    Click **Modify model access** and enable both:

    * **Claude Sonnet 4.5** (`anthropic.claude-sonnet-4-5-20250929-v1:0`)
    * **Claude Opus 4.5** (`anthropic.claude-opus-4-5-20251101-v1:0`)
  </Step>

  <Step title="Submit use case details">
    Complete the form with your use case description, expected usage patterns, and compliance requirements if applicable.

    **Success state:** the Model access page shows both models as access granted — typically immediately after submission.
  </Step>
</Steps>

<Info>
  Request access to **both** Sonnet 4.5 and Opus 4.5. CloudThinker switches between them based on task requirements.
</Info>

***

## Create IAM credentials

Your IAM user needs permission to invoke both models. Create one with the AWS CLI, or via the [AWS Console](https://console.aws.amazon.com/iam/).

<Steps>
  <Step title="Create the IAM user">
    ```bash theme={null}
    aws iam create-user --user-name bedrock-byok-user
    ```
  </Step>

  <Step title="Create the policy file">
    ```bash theme={null}
    cat > bedrock-policy.json << 'EOF'
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "bedrock:InvokeModel",
            "bedrock:InvokeModelWithResponseStream"
          ],
          "Resource": [
            "arn:aws:bedrock:*::foundation-model/anthropic.claude-sonnet-4-5-20250929-v1:0",
            "arn:aws:bedrock:*::foundation-model/anthropic.claude-opus-4-5-20251101-v1:0",
            "arn:aws:bedrock:*:*:inference-profile/global.anthropic.claude-sonnet-4-5-20250929-v1:0",
            "arn:aws:bedrock:*:*:inference-profile/global.anthropic.claude-opus-4-5-20251101-v1:0",
            "arn:aws:bedrock:*:*:inference-profile/us.anthropic.claude-sonnet-4-5-20250929-v1:0",
            "arn:aws:bedrock:*:*:inference-profile/us.anthropic.claude-opus-4-5-20251101-v1:0",
            "arn:aws:bedrock:*:*:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
            "arn:aws:bedrock:*:*:inference-profile/eu.anthropic.claude-opus-4-5-20251101-v1:0",
            "arn:aws:bedrock:*:*:inference-profile/apac.anthropic.claude-sonnet-4-5-20250929-v1:0",
            "arn:aws:bedrock:*:*:inference-profile/apac.anthropic.claude-opus-4-5-20251101-v1:0"
          ]
        },
        {
          "Effect": "Allow",
          "Action": ["sts:GetSessionToken"],
          "Resource": "*"
        }
      ]
    }
    EOF
    ```
  </Step>

  <Step title="Attach the policy">
    ```bash theme={null}
    aws iam put-user-policy \
      --user-name bedrock-byok-user \
      --policy-name BedrockInvokePolicy \
      --policy-document file://bedrock-policy.json
    ```
  </Step>

  <Step title="Create access keys">
    ```bash theme={null}
    aws iam create-access-key --user-name bedrock-byok-user
    ```

    Save the `AccessKeyId` and `SecretAccessKey` from the output — you'll enter these in CloudThinker.
  </Step>

  <Step title="Verify the credentials">
    ```bash theme={null}
    aws configure --profile bedrock-byok-user
    aws sts get-caller-identity --profile bedrock-byok-user
    ```

    **Success state:** `get-caller-identity` returns the `bedrock-byok-user` ARN.
  </Step>
</Steps>

<Info>
  These commands require an AWS profile with IAM administrative permissions (`iam:CreateUser`, `iam:PutUserPolicy`, `iam:CreateAccessKey`).
</Info>

***

## Connect Bedrock in CloudThinker

<Steps>
  <Step title="Open BYOK settings">
    Go to **Settings → BYOK Settings** and choose **AWS Bedrock** as the provider.
  </Step>

  <Step title="Enter credentials">
    Provide your **Access Key ID** (AKIA or ASIA prefix), **Secret Access Key**, and — only for temporary credentials — a **Session Token**.
  </Step>

  <Step title="Select an inference profile">
    Pick **Global**, **US**, **EU**, or **APAC** depending on your [data residency needs](#inference-profiles).
  </Step>

  <Step title="Test and save">
    Click **Test Connection** to confirm the credentials are valid and both models are reachable, then click **Save**.

    **Success state:** the test passes for both Sonnet 4.5 and Opus 4.5.
  </Step>
</Steps>

Credentials are encrypted at rest and never exposed in API responses or logs.

***

## Inference profiles

Bedrock inference profiles control which AWS regions can serve your requests. For region coverage, see the [AWS inference profile documentation](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-support.html).

| Profile    | Routing                   | Typical use             |
| ---------- | ------------------------- | ----------------------- |
| **Global** | Any commercial AWS region | Maximum throughput      |
| **US**     | US regions only           | US data residency       |
| **EU**     | EU regions only           | GDPR compliance         |
| **APAC**   | APAC regions only         | Regional data residency |

***

## How it works

* **Model selection** — CloudThinker picks the appropriate Claude model per task; you never select models manually. See the [supported foundation models list](https://docs.aws.amazon.com/bedrock/latest/userguide/models-supported.html).
* **Workspace inheritance** — the workspace owner configures BYOK once; every member inherits it. All member LLM usage routes through the owner's AWS account, and the owner manages the credentials centrally.

