Connect to Amazon Bedrock

This page provides step-by-step instructions for connecting Kibana to large language models (LLMs) in Amazon Bedrock. You’ll first need to configure AWS, then connect Kibana to Amazon Bedrock.

Note

All models in Amazon Bedrock's Claude model group are supported.

Configure AWS

Configure an IAM policy

First, configure an IAM policy with the necessary permissions:

  1. Log into the AWS console and search for Identity and Access Management (IAM).

  2. From the IAM menu, select Policies → Create policy.

  3. To provide the necessary permissions, paste the following JSON into the Specify permissions menu.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": "*"
        }
    ]
}
    Note

    These are the minimum required permissions. IAM policies with additional permissions are also supported.

  4. Click Next. Name your policy.

The following video demonstrates these steps (click to watch).

azure-openai-configure-model-video

Configure an IAM User

Next, assign the policy you created to a new user:

  1. Return to the IAM menu. Select Users from the navigation menu, then click Create User.
  2. Name the user, then click Next.
  3. Select Attach policies directly.
  4. In the Permissions policies field, search for the policy you created earlier, select it, and click Next.
  5. Review the configuration then click Create user.

The following video demonstrates these steps (click to watch).

bedrock-iam-video

Create an access key

Create the access keys that Elastic uses to authenticate with Amazon Bedrock:

  1. Return to the IAM menu. Select Users from the navigation menu.
  2. Search for the user you created, and click its name.
  3. Go to the Security credentials tab.
  4. Under Access keys, click Create access key.
  5. Select Third-party service, check the box under Confirmation, click Next, then click Create access key.
  6. Click Download .csv file to download the key. Store it securely.

The following video demonstrates these steps (click to watch).

bedrock-accesskey-video

Connect Kibana to Amazon Bedrock

Create an inference endpoint so that Kibana can use models from Amazon Bedrock. AI features in Kibana can use only endpoints with the chat_completion task type. For more information about adding endpoints, refer to External inference.

  1. Go to the External inference page by using the navigation menu or the global search field.
  2. Select Add endpoint.
  3. Select Amazon Bedrock as the service.
  1. For Provider, select the provider of your model, for example Anthropic. For Model, enter the model ID.
  2. For Region, enter the AWS region where your model is available.
  3. Enter the access key and secret key that you generated earlier.
  4. Select the chat_completion task type, then select Save.

Create an Amazon Bedrock connector so that Kibana can use Amazon Bedrock models.

  1. Log in to Kibana.

  2. Find the Connectors page in the navigation menu or use the global search field. Then click Create Connector, and select Amazon Bedrock.

  3. Name your connector.

  4. (Optional) Configure the Amazon Bedrock connector to use a different AWS region where Anthropic models are supported by editing the URL field, for example by changing us-east-1 to eu-central-1.

  5. (Optional) Add one of the following strings if you want to use a model other than the default. These model IDs should have a prefix of us. or eu., depending on your region, for example us.anthropic.claude-3-5-sonnet-20240620-v1:0 or eu.anthropic.claude-3-5-sonnet-20240620-v1:0.

    • Sonnet 3.5: us.anthropic.claude-3-5-sonnet-20240620-v1:0 or eu.anthropic.claude-3-5-sonnet-20240620-v1:0
    • Sonnet 3.5 v2: us.anthropic.claude-3-5-sonnet-20241022-v2:0 or eu.anthropic.claude-3-5-sonnet-20241022-v2:0
    • Sonnet 3.7: us.anthropic.claude-3-7-sonnet-20250219-v1:0 or eu.anthropic.claude-3-7-sonnet-20250219-v1:0
    • Haiku 3.5: us.anthropic.claude-3-5-haiku-20241022-v1:0 or eu.anthropic.claude-3-5-haiku-20241022-v1:0
    • Opus: us.anthropic.claude-3-opus-20240229-v1:0 or eu.anthropic.claude-3-opus-20240229-v1:0

  6. Enter the Access Key and Secret that you generated earlier, then click Save.

    Your LLM connector is now configured. For more information on using Elastic AI Assistant, refer to AI Assistant.

Important

If you’re using provisioned throughput, your ARN becomes the model ID, and the connector settings URL value must be encoded to work. For example, if the non-encoded ARN is arn:aws:bedrock:us-east-2:123456789102:provisioned-model/3Ztr7hbzmkrqy1, the encoded ARN would be arn%3Aaws%3Abedrock%3Aus-east-2%3A123456789102%3Aprovisioned-model%2F3Ztr7hbzmkrqy1.

The following video demonstrates these steps (click to watch).

bedrock-configure-model-video