Accessing Bedrock With Command Line Part 1

In this lesson we’ll show how to access Amazon Bedrock from your terminal using the AWS Command Line Interface (AWS CLI). Working from a developer workstation (for example, a terminal inside Visual Studio Code) reduces friction compared to switching back and forth to the AWS Management Console. It also speeds up iterative testing and makes automation straightforward. We will:

Introduce the AWS CLI as the primary tool for Bedrock interaction.
Explain the difference between control-plane and inference/runtime Bedrock commands.
Cover common authentication options for securely using the CLI.
Summarize best practices and next steps.

First, consider the problem this solves. If you frequently test prompts or compare multiple foundation models, switching between an IDE and the browser-based console slows development. Automation—such as running the same prompt across several models—is easiest from the terminal, but that requires reliable and secure authentication and a clear distinction between management and runtime APIs.

A slide titled "Problem: Testing and Automation Is Slow in AWS Console" with four numbered panels. Each panel lists pain points: developers need fast model testing, switching between console and code slows work, automation requires CLI access, and teams need secure CLI authentication.

Solution: use the AWS CLI The AWS CLI runs on Windows, Linux, and macOS and lets you interact with AWS services from a terminal. This approach provides:

Faster iterative testing without switching to a browser.
Automation via Bash, PowerShell, or CI/CD pipelines that call the AWS CLI.
Secure access patterns using AWS credential mechanisms such as named profiles, environment variables, IAM roles, or SSO.

An infographic titled "Solution: AWS Command Line Tool" showing four colored panels that list benefits: Direct AWS Interaction, Faster Testing, Automation & Scripting, and Secure CLI Access. Each panel includes a small icon and brief explanatory text.

AWS CLI basics The AWS CLI is consistent across services. The general form is:

aws <service> <operation> [parameters]

Examples:

aws s3 ls
aws ec2 describe-instances
aws ec2 describe-instances --region eu-west-1

The first token after aws selects the service (for example, s3, ec2), the second token is the operation (for example, ls, describe-instances), and flags such as --region scope the command.

Bedrock-specific CLI considerations When using the AWS CLI with Bedrock, there are two distinct service targets depending on your goal:

Control plane (management): aws bedrock <operation> ...
Use this for listing available foundation models, managing access, or configuring guardrails and knowledge bases.
Inference/runtime: aws bedrock-runtime <operation> ...
Use this for sending prompts to models and receiving outputs, embeddings, or multi-turn conversation messages.

Examples Control plane — list foundation models (operation names may vary by CLI version):

aws bedrock list-foundation-models --region eu-west-1

Inference/runtime — invoke a model (flags may vary by CLI version):

aws bedrock-runtime invoke-model \
  --model-id MODEL-ID \
  --body '{"input":"Hello"}' \
  --content-type 'application/json' \
  --region eu-west-1

Common runtime subcommands

invoke-model — lower-level call for sending a payload to a specific model and receiving the response.
converse — higher-level method designed for managing multi-turn conversations and consistent message structure across models. converse can simplify conversation flow handling and help with token accounting for context windows.

Why the control-plane vs runtime distinction matters

Use aws bedrock for administrative actions: listing models, configuring guardrails, or managing knowledge bases.
Use aws bedrock-runtime for inference: sending prompts, receiving outputs, or managing multi-turn conversations.

Authentication and secure access Before running Bedrock commands, authenticate the AWS CLI to an identity that has Bedrock permissions. Common options:

Authentication method	When to use it	Example / notes
Named profile	Local development with long-lived credentials per role/person	`aws configure --profile my-dev-profile`
Environment variables	Short-lived or CI environments	Set `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`
IAM roles (EC2, ECS, Lambda)	When running from AWS compute that can assume a role automatically	No key material on disk; recommended for production compute
AWS SSO / IAM Identity Center	Federated access for interactive users; reduces long-lived keys	See AWS SSO docs

Example: configure the CLI with a named profile

aws configure --profile my-dev-profile

Then use that profile when invoking Bedrock runtime commands:

aws bedrock-runtime invoke-model \
  --model-id MODEL-ID \
  --body '{"input":"Hi"}' \
  --region eu-west-1 \
  --profile my-dev-profile

When running inference, be mindful of token usage. Tokens are consumed both for prompt/context tokens and for tokens produced in model responses. Tokenization affects context window limits and cost for on-demand model invocations. Consider smaller prompts, batching, or model selection to control costs.

Security note

Avoid committing credentials to source control. Use IAM roles, SSO, or environment variables for short-lived credentials. Rotate keys regularly and apply least-privilege IAM policies for Bedrock operations.

Key takeaways

The AWS CLI is a fast, scriptable way to interact with Amazon Bedrock from a developer workstation.
Use aws bedrock for control-plane management and aws bedrock-runtime for inference and multi-turn conversations.
Authenticate securely using named profiles, environment variables, IAM roles, or AWS SSO, and monitor token usage (context windows and cost).

Next steps (hands-on) A follow-up hands-on demonstration will step through Bedrock runtime calls using the AWS CLI and include an example using converse to manage a multi-turn conversation and token accounting. Links and references

Amazon Bedrock overview — https://docs.aws.amazon.com/bedrock/latest/ug/overview.html
AWS CLI User Guide — https://docs.aws.amazon.com/cli/latest/userguide/
AWS Single Sign-On / IAM Identity Center — https://docs.aws.amazon.com/singlesignon/latest/userguide/

Introduction to Gen AI and LLMs

Introduction to Amazon Bedrock

Getting Started With Amazon Bedrock

Foundation Models in Amazon Bedrock

Basic Concepts of Prompt Engineering

Introduction to Text Generation With Amazon Bedrock

How Foundation Models Process Input

Extract Insights Using Prompt Engineering

Working With Different Task Types

Integrating Amazon Bedrock With Other AWS Services

Build a Marketing Email Generation Application

Introduction to Retrieval Augmentation With Bedrock Knowledge Bases

Best Practices and Optimization

Governance, Safety in Responsible AI

Security

Monitoring and Logging

Taking action with Bedrock Agents

Advanced Topics (Optional)

Final Project

Wrap Up

Accessing Bedrock With Command Line Part 1

Watch Video