Skip to main content
This topic explains how to configure Amazon Bedrock as a model provider for the Playground integration. You can use the Playground integration to configure AI models for use with the LaunchDarkly playground feature. Unlike other model providers, Amazon Bedrock does not use an API key. Instead, you grant LaunchDarkly permission to invoke your Bedrock models by creating an AWS Identity and Access Management (IAM) role in your AWS account. You configure this role once, then choose Bedrock models from the Playground the same way you choose models from any other provider.

​
Prerequisites

To configure Bedrock, you need:
  • AWS IAM permissions to create and update roles and policies
  • Access to the specific foundation models you plan to use
  • Amazon Bedrock access in the AWS Region where you want to invoke models
  • LaunchDarkly AWS account ID for your deployment

​
LaunchDarkly AWS Account IDs

Use the LaunchDarkly Account ID for your deployment in the following table:
DeploymentLaunchDarkly AWS account ID
US production554582317989
EU production730335645576

​
How the integration works

LaunchDarkly calls the AWS API action, sts:AssumeRole, using the role Amazon Resource Name (ARN) you provide and a generated External ID. AWS then returns short-lived credentials, and LaunchDarkly uses those credentials to call Bedrock in the AWS Region you select. Model inference runs against, and is billed to, your AWS account, not the LaunchDarkly AWS account.

​
Step 1: Start the integration in LaunchDarkly

  1. Navigate to Settings. Under “Connections”, click Integrations.
  2. Search for “Playground” and click Add new. A side panel opens.
  3. In the Name field, enter a unique name for the configuration.
  4. From the Model Provider dropdown, choose “Bedrock”.
  5. In the AWS Region dropdown, choose the region where you want the configuration to invoke models.
  6. Copy the generated External ID.
  7. Keep this side panel open. You will enter the AWS Role ARN value after completing the Step 4.
Start the configuration from the playgroundYou can also start the configuration from the playground. Click Set up API key, select “Bedrock,” then choose an AWS Region and copy the External ID from the “Connect your AI provider” dialog. Complete the remaining AWS steps in this topic, then return to the dialog to enter the Role ARN. To learn more, read Manage API keys.

​
Step 2: Prepare model access in AWS

  1. Navigate to the AWS console and select the same region you selected in LaunchDarkly.
  2. Open Amazon Bedrock.
  3. Confirm that you have access to the foundation models you plan to use.
Foundation model accessAccess to a foundation model is generally enabled on first invocation if the caller has the necessary AWS Marketplace subscription permissions. If the role you use for setup does not have those permissions, ask an AWS administrator to enable or subscribe to the model first.

​
Step 3: Create a permissions policy

Create an IAM policy that grants the bedrock:InvokeModel permission. This permission is also required by the Bedrock Converse API that the integration uses. Here is an example policy document that grants the required permission:
Setting Bedrock accessSetting the resource to all (*) resources scopes the policy to InvokeModel only. It does not grant full Bedrock access. If you want least-privilege access, restrict the resource to specific model or inference profile ARNs instead.

​
Step 4: Create the IAM role

  1. In the AWS console, navigate to IAM > Roles. Click Create role.
  2. Click Custom trust policy, and set the trusted account to the LaunchDarkly AWS Account ID for your deployment.
  3. Check the Require external ID checkbox.
  4. Paste the exact External ID you copied in Step 1.
  5. Leave the Require MFA box unchecked.
  6. Attach the permissions policy you created in Step 3.
  7. Create the role, then copy the Role ARN.
Here is an example trust policy that trusts the LaunchDarkly AWS account and requires the External ID:
External IDs in role trust policiesDo not remove the External ID condition from the role’s trust policy.The External ID is a confused-deputy safeguard. It does not grant access by itself, but LaunchDarkly requires it as part of the trust relationship.
If you delete and recreate the integration, LaunchDarkly generates a new external ID. Update the role’s trust policy with the new external ID before LaunchDarkly can assume the role again.

​
Step 5: Finish the integration in LaunchDarkly

  1. Return to the integration configuration panel in LaunchDarkly from Step 1.
  2. Paste the Role ARN from Step 4.
  3. Confirm that the Region matches the Region you selected in AWS.
  4. Read the Integration Terms and Conditions, then check the I have read and agree to the Integration Terms and Conditions checkbox.
  5. Click Save.
To confirm your setup:
  1. Open the playground.
  2. Choose a Bedrock model.
  3. Run a prompt.
Only one enabled configuration per model providerOnly one enabled configuration is supported per model provider. If you try to enable a second configuration for the same provider, LaunchDarkly prevents you from saving it and shows an error message that reads Only one enabled configuration per provider is allowed.