AWS Bedrock

Register Amazon Bedrock as an LLM provider on SonarQube Server 2026.5, using the AWS credentials available to the server.

Use the AWS Bedrock provider type when your models run in Amazon Bedrock and SonarQube Server already has AWS credentials available in its own environment.

AWS Bedrock offers two ways to connect:

• AWS Bedrock Runtime: the native API, authenticated with an AWS identity. The rest of this page, up to Least privilege, covers this connection.
• AWS Bedrock Mantle: an OpenAI-compatible endpoint, authenticated with an API key or the same AWS identity. Register it with the dedicated AWS Bedrock Mantle provider type; see AWS Bedrock Mantle.

To select this provider and choose a model for an AI agent, see Selecting a provider and model for an agent; for the steps that apply to every provider type, see LLM providers.

How this provider type authenticates

This type has no endpoint and no API key: SonarQube Server does not store AWS credentials in the provider configuration, and instead uses the credentials available in its own environment.

Those credentials have to be available on two sides, not one:

• SonarQube Server, which uses them to verify the region and the model when you select a model for an agent
• Each agent host, which uses them to invoke the model when the agent runs

Give both the same AWS identity, or two identities that hold the same permissions on the models you use.

Supply the credentials through any of the standard AWS mechanisms:

• An EC2 instance profile
• An ECS task role
• IAM roles for service accounts (IRSA) on EKS
• The standard AWS environment variables

Prerequisites

• An AWS identity available to SonarQube Server and to your agent hosts, for example an EC2 instance profile, an ECS task role, or IAM roles for service accounts (IRSA) on EKS. Each side uses the credentials available in its own environment, so both need access to them.
• Access to the models you want to use, enabled in your AWS account for the region you're registering, and permission for that identity to invoke those models in that region.

Fields

Field	Required	What to enter
AWS region	Yes	The AWS region your models run in, for example eu-west-1

There's no endpoint field, because SonarQube Server derives the endpoint from the region. A region of eu-west-1 resolves to bedrock-runtime.eu-west-1.amazonaws.com, the AWS Bedrock Runtime endpoint. Use that full hostname when you add Bedrock to a firewall rule, an egress proxy, or an allowlist.

What happens when you save

Adding the provider runs no checks. SonarQube Server checks the region and the AWS permissions later, when you select a model for an agent, so complete that step to confirm your setup works.

Entering the model identifier

1. Find the model in the Amazon Bedrock console, in the region you registered.
2. Copy the model identifier exactly as Bedrock names it.
3. Go to the agent's page under Administration > Configuration > AI capabilities, paste the identifier into the model field, and select Save.

Least privilege

The AWS identity used by SonarQube Server and by your agent hosts needs these permissions:

• bedrock:InvokeModel
• bedrock:InvokeModelWithResponseStream

Scope the policy to the models and the region you use, rather than granting access to your whole account.

AWS Bedrock Mantle

Use the AWS Bedrock Mantle provider type to reach Bedrock through its OpenAI-compatible endpoint instead of the native Bedrock Runtime API.

Field	Required	What to enter
AWS region	Yes	The AWS region your models run in, for example eu-west-1
API key	No	A Bedrock API key. Leave it empty to authenticate with the AWS identity available to SonarQube Server instead.

SonarQube Server derives the endpoint from the region: https://bedrock-mantle.{region}.api.aws/v1. Unlike AWS Bedrock Runtime, SonarQube Server tests this connection when you save the provider.

If adding the provider fails, see Troubleshooting.