AWS Bedrock with .NET: Getting Started

Use this for quick local testing with temporary credentials (e.g., from AWS STS or temporary session tokens).

SessionAWSCredentials GetCredentials()
{
    // ⚠️ NEVER hardcode credentials in production!
    string accessKey = "<your-access-key>";
    string secretKey = "<your-secret-key>";
    string sessionToken = "<your-session-token>";
    return new SessionAWSCredentials(accessKey, secretKey, sessionToken);
}
                

Use static IAM user credentials for simple scenarios, but this method is less secure for production.

BasicAWSCredentials GetBasicCredentials()
{
    string accessKey = Environment.GetEnvironmentVariable("AWS_ACCESS_KEY_ID");
    string secretKey = Environment.GetEnvironmentVariable("AWS_SECRET_ACCESS_KEY");
    
    if (string.IsNullOrWhiteSpace(accessKey) || string.IsNullOrWhiteSpace(secretKey))
        throw new InvalidOperationException("AWS credentials not found in environment variables.");
    
    return new BasicAWSCredentials(accessKey, secretKey);
}
                

The most convenient approach for local development is the AWS shared credentials file. When you run aws configure, the CLI writes your credentials to ~/.aws/credentials. The AWS SDK for .NET automatically reads from this file through its default credential resolution chain—no extra code required.

# ~/.aws/credentials
[default]
aws_access_key_id     = YOUR_ACCESS_KEY_ID
aws_secret_access_key = YOUR_SECRET_ACCESS_KEY

[bedrock-dev]
aws_access_key_id     = YOUR_DEV_ACCESS_KEY_ID
aws_secret_access_key = YOUR_DEV_SECRET_ACCESS_KEY
                

To use the default profile, simply instantiate the client without passing credentials—the SDK picks it up automatically:

// SDK automatically resolves credentials from ~/.aws/credentials [default] profile
var bedrockClient = new AmazonBedrockClient(RegionEndpoint.USEast1);
                

To use a named profile explicitly at runtime, use CredentialProfileStoreChain:

var chain = new CredentialProfileStoreChain(); // reads ~/.aws/credentials
if (chain.TryGetAWSCredentials("bedrock-dev", out AWSCredentials credentials))
{
    var bedrockClient = new AmazonBedrockClient(credentials, RegionEndpoint.USEast1);
}
                

This is the recommended approach for production applications running on EC2. The SDK automatically retrieves credentials from the instance metadata without any code changes.

// No credentials needed! The SDK automatically uses the EC2 instance role.
var bedrockClient = new AmazonBedrockClient(RegionEndpoint.USEast1);
var runtimeClient = new AmazonBedrockRuntimeClient(RegionEndpoint.USEast1);
                

To create an EC2 instance profile role with the minimal permissions needed to list models and invoke them:

Step 1: Create an IAM Role

1. Go to IAM console → Roles → Create Role
2. Select "AWS service" → "EC2" as the trusted entity
3. Click "Create Role"

Step 2: Add Inline Policy with Required Permissions

Once the role is created, add this inline policy to grant Bedrock permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels",
        "bedrock:GetFoundationModel"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:*:*:foundation-model/*"
    }
  ]
}
                

Step 3: Attach the Role to Your EC2 Instance

1. Go to EC2 console → Instances → Select your instance
2. Right-click → Security → Modify IAM role
3. Select the role you created
4. Click "Update IAM role"

Step 4: Use in Your .NET Code

No code changes needed! The SDK automatically picks up the EC2 instance role:

var bedrockClient = new AmazonBedrockClient(RegionEndpoint.USEast1);
var runtimeClient = new AmazonBedrockRuntimeClient(RegionEndpoint.USEast1);
                

If you're getting permission errors, check these common issues:

• UnauthorizedException or AccessDeniedException: Your credentials don't have Bedrock permissions. Double-check the IAM policy above is attached to your role/user.
• InvalidUserID or SignatureDoesNotMatch: Your AWS credentials are incorrect or expired. Re-verify your access key and secret key.
• EC2 instance can't access Bedrock: The instance profile role isn't attached, or the IAM policy is missing. Check the instance details in AWS console.
• Region issues: Ensure Bedrock is available in your region. Not all AWS regions support Bedrock yet.

Debug tip: Use the AWS CLI to test credentials before using them in your .NET app:

aws bedrock list-foundation-models --region us-east-1
                

Note: The same IAM permissions can also be set up using CloudFormation or AWS CDK if you prefer infrastructure-as-code approaches.