Hermes Agent Bedrock Setup: 7 Steps That Work (2026)

Hermes Agent Bedrock support is native, which means you pick "AWS Bedrock" inside hermes model and Hermes talks to Amazon Bedrock directly with your normal AWS credentials.

You don't need LiteLLM, a proxy or OpenRouter in the middle, because the official Hermes docs list bedrock as a built-in provider.

This post is the operator walkthrough, so you'll get the seven setup steps, the real config keys, the IAM permissions and the fixes for the errors AWS throws most often.

I need to be straight with you about one thing first.

I run Hermes every day on other providers, but I haven't published a Bedrock test of my own.

Everything below comes from the official Hermes AWS Bedrock guide, the Hermes source code in my own install (v0.21.4), and the AWS docs, all checked on 12 October 2026.

How Hermes Agent Bedrock Support Actually Works

Hermes is the harness, and Bedrock is one of the places the brain can live.

The docs say Hermes routes each model family through the API that serves it best.

Model family	Route Hermes uses	Why the docs say it does that
Anthropic Claude	The Anthropic SDK's Bedrock client	It keeps prompt caching, thinking budgets and adaptive thinking.
OpenAI GPT-5.5 and GPT-5.6	The Bedrock Mantle OpenAI Responses endpoint	Those models are Mantle-only on Bedrock.
Everything else, such as Nova, DeepSeek and Llama	The native Bedrock Converse API	It gives guardrails, inference profiles and streaming.

All three routes share the same AWS credentials and the same region setting.

That is the whole reason this is easier than a proxy.

You set it up once, and you can switch between Claude, Nova and Llama with the /model command.

What You Need Before You Start

• You need an AWS account with a valid payment method.
• You need a region where Bedrock offers the model you want.
• You need an IAM user, role or SSO identity that is allowed to call Bedrock.
• You need Hermes Agent installed, and my one-click Hermes setup walkthrough covers that part.
• You need the AWS CLI if you plan to authenticate on a laptop with aws configure or SSO.

You never need to paste an AWS secret into a chat window, and you shouldn't.

🔥 Want my exact Hermes Agent Bedrock Setup setup, step by step? Inside the AI Profit Boardroom you get step-by-step video trainings, my installable Agent OS and four coaching calls a week with 3,400+ members building real automations. → Join the AI Profit Boardroom

Hermes Agent Bedrock Setup In 7 Steps

Step 1: Pick your AWS region

The region decides which models you can call and where the request is processed.

Hermes reads the region in this order, according to the docs.

1. It reads bedrock.region in config.yaml first.
2. It reads the AWS_REGION environment variable second.
3. It reads the AWS_DEFAULT_REGION environment variable third.
4. It falls back to us-east-1 if none of those are set.

Choose the region your company already uses, unless the model you want isn't offered there.

Step 2: Make sure your account can use the model

AWS changed how this works, so old tutorials are out of date.

The AWS model access docs now say access to many Bedrock models is enabled by default when you have the right AWS Marketplace permissions.

The first time you call a third-party model, Bedrock starts the subscription in the background, and AWS says that can take up to 15 minutes.

Anthropic models have one extra step.

AWS says first-time customers must submit use case details for Anthropic models once per account or once at the organisation's management account.

You do that by selecting an Anthropic model in the model catalogue in the Bedrock console.

The identity that enables a Marketplace model for the first time needs aws-marketplace:Subscribe, aws-marketplace:Unsubscribe and aws-marketplace:ViewSubscriptions.

After the model is enabled, AWS says users don't need those Marketplace permissions to invoke it.

Step 3: Create a least-privilege IAM policy

The Hermes docs list the minimum permissions.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:ListFoundationModels",
        "bedrock:ListInferenceProfiles"
      ],
      "Resource": "*"
    }
  ]
}

The two Invoke actions are for inference, and the two List actions are for model discovery in the picker.

You only add bedrock:GetInferenceProfile if your default model is an application inference profile ARN.

Your security team can tighten the Resource line to specific model ARNs later.

