AWS Bedrock

Hermes Agent supports Amazon Bedrock as a native provider using the Converse API — not the OpenAI-compatible endpoint. This gives you full access to the Bedrock ecosystem: IAM authentication, Guardrails, cross-region inference profiles, and all foundation models.

• AWS credentials — any source supported by the boto3 credential chain ↗:
• IAM instance role (EC2, ECS, Lambda — zero config)
• AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY environment variables
• AWS_PROFILE for SSO or named profiles
• aws configure for local development
• boto3 — install with cd ~/.hermes/hermes-agent && uv pip install -e ".[bedrock]"
• IAM permissions — at minimum:
• bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream (for inference)
• bedrock:ListFoundationModels and bedrock:ListInferenceProfiles (for model discovery)

After running hermes model, your ~/.hermes/config.yaml will contain:

model:
  default: us.anthropic.claude-sonnet-4-6
  provider: bedrock
  base_url: https://bedrock-runtime.us-east-2.amazonaws.com

bedrock:
  region: us-east-2

Region

Set the AWS region in any of these ways (highest priority first):

1. bedrock.region in config.yaml
2. AWS_REGION environment variable
3. AWS_DEFAULT_REGION environment variable
4. Default: us-east-1

Guardrails

To apply Amazon Bedrock Guardrails ↗ to all model invocations:

bedrock:
  region: us-east-2
  guardrail:
    guardrail_identifier: "abc123def456"  # From the Bedrock console
    guardrail_version: "1"                # Version number or "DRAFT"
    stream_processing_mode: "async"       # "sync" or "async"
    trace: "disabled"                     # "enabled", "disabled", or "enabled_full"

Model Discovery

Hermes auto-discovers available models via the Bedrock control plane. You can customize discovery:

bedrock:
  discovery:
    enabled: true
    provider_filter: ["anthropic", "amazon"]  # Only show these providers
    refresh_interval: 3600                     # Cache for 1 hour

Prompt caching (cachePoint)

Hermes automatically applies prompt caching on the Bedrock Converse API path by inserting cachePoint markers after the system prompt, tool definitions, and the latest message. Because sending a cachePoint block to a model that doesn't support it raises a ValidationException, markers are only added for models on a known-good allowlist (Anthropic Claude and Amazon Nova model IDs); unknown models default to no cache markers. Claude models normally use the AnthropicBedrock SDK path, which has its own prompt caching — the Converse cachePoint path covers Nova and the bearer-token Claude fallback. No configuration needed; cache reads/writes show up in usage accounting.

Context-window probing

For models whose context window isn't in Hermes' static table, Hermes can probe the real limit by sending oversized requests at fixed tiers (~1.3M and ~2.2M tokens) and parsing the maximum reported in Bedrock's length-validation error. Probed values feed the same metadata cache as the static table; stale cached entries that under-report a model's window (e.g. entries seeded before a model's 1M window went GA) are dropped automatically in favor of the larger known value.

Bedrock models use inference profile IDs for on-demand invocation. The hermes model picker shows these automatically, with recommended models at the top:

Use the /model command during a conversation:

/model us.amazon.nova-pro-v1:0
/model deepseek.v3.2
/model us.anthropic.claude-opus-4-6-v1

hermes doctor

The doctor checks:

• Whether AWS credentials are available (env vars, IAM role, SSO)
• Whether boto3 is installed
• Whether the Bedrock API is reachable (ListFoundationModels)
• Number of available models in your region

Bedrock works with all Hermes gateway platforms (Telegram, Discord, Slack, Feishu, etc.). Configure Bedrock as your provider, then start the gateway normally:

hermes gateway setup
hermes gateway start

The gateway reads config.yaml and uses the same Bedrock provider configuration.

"No API key found" / "No AWS credentials"

Hermes checks for credentials in this order:

1. AWS_BEARER_TOKEN_BEDROCK
2. AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY
3. AWS_PROFILE
4. EC2 instance metadata (IMDS)
5. ECS container credentials
6. Lambda execution role

If none are found, run aws configure or attach an IAM role to your compute instance.

"Invocation of model ID ... with on-demand throughput isn't supported"

Use an inference profile ID (prefixed with us. or global.) instead of the bare foundation model ID. For example:

• ❌ anthropic.claude-sonnet-4-6
• ✅ us.anthropic.claude-sonnet-4-6

"ThrottlingException"

You've hit the Bedrock per-model rate limit. Hermes automatically retries with backoff. To increase limits, request a quota increase in the AWS Service Quotas console ↗.

For a fully automated deployment on EC2 with CloudFormation:

sample-hermes-agent-on-aws-with-bedrock ↗ — creates VPC, IAM role, EC2 instance, and configures Bedrock automatically. Deploy in any region with one click.