Bring Your Own Bedrock

What it does

Kimi K3 (moonshotai/Kimi-K3) calls run on your own Amazon Bedrock account instead of Brainbase's hosted provider. AWS bills those calls to you, and they use no Brainbase credits. Sandbox time still uses credits, and a team with no credits is still blocked from running tasks.

This applies to Kimi K3 only. Every other model keeps its current provider. With no credential saved, Kimi K3 runs exactly as it does today.

When a credential applies, Brainbase never falls back to its hosted provider. If your AWS account refuses a call, the turn fails with the reason, and you fix it on the AWS side or in the credential.

Where to set it

Each scope holds one credential. For every Kimi K3 call, Brainbase uses the most specific credential that applies: the agent's credential, then the task owner's user credential, then the org credential. A failing credential never falls back to a less specific one.

• Task owner: The task owner is fixed when the task is created. A teammate who sends messages in someone else's task uses the task owner's credential.
• Override switch: Org owners and admins can block member (user) and agent overrides. Overrides are allowed by default. When they are blocked, only the org credential is used.
• Leaving an org: When a user leaves an org, their user credential for that org is deleted.
• Changes apply on the next call: A new, replaced, or deleted credential takes effect on the next model call, including inside a thread that is already running.
• Admin overrides table: Org owners and admins see a table of the user and agent credentials in the org: who saved each one, its region, and the AWS account when known. They never see the secret.
• Which source served a task: Each task shows which credential served its Kimi K3 turns, including turns that failed at AWS. The agent page shows which source Kimi K3 will use when you start a task.

Credentials

The form accepts one of two credential types:

• IAM access key: An access key ID and secret access key, with an optional session token. A session token means the credentials are temporary and expire within hours, so the form warns about it. Replace them when they expire.
• Bedrock API key: A key created in the Amazon Bedrock console. It works only in the region it was created in.

A saved secret is never shown again. Brainbase shows the credential type, a masked key hint, the region, the data location, who saved it and when, and the last test result. For IAM keys it also shows the AWS account ID to people who can manage that credential and to org admins. For Bedrock API keys the account is shown as unknown.

Replacing or deleting a credential destroys the old secret in Brainbase. If two people save the same scope at the same time, the later save is refused with a conflict message. Creating, replacing, deleting, and testing a credential, and moving an agent with a credential to another org, are recorded in an audit trail with the scope, the masked key hint, and who made the change when it was made in Brainbase. Changing the override switch is recorded with who changed it and the org.

Region and data location

Pick the region of your AWS account and a data location. The form offers only the data locations that are valid for the region you selected.

The 32 source regions available with Global:

Test connection

Test connection runs automatically after every save, and you can run it again yourself. One test runs at a time per credential, each person can run 5 a minute, and an org (or an agent's credential) can run 50 a day. A test that hits a limit says when to retry, and a test after a save is skipped when the limit is reached. It makes one minimal Kimi K3 call on your account, which costs a fraction of a cent, and shows either success or the error from the table below. For IAM keys, a successful test also shows the AWS account ID when AWS reports it; if that lookup fails, the test still passes without an account ID.

IAM policies

The policies below grant only what Kimi K3 calls need. Treat them as starting points and adapt them to your account's own policy conventions. Replace <source-region> with the region you saved in Brainbase and <account-id> with your 12-digit AWS account ID.