The docs mention the managed AmazonBedrockFullAccess policy as the quick route on EC2, ECS and Lambda, but I'd start with the smaller policy above.

Step 4: Authenticate the machine, not the chat

Hermes uses the standard boto3 credential chain, so there is no Hermes-specific key to create.

On a laptop, the simplest route is a named profile.

aws configure --profile hermes
aws sts get-caller-identity --profile hermes

The second command proves the credentials work before Hermes is involved.

On AWS compute, attach an IAM role to the instance and skip keys completely.

The docs say Hermes detects the instance role automatically, so there is no .env work at all.

Hermes checks for credentials in this order, according to the troubleshooting section of the docs.

1. It checks AWS_BEARER_TOKEN_BEDROCK first.
2. It checks AWS_ACCESS_KEY_ID with AWS_SECRET_ACCESS_KEY second.
3. It checks AWS_PROFILE third.
4. It checks EC2 instance metadata fourth.
5. It checks ECS container credentials fifth.
6. It checks the Lambda execution role last.

Step 5: Install the Bedrock extra

Bedrock needs boto3, and Hermes ships it as an optional extra.

The docs give this exact command.

cd ~/.hermes/hermes-agent && python -c "import pm; pm.sync_venv(['bedrock'], explicit=True)"

Restart Hermes after it finishes.

If the setup wizard says it could not load the Bedrock adapter, the message in the source tells you to run hermes pm repair and restart.

Step 6: Choose AWS Bedrock in hermes model

hermes model

Choose "More providers...", then "AWS Bedrock".

The wizard shows whether it found AWS credentials, then asks for your AWS region.

It then asks you to choose an authentication method.

Option 1 is the IAM credential chain, and the wizard marks it as recommended.

Option 2 is a Bedrock API Key, which the wizard describes as useful when an admin hands keys out to a team.

Hermes then discovers the text models in your region and shows a picker with recommended models at the top.

Step 7: Check it and start chatting

hermes doctor
hermes chat

The docs say hermes doctor checks whether AWS credentials are available, whether boto3 is installed, whether the Bedrock API is reachable and how many models your region has.

You can also test a model for one session without touching your saved config.

AWS_PROFILE=hermes AWS_REGION=us-east-1 hermes chat --provider bedrock --model us.anthropic.claude-sonnet-4-6

🔥 Want help wiring Hermes into your own stack? Inside the AI Profit Boardroom, you get step-by-step Hermes tutorials, the installable Agent OS and four coaching calls a week where you can ask setup questions live. You'll be learning with 3,400+ members. → Get access here

The Hermes Agent Bedrock Config File, Line By Line

After the wizard runs, the docs say ~/.hermes/config.yaml contains a block like this.

model:
  default: us.anthropic.claude-sonnet-4-6
  provider: bedrock
  base_url: https://bedrock-runtime.us-east-2.amazonaws.com

bedrock:
  region: us-east-2

You can add optional keys under bedrock: when you need them.

bedrock:
  region: us-east-2
  # profile: "hermes"
  discovery:
    enabled: true
    provider_filter: ["anthropic", "amazon"]
    refresh_interval: 3600
  guardrail:
    guardrail_identifier: "your-guardrail-id"
    guardrail_version: "1"
    stream_processing_mode: "async"
    trace: "disabled"

Key or variable	What it does
model.provider: bedrock	It tells Hermes to use the Bedrock provider.
model.default	It holds the inference profile ID of your default model.
bedrock.region	It sets the AWS region and beats the environment variables.
bedrock.profile or AWS_PROFILE	It picks a named profile from your AWS credentials file.
bedrock.discovery.provider_filter	It limits the picker to the model makers you list.
bedrock.guardrail	It attaches an Amazon Bedrock Guardrail to model calls.
AWS_REGION	It sets the region when the config file doesn't.
BEDROCK_BASE_URL	It overrides the runtime endpoint, and the docs say to usually leave it unset.

Guardrails have one catch that the docs spell out.

