Context7 On-Premise can call AWS Bedrock directly for parsing, source-code documentation, reranking, and embeddings. LiteLLM and other OpenAI-compatible proxies are not required.
Native AWS Bedrock support is available in Context7 Enterprise v1.3.9 and later.
Prerequisites
- Enable access to the Claude and Amazon Titan models you plan to use in the selected AWS Region.
- Allow
bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream for the models you use. For a geographic cross-region inference profile, allow both the inference-profile ARN and the underlying foundation-model ARN in the source Region and every destination Region.
- Give the Context7 container network access to the regional Bedrock Runtime endpoint.
Authenticate
A workload IAM role is recommended. Context7 uses the standard AWS SDK credential chain, including environment credentials, web identity, shared profiles, and ECS or EC2 role credentials.
Workload role
Environment credentials
Shared AWS profile
Bedrock API key
Attach an IAM role to the ECS task, EC2 instance, or Kubernetes service account that runs Context7. Leave the API Key field blank in Context7.
Pass credentials to the container:Omit AWS_SESSION_TOKEN for long-lived credentials. The container image sets HOME=/data/home, so mount the AWS files there and select the profile:A profile that uses credential_process also requires its helper executable inside the container image.Ensure the mounted files are readable by the UID that runs the container, especially when using Docker --user or Kubernetes runAsUser. Paste a Bedrock API key into Context7’s API Key field, or pass it as AWS_BEARER_TOKEN_BEDROCK. The value is used for both Claude and Titan when both providers are set to Bedrock.AWS_BEARER_TOKEN_BEDROCK takes precedence over the standard AWS credential chain. Remove an expired or revoked value from the container environment to fall back to a workload role or shared profile.Console-generated short-term keys expire with the session or after at most 12 hours. A key saved in Context7 stops working when it expires, so use a workload role for unattended production deployments. AWS positions long-term Bedrock API keys for exploration and development rather than production workloads.
The AWS credential chain does not skip credentials merely because they are invalid. AWS_BEARER_TOKEN_BEDROCK takes precedence over SigV4 authentication, and AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY take precedence over a shared profile. Remove stale environment credentials if a valid role or profile unexpectedly returns The security token included in the request is invalid.
Configure Context7
Configure the LLM
In the setup wizard or Settings → AI & Models, select AWS Bedrock. Enter the raw Bedrock model or inference-profile ID—without an amazon-bedrock/ prefix—and select its AWS Region.For example: us.anthropic.claude-haiku-4-5-20251001-v1:0.
Configure embeddings
Select Same as LLM to use Bedrock embeddings, or select AWS Bedrock separately. Use an Amazon Titan model such as amazon.titan-embed-text-v2:0.The LLM and embedding configurations share one AWS Region. If both use Bedrock, choose models available from the same configured region.
Test and verify
Test both connections, save the configuration, and parse a small repository. Query the resulting library to verify that parsing and semantic search both work.
Model IDs prefixed with values such as us., eu., apac., or global. are cross-region inference profiles. They can route requests among supported regions. The AWS Region field selects the Bedrock endpoint; it does not constrain a cross-region profile to that single region.
Private connectivity
Create the com.amazonaws.<region>.bedrock-runtime interface VPC endpoint for AWS PrivateLink. With private DNS enabled, leave Context7’s optional Bedrock endpoint field blank. Without private DNS, enter the full endpoint URL, such as:
The endpoint, configured AWS Region, and selected models must agree. Credential discovery may also need access to STS, container or instance metadata, or another identity endpoint, depending on the authentication method.
An offline Context7 license removes the Context7 Cloud license check, but Bedrock still requires AWS network connectivity. Content sent for parsing, embedding, reranking, or source-code documentation is processed by the selected Bedrock models.
Changing embedding models
Bedrock indexes are stored separately from existing OpenAI or Gemini vector indexes because their dimensions can differ. After changing the embedding provider or model, refresh the libraries that should be available under the new embedding configuration. 
