Pydantic AI (AWS Bedrock) Connection¶

The pydanticai_bedrock connection type configures access to AWS Bedrock via the pydantic-ai framework. It backs PydanticAIBedrockHook, the dedicated subclass of PydanticAIHook for Bedrock’s AWS-style credentials — IAM keys, a bearer token, or the default credential chain — none of which fit the plain api_key + base_url shape that the generic Pydantic AI Connection connection assumes. All fields live in extra; the password and host fields are hidden in the connection form.

Note

This connection type was previously named pydanticai-bedrock.

Connections stored as a URI or as JSON need no change: - is how _ is encoded in a URI scheme, so pydanticai-bedrock is decoded to pydanticai_bedrock on read and resolves as before. That covers AIRFLOW_CONN_* environment variables and secrets backends such as HashiCorp Vault, AWS Secrets Manager and GCP Secret Manager.

A connection whose type is stored verbatim does need updating, because the hyphen is preserved and no longer matches a registered hook. That means rows in the metadata database, including any created through the UI, and connections imported in object form from a local file:

airflow connections get <conn_id> -o json    # confirm conn_type is 'pydanticai-bedrock'
airflow connections delete <conn_id>
airflow connections add <conn_id> --conn-type pydanticai_bedrock ...

In the UI, edit the connection and re-pick its type.

Default Connection IDs¶

The PydanticAIBedrockHook uses pydanticai_bedrock_default by default.

Configuring the Connection¶

All fields below are extra (JSON) fields.

Model

Bedrock model identifier (e.g. bedrock:us.anthropic.claude-opus-4-5).

A bare name is automatically resolved to bedrock:<name> – Bedrock is this connection type’s own platform. This includes Bedrock’s version-suffixed ids, which contain a : of their own (e.g. us.anthropic.claude-opus-4-6-v1:0): that : is not a recognized pydantic-ai provider name, so it does not count as an existing platform prefix, and the whole bare id still gets bedrock: prepended (bedrock:us.anthropic.claude-opus-4-6-v1:0). Writing the bedrock: prefix yourself has the same effect and is still accepted.

AWS Region

AWS region (e.g. us-east-1). Falls back to the AWS_DEFAULT_REGION environment variable.

AWS Access Key ID

IAM access key. Leave empty to use instance role / environment credential chain.

AWS Secret Access Key

IAM secret key.

AWS Session Token

Temporary session token (optional).

AWS Profile Name

Named AWS credentials profile (optional).

Bearer Token

AWS bearer token (alt. to IAM key/secret). Falls back to the AWS_BEARER_TOKEN_BEDROCK environment variable.

Custom Endpoint URL

Override the Bedrock runtime endpoint URL (optional).

Read Timeout (s)

boto3 read timeout in seconds (float, optional).

Connect Timeout (s)

boto3 connect timeout in seconds (float, optional).

Fallback Connections

Other connection IDs to fail over to, in order, while this provider is unavailable. Stored in extra["fallback_conn_ids"]. Entries may name any pydanticai connection type, so one chain can span vendors. See Provider fallback.

Credentials¶

The hook passes every field you set on to BedrockProvider together; when more than one credential source is set at once, the bearer token (api_key) takes precedence over IAM keys:

A bearer token (api_key, mapped to AWS_BEARER_TOKEN_BEDROCK) — used first if set.
IAM keys (aws_access_key_id + aws_secret_access_key, optionally aws_session_token) — used only when no bearer token is set.
The environment-variable / instance-role credential chain (AWS_PROFILE, IAM role, …) when none of the fields above are set.

Examples¶

IAM instance role / environment credential chain (recommended)

Leave the AWS credential fields empty and let boto3 resolve credentials from the instance role or environment:

{
    "conn_type": "pydanticai_bedrock",
    "extra": "{\"model\": \"bedrock:us.anthropic.claude-opus-4-5\", \"region_name\": \"us-east-1\"}"
}

Explicit IAM keys

{
    "conn_type": "pydanticai_bedrock",
    "extra": "{\"model\": \"bedrock:us.anthropic.claude-opus-4-5\", \"region_name\": \"us-east-1\", \"aws_access_key_id\": \"AKIA...\", \"aws_secret_access_key\": \"...\"}"
}

Bearer token

{
    "conn_type": "pydanticai_bedrock",
    "extra": "{\"model\": \"bedrock:us.anthropic.claude-opus-4-5\", \"api_key\": \"<bearer-token>\"}"
}