When you need AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY for Amazon Bedrock

You can create AWS access keys in the AWS IAM Console. Below are the step to create AWS Access Keys:

1. AWS Management Console

Go to https://console.aws.amazon.com → Sign in to your AWS account → Navigate to IAM service → Click Users in the left sidebar → Select your username (or create a new user) → Go to Security credentials tab → Click Create access key → Choose Application running outside AWS → Copy the Access Key ID and Secret Access Key

2. Required Permissions for Bedrock

The user/role needs this IAM policy:

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Allow",
           "Action": [
               "bedrock:InvokeModel",
               "bedrock:InvokeModelWithResponseStream",
               "bedrock:ListFoundationModels"
           ],
           "Resource": "*"
       }
   ]
}

3. Alternative: Use AWS CLI

If you have AWS CLI configured

aws iam create-access-key --user-name your-username

4. Security Best Practices

• Create a dedicated user for the API server
• Attach minimal required permissions (Bedrock only)
• Set up access key rotation
• Never commit keys to code repositories

5. For Production

Consider using IAM Roles instead of access keys:
• ECS Task Roles (if using ECS)
• EC2 Instance Profiles (if using EC2)
• More secure than hardcoded keys

Once created, set these as environment variables on your remote server.