AWS does not apply Guardrails to the Mantle endpoint that serves the openai.gpt-5.x models, so use a Converse-served model when a guardrail is required.

🚀 Ready to put Hermes Agent Bedrock Setup to work in your business? Inside the AI Profit Boardroom you get step-by-step video trainings, my installable Agent OS and four coaching calls a week with 3,400+ members building real automations. → Join the AI Profit Boardroom

Which Bedrock Models To Run In Hermes

The Hermes docs list these IDs as available in the picker.

Model	ID from the Hermes docs	Note from the docs
Claude Sonnet 4.6	us.anthropic.claude-sonnet-4-6	It is the recommended balance of speed and capability.
Claude Opus 4.6	us.anthropic.claude-opus-4-6-v1	It is listed as the most capable.
Claude Haiku 4.5	us.anthropic.claude-haiku-4-5-20251001-v1:0	It is the fastest Claude in the list.
OpenAI GPT-5.6 Sol	openai.gpt-5.6-sol	It runs through Bedrock Mantle.
Amazon Nova Pro	us.amazon.nova-pro-v1:0	It is described as Amazon's flagship.
Amazon Nova Micro	us.amazon.nova-micro-v1:0	It is described as the fastest and cheapest.
DeepSeek V3.2	deepseek.v3.2	It is described as a strong open model.
Llama 4 Scout 17B	us.meta.llama4-scout-17b-instruct-v1:0	It is Meta's entry in the list.

That table is the docs' own shortlist, and Bedrock's catalogue is bigger.

The AWS models at a glance page listed newer Claude models, Mistral models, Qwen, Kimi, Grok and GLM models when I checked on 12 October 2026.

Hermes discovers what your region offers, so trust the picker over any blog table, including mine.

For an agent, I'd start with a Claude model, because tool calling is the whole job and the Claude route keeps prompt caching.

My wider ranking is in the best Hermes Agent model post.

Tool Calling Caveats On Bedrock

An agent that can't call tools is just a chatbot, so check this before you commit to a model.

• Hermes converts its tool definitions into the Converse format for you, so you don't write any Bedrock-specific tool code.
• The Hermes source keeps a short list of models that reject tools, which covers DeepSeek R1, Stability image models and embedding models.
• The source treats unknown models as tool-capable, so a small model may accept tools and still use them badly.
• Prompt caching markers are only added for Claude and Nova model IDs, because other models reject them.
• The extra_headers setting is not used on the Converse route, according to the configuring models docs.

Test a real multi-step task before you trust a new model with a scheduled job.

Switching Models, Fallbacks And The Gateway

You switch models mid-session with the /model command.

/model us.amazon.nova-pro-v1:0
/model deepseek.v3.2

Bedrock is also on the list of supported fallback providers in the docs.

You set a fallback chain in config.yaml or with hermes fallback, and Hermes swaps provider mid-session without losing your conversation.

That lets you keep Bedrock as the main brain and a second provider as the safety net, or the other way round.

The gateway works too.

The docs say Bedrock works with every Hermes gateway platform, and you run hermes gateway setup and hermes gateway start as normal.

If you want the wider picture of where Hermes runs commands and which model backends exist, read my Hermes Agent backend guide.

What Hermes On Bedrock Costs

Hermes itself is free and open source, so the bill is the AWS bill.

Bedrock charges per token on demand, and the price depends on the model and the region.

I checked the Amazon Bedrock pricing page on 12 October 2026.

The lowest regional prices I could read were $0.50 per million input tokens and $1.50 per million output tokens for Mistral Large 3, and $0.62 and $1.85 for DeepSeek v3.2.

Other regions on the same page were higher.

The Claude and Nova prices load dynamically on that page and I couldn't read them reliably, so check the page for those instead of trusting a number from me.

The pricing page also describes batch inference and service tiers called Standard, Priority, Flex and Reserved, which change the price for the same model.

An agent sends the system prompt and tool definitions on every turn, so prompt caching matters more than the headline price.

