AWS connection
One AWS account. In the connection picker it is AWS. It serves two things at once: the AgentCore runtimes the action below invokes, and the Bedrock models AI steps can run on.
Powers these nodes
It also serves as an AI provider account for the built-in AI Agent action, the AI Judgment condition, and your default model.
Fields
| Field | Required | Description |
|---|---|---|
| Name | Yes | A name for the account. It labels the account everywhere it is offered, so say whose account it is. |
| Region | Yes | The region this account's models and runtimes are invoked in. |
| Credentials | Yes | Access Key or Server Identity—see below. |
Region does more work than it looks like. A model is available per region, and an agent runtime is only reachable in the region it lives in, so changing the region changes both what the Model field offers and which runtimes an AgentCore step can pick.
Credentials
| Type | What it takes |
|---|---|
| Access Key | An Access Key ID and Secret Access Key for a user in that account. The secret is stored encrypted and never logged. |
| Server Identity | Nothing. It signs with the AWS identity the server already runs as. Whether it works depends on how the server was provisioned, and it is offered only where the deployment allows accounts to authenticate this way. |
Even with Server Identity, this is still an account record of its own, with its own name and region—which is what separates it from a step falling back to the deployment's configuration.
Connecting
Credential-based: there is no Connect button. Fill in the region and credentials and save.
The Model field on anything pointing at this account then offers the text-generating Bedrock inference profiles the account can serve in the chosen region.