***

## Fallback behavior

CloudThinker can retry a failed BYOK call on platform-managed Bedrock credentials, but this is **opt-in per workspace** and **disabled by default for Enterprise and BYOC plans**. With fallback off, a failed call surfaces the error — no request leaves your credential boundary.

### When fallback triggers (if enabled)

A BYOK call falls back to the platform path only when **all three** are true:

1. The error is retryable — credential expiration, throttling, transient 5xx — not a content or policy violation.
2. The operation is marked **fallback-eligible** (most read operations; never autonomous write actions in production).
3. The workspace's fallback policy is **Allow**.

A fallback re-sends the request to the platform-managed Bedrock account in **the same region** as the original call — never a different jurisdiction. Every fallback emits an audit event (original error code, serving endpoint, user, workspace, model, token count) in **Admin Settings → Audit log**, exportable to your SIEM via [webhooks](/guide/webhooks/overview).

### Set the fallback policy

<Steps>
  <Step title="Open the fallback policy">
    Go to **Admin Settings → BYOK → Fallback policy**.
  </Step>

  <Step title="Choose a policy">
    | Policy                                                       | Behavior on BYOK failure                                       | Typical use            |
    | ------------------------------------------------------------ | -------------------------------------------------------------- | ---------------------- |
    | **Allow**                                                    | Retry on platform credentials in-region                        | Dev / sandbox tenants  |
    | **Warn**                                                     | Retry in-region, but require user re-confirmation next session | Mixed workloads        |
    | **Strict** *(default and recommended for Enterprise / BYOC)* | Surface the error; never retry on different credentials        | Regulated environments |
  </Step>

  <Step title="Lock it at the org level (optional)">
    Toggle **Enforce across all workspaces** so workspace admins can't change the policy locally. Only org owners with the `byok:admin` permission can flip this toggle.
  </Step>
</Steps>

<Warning>
  **Strict mode trade-off:** if BYOK credentials are misconfigured or revoked, agent operations fail until you fix them. Plan for credential rotation and quota management, and set up [notifications](/guide/notifications) on BYOK health.
</Warning>

### What inference calls send

Regardless of policy, each BYOK call sends the agent's system prompt and tool definitions, the relevant conversation history, and any retrieved context (topology, memory, runbooks). It never sends raw cloud credentials, other workspaces' data, or — when tokenization is configured in **Admin Settings → Data Protection** — customer PII.

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="Model access denied errors">
    * Verify you submitted the use case form in the Bedrock console
    * Check that both Sonnet 4.5 and Opus 4.5 are enabled on the **Model access** page
    * Wait a few minutes after submission for access to propagate
  </Accordion>

  <Accordion title="IAM permission errors">
    * Verify the policy includes `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream`
    * Check the model and inference-profile ARNs match the models and profile you use
    * Test the permissions directly in the AWS Console
  </Accordion>

  <Accordion title="Credential validation failures">
    * Verify the access key ID and secret access key are correct and not rotated or revoked
    * For temporary credentials, confirm the session token hasn't expired
    * Test with `aws sts get-caller-identity`
  </Accordion>

  <Accordion title="Test connection fails">
    * Verify both Sonnet 4.5 and Opus 4.5 are accessible and covered by your IAM policy
    * Ensure Bedrock is enabled in your AWS account
    * Check the region selection matches your model access
  </Accordion>

  <Accordion title="BYOK not working in workspace">
    * Verify the workspace owner has configured BYOK and it's enabled in settings
    * Confirm the owner's plan is Scale, Scale +, or Enterprise
    * Check the owner's credentials are still valid
  </Accordion>

  <Accordion title="Session token expiration">
    * Long-term credentials (AKIA) refresh automatically
    * Temporary credentials (ASIA) can't be refreshed — reconfigure with new credentials
    * Check the `session_token_expires_at` timestamp in the configuration
  </Accordion>
</AccordionGroup>

***

## Related

<CardGroup cols={2}>
  <Card title="Pricing & Plans" icon="credit-card" href="/guide/billing/pricing">
    Which plans include BYOK and what each tier covers
  </Card>

  <Card title="Usage" icon="chart-line" href="/guide/billing/usage">
    Track credit and LLM usage across your workspace
  </Card>

  <Card title="Notifications" icon="bell" href="/guide/notifications">
    Alert on BYOK credential health before it blocks work
  </Card>

  <Card title="Webhooks" icon="webhook" href="/guide/webhooks/overview">
    Export audit events to your SIEM
  </Card>
</CardGroup>