Bedrock runs Anthropic's models on your AWS account. It costs real money per token — but no key is ever written into Onidia's config, and the whole setup is five commands.
Two things to have ready:
Bedrock has to be enabled for the region you pick, and you need permission to turn it on. The AWS console walks you through it.
https://console.aws.amazon.com/bedrock
Only for this guide. Onidia itself never shells out to it — she reads the credential files the CLI writes.
sudo apt install awscli aws --version
A dedicated user, so her access is separate from yours and easy to revoke later. She is an application, not a person — no password, no console sign-in.
aws iam create-user \ --user-name onidia \ --no-password-access
One time only. This is the only moment AWS shows you the secret — there is no way to fetch it again, so copy it now.
aws iam create-access-key --user-name onidia
You get an AccessKeyId and a SecretAccessKey. The secret is
shown once and never again. Put both somewhere safe before you do anything else.
AWS ships a managed policy that covers Bedrock calls.
aws iam attach-user-policy \ --user-name onidia \ --policy-arn arn:aws:iam::aws:policy/AmazonBedrockFullAccess
That name is broad — it covers model access in every region. If you would rather she could only use one model in one region, skip the managed policy and attach a scoped one instead:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
"Resource": "arn:aws:bedrock:us-east-1::foundation-model/*"
}]
}
aws iam create-policy \ --policy-name onidia-bedrock \ --policy-document file://bedrock-scoped.json aws iam attach-user-policy \ --user-name onidia \ --policy-arn arn:aws:iam::ACCOUNT-ID:policy/onidia-bedrock
Either way, check what she ended up with:
aws iam list-attached-user-policies --user-name onidia
The AWS CLI already knows where that is — so let it write the file, rather than making one by hand and getting the shape wrong.
aws configure set aws_access_key_id AKIA... aws configure set aws_secret_access_key "your-secret..." aws configure set region us-east-1 # where that landed cat ~/.aws/credentials cat ~/.aws/config
Add --profile onidia to those three commands and the keys go into their own
section instead of [default]. Then tell Onidia which profile to read with
aws-profile. Useful if your day job already uses the default profile.
No key goes in here — only which profile and region to read.
provider = bedrock [bedrock] aws-profile = default aws-region = us-east-1 bedrock-model = amazon.nova-lite-v1:0
Left empty, aws-profile and aws-region both fall back to the
defaults, so if your ~/.aws/config is already set up you can leave those two
lines out entirely.
onidia-chat -preflight warn # terminal 1 - the body onidia # terminal 2 - the brain onidia-chat
Preflight reports whether the credentials resolve and whether the model is actually available in that region — the two things that go wrong.
Which ones you can use depends on your region, and the model has to be enabled in the Bedrock console before it will answer — access is not automatic even with the right IAM policy.
amazon.nova-lite-v1:0 — small, fast, and the cheapest sensible option
on a Pi. Set with bedrock-model in the config, or -model for one run.
Use its Bedrock model id, for example
anthropic.claude-3-5-sonnet-20241022-v2:0. Enable it in the console first.
The model has not been enabled in this region, or it does not exist there. Model access
is granted per region, so a model working in us-east-1 may not exist in
eu-central-1.
The CLI may be writing to a different home than Onidia reads. Check with
cat ~/.aws/credentials, and that aws-profile matches the
section name in that file exactly.
The key works but the policy is missing. Confirm with
aws iam list-attached-user-policies --user-name onidia, and wait a minute
after attaching — IAM changes take a moment to propagate.
The access key is older than 90 days, or was deleted. Make a new one with
aws iam create-access-key, update the file, and delete the old one.
Add a budget alarm in the AWS billing console before you start chatting. Small models on short replies are cheap; long conversations are not.
To revoke her access completely: detach the policy, delete the access key, then
aws iam delete-user --user-name onidia. Do it in that order — a user
with an attached policy cannot be deleted.