Each policy allows bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream on the Kimi K3 inference profile, and on the foundation models that profile routes to, only when the call comes through that profile.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeKimiK3InferenceProfile",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:<source-region>:<account-id>:inference-profile/global.moonshotai.kimi-k3"
    },
    {
      "Sid": "InvokeKimiK3FoundationModels",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/moonshotai.kimi-k3",
        "arn:aws:bedrock:::foundation-model/moonshotai.kimi-k3"
      ],
      "Condition": {
        "StringLike": {
          "bedrock:InferenceProfileArn": "arn:aws:bedrock:<source-region>:<account-id>:inference-profile/global.moonshotai.kimi-k3"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeKimiK3InferenceProfile",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:<source-region>:<account-id>:inference-profile/us.moonshotai.kimi-k3"
    },
    {
      "Sid": "InvokeKimiK3FoundationModels",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:us-east-1::foundation-model/moonshotai.kimi-k3",
        "arn:aws:bedrock:us-east-2::foundation-model/moonshotai.kimi-k3",
        "arn:aws:bedrock:us-west-1::foundation-model/moonshotai.kimi-k3",
        "arn:aws:bedrock:us-west-2::foundation-model/moonshotai.kimi-k3",
        "arn:aws:bedrock:ca-central-1::foundation-model/moonshotai.kimi-k3",
        "arn:aws:bedrock:ca-west-1::foundation-model/moonshotai.kimi-k3"
      ],
      "Condition": {
        "StringLike": {
          "bedrock:InferenceProfileArn": "arn:aws:bedrock:<source-region>:<account-id>:inference-profile/us.moonshotai.kimi-k3"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeKimiK3InferenceProfile",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:<source-region>:<account-id>:inference-profile/in.moonshotai.kimi-k3"
    },
    {
      "Sid": "InvokeKimiK3FoundationModels",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:ap-south-1::foundation-model/moonshotai.kimi-k3",
        "arn:aws:bedrock:ap-south-2::foundation-model/moonshotai.kimi-k3"
      ],
      "Condition": {
        "StringLike": {
          "bedrock:InferenceProfileArn": "arn:aws:bedrock:<source-region>:<account-id>:inference-profile/in.moonshotai.kimi-k3"
        }
      }
    }
  ]
}

Two additions depend on how you connect:

• Bedrock API keys: Add a statement that allows bedrock:CallWithBearerToken for the IAM user or role that owns the key.
• Agents on the Codex harness: Codex calls Bedrock through the Responses API. Also allow bedrock:InvokeModel on arn:aws:bedrock:<source-region>:<account-id>:project/default.

[
  {
    "Sid": "BedrockApiKeyAuth",
    "Effect": "Allow",
    "Action": "bedrock:CallWithBearerToken",
    "Resource": "*"
  },
  {
    "Sid": "CodexResponsesApi",
    "Effect": "Allow",
    "Action": "bedrock:InvokeModel",
    "Resource": "arn:aws:bedrock:<source-region>:<account-id>:project/default"
  }
]

Supported agent types

Kimi K3 on your Bedrock account works with OpenCode, Pi, Kafka, Qwen, and Codex agents. Claude Code and Kafka Legacy agents cannot use it: while a credential applies, their Kimi K3 turns fail with a message that names the supported agent types. Either remove the credential or switch to a supported agent type.

Errors and fixes

When AWS refuses a call, the turn ends with a message mapped from the AWS error. The message never contains secret material, account IDs, or ARNs. Context-length errors still trigger the harness's normal context compaction.

Throttling and temporary capacity errors are retried automatically before the turn fails. Quota, authentication, and permission errors are not retried.

Limits and data flow

• Title generation and compaction: Both run on Brainbase's hosted Claude and use Brainbase credits. Some conversation content is therefore still processed outside your chosen data location.
• Automatic model selection: When auto model selection picks Kimi K3, the call uses your Bedrock account.
• Task owner's credential: A teammate's messages in someone else's task use the task owner's credential.
• Orchestrations and subagents: Orchestration members and subagents resolve their own credentials. Content passed between them can cross from one AWS account to another.
• Org credential: An org credential lets every member's agents spend on that AWS account.
• Sandboxes: Your credential is never placed in the agent's sandbox. It is used only when Brainbase makes the model call.

Removing a credential

Deleting or replacing a credential in Brainbase does not revoke it in AWS. To stop a key from working, disable or rotate it in IAM, or delete the Bedrock API key in the Bedrock console. Encrypted copies of a deleted credential can persist in Brainbase database backups until the backup retention window ends.