AWS Bedrock Connector
The AWS Bedrock connector imports activity from Amazon Bedrock into an ANTS Platform project as traces, without changes to your agents. It is one of the AI Studio connectors.
| Resource type | Collection method | What it reads |
|---|---|---|
| Bedrock Agent | CloudWatch Logs | Trace events from the CloudWatch Logs log group your agent's traces are written to |
| Bedrock Flow | Flow execution API | Completed executions of a Bedrock Flow and their events |
Each imported trace has generation observations for model calls and span observations for the other processing steps.
The connector also lists every Bedrock agent and flow in its AWS account and region and adds them to the agent inventory, including those that have never run. See Agent inventory.
Self-hosted deployments need the Bedrock connector service
(bedrockConnector.enabled: true in the Helm values). It is off by default.
Prerequisites
- An IAM user with an access key that has the permissions below.
- For a Bedrock Agent: the agent ID and a CloudWatch Logs log group that receives the agent's trace events.
- For a Bedrock Flow: the flow ID, and optionally the flow alias ID.
- In ANTS Platform, write access to AI Studio Connectors (the Owner role has it).
IAM permissions
| Permission | Why |
|---|---|
logs:FilterLogEvents | Read log events from the agent's log group |
bedrock:GetAgent | Read the agent name when the connector is created |
For the agent inventory, also grant:
| Permission | Why |
|---|---|
bedrock:ListAgents | List every Bedrock agent in the region |
bedrock:ListFlows | List every Bedrock flow in the region |
Scope the policy to the specific log group, agent or flow where you can. The list permissions apply to the account and region. The create dialog shows the permissions needed for the method you pick.
Create the connector
Open AI Studio connectors
Go to Project Settings > Integrations, scroll to AI Studio connectors and add an AWS Bedrock connector.
Choose the resource type
Pick Bedrock Agent or Bedrock Flow in Resource Type.
Enter credentials
| Field | Notes |
|---|---|
| AWS Access Key ID | Required |
| AWS Secret Access Key | Required |
| AWS Region | The region of the agent or flow. Default us-east-1. |
Enter the resource details
| Field | Notes |
|---|---|
| Collection Method | CloudWatch Logs |
| Agent ID | For example D5XC2YYWXW |
| Log Group Name | Default /aws/bedrock/agents/<agentId> |
Set the sync frequency and save
Choose Sync Frequency (every 5, 15, 30 or 60 minutes) and create the connector. ANTS Platform reads the agent or flow name to check the credentials and uses it as the display name.
Sync behaviour
- CloudWatch Logs: the first sync reads all events still retained in the log group. Later syncs read only events after the last checkpoint.
- Flows: each sync imports completed executions that ended after the last checkpoint.
- Rate limiting from AWS is retried with backoff.
- See results under View sync logs on the connector row.
Agent inventory
On every sync, the connector lists all Bedrock agents and flows in its AWS
account and region with bedrock:ListAgents and bedrock:ListFlows, and adds
each one to the AI Agent Center.
Agents appear before they first run, so the inventory covers every agent in
the account, not only the active ones.
- An agent or flow found in the inventory that has never sent a trace is marked Not seen running. Dormant agents are often the forgotten, risky ones.
- Once the agent runs and its traces are imported, the mark is cleared.
- Inventory runs for every Bedrock connector in the project. One connector per account and region is enough to list all of its agents and flows.
Troubleshooting
- Create fails with "Failed to fetch agent name from Bedrock". The key
lacks
bedrock:GetAgent, or the agent ID or region is wrong. - Create fails with "Failed to fetch flow name from Bedrock". The key
lacks
bedrock:GetFlow, or the flow ID or region is wrong. - Syncs succeed but import nothing. Check that the log group name is right and that it receives the agent's trace events.
- Last sync never changes. On self-hosted deployments, check that the Bedrock connector service is running.
- Agents that have not run are missing from the AI Agent Center. The key
lacks
bedrock:ListAgentsorbedrock:ListFlows. The sync log shows the access error.