🔥 Want the exact Hermes setup I run, with someone to ask when you get stuck? The AI Profit Boardroom includes my Agent OS, Hermes walkthroughs and four live coaching calls a week with 3,400+ members. → Join the AI Profit Boardroom

Troubleshooting Hermes Agent Bedrock Errors

What you see	What it means	The fix
"No API key found" or "No AWS credentials"	Hermes found nothing in the credential chain.	Run aws configure or attach an IAM role to the instance.
"Invocation of model ID ... with on-demand throughput isn't supported"	You used a bare foundation model ID.	Use an inference profile ID with a us. or global. prefix.
AccessDeniedException	The model isn't enabled, the Anthropic form is pending or IAM blocks it.	Check model access, wait for the subscription and check the policy.
ThrottlingException	You hit the per-model rate limit.	Hermes retries with backoff, and you can request a quota increase.
"No models found"	The identity can't list models.	Add bedrock:ListFoundationModels to the policy.
"Could not load the Bedrock adapter"	The boto3 extra isn't installed properly.	Run hermes pm repair and restart Hermes.

The region is the cause more often than people expect.

A model can exist on Bedrock and still not be offered in your region.

The Hermes setup code only shows models your region can route to, so a model missing from the picker usually means a region problem and not a Hermes bug.

Run hermes doctor first every time, because it tells you which layer is broken.

Should You Use Bedrock Or Something Simpler?

Bedrock is the right call when your company already lives in AWS.

It is more setup than most solo operators need.

Route	Setup effort	Best for
AWS Bedrock	It needs an AWS account, IAM and model access.	It suits teams with AWS billing, IAM and compliance rules.
Anthropic direct	It needs one API key.	It suits people who only want Claude.
OpenRouter	It needs one API key.	It suits people who want many models on one bill.
Nous Portal	It needs one OAuth login.	It suits people who want the route the Hermes docs recommend.

The docs call Nous Portal the recommended way to run Hermes, and hermes setup --portal sets it up in one command.

If you want to know who is behind all of this, I wrote a plain explainer of Hermes Agent by Nous Research.

FAQ: Hermes Agent Bedrock

Does Hermes Agent support Amazon Bedrock?

Yes, and the official docs call it a native provider.

You pick AWS Bedrock in hermes model, and the provider name in the config is bedrock.

Do I need an API key?

No, because Hermes uses the standard boto3 credential chain.

An IAM role, a named profile, SSO or the usual AWS environment variables all work.

Which IAM permissions does Hermes need?

It needs bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream for inference.

It needs bedrock:ListFoundationModels and bedrock:ListInferenceProfiles for model discovery.

Can I run Hermes on an EC2 instance with Bedrock?

Yes, and the docs say an attached IAM role is detected automatically.

The docs also link a community CloudFormation sample called sample-hermes-agent-on-aws-with-bedrock, which I haven't run myself.

Have you tested Hermes on Bedrock yourself?

I haven't published a Bedrock test, so treat this as a documented setup and not a field report.

Also On Our Network

• 🌐 Why a business would run Hermes on Bedrock, and when it shouldn't
• 🌐 Every Hermes Bedrock feature checked, with a verdict
• 🌐 The Hermes Bedrock quick-start and where it fits in an Agent OS
• 🌐 Which Bedrock models are worth running, with real benchmark scores

📺 Video notes + links to the tools 👉

🎥 Learn how I make these videos 👉

🆓 Get a FREE AI Course + Community + 1,000 AI Agents 👉

About Julian

I'm Julian Goldie, an SEO entrepreneur, author and founder of the AI Profit Boardroom, which has 3,400+ members.

I help business owners scale with AI agents, automation and SEO.

• I've built a 7-figure SEO and link-building agency, Goldie Agency, with 70+ people in Bangkok.
• I've grown a YouTube channel to 400,000+ subscribers.
• I wrote the book "Link Building Mastery", which covers nine link building strategies.
• My Udemy courses have taught 29,000+ students.

→ Get my best AI training inside the AI Profit Boