Connecting AWS Bedrock

Bedrock is set up a little differently than the others. Instead of pasting in an existing key, TokenFront walks you through creating a dedicated, read-only AWS credential just for this connection. You don't need to touch IAM policies by hand.

Step 1: Create the AWS credentials

1. Open Connect AWS Bedrock in TokenFront.
2. Pick your AWS region from the dropdown.
3. Click Launch stack in the AWS console. This opens AWS CloudFormation in a new tab, pre-filled with everything needed.
4. Review the stack (it's named TokenFront-Bedrock-Access) and click Create stack.
5. Wait about 30 seconds for AWS to finish creating it.

This creates a new, narrowly-scoped IAM user with exactly the read permissions TokenFront needs to pull Bedrock usage and cost data, nothing more. It does not give TokenFront the ability to run models or change anything in your AWS account.

If you're running TokenFront locally rather than through the hosted app, you'll instead see a Download CloudFormation Template button. In that case: go to CloudFormation in your AWS Console, choose Create stack, then Upload a template file, select the downloaded file, name the stack TokenFront-Bedrock-Access, and click through to Create stack.

Step 2: Copy the credentials into TokenFront

1. Once the stack finishes, open its Outputs tab in the AWS Console.
2. Copy the AccessKeyId value and paste it into TokenFront's Access Key ID field.
3. Copy the SecretAccessKey value and paste it into the Secret Access Key field.
4. Confirm the region matches what you selected in Step 1.
5. Save.

The first sync takes 30–90 seconds. After that, TokenFront checks in periodically on its own.

If the connection shows "Key Error"

Confirm the CloudFormation stack finished creating successfully (check the AWS Console for its status) and that you copied both values from the Outputs tab exactly, with no extra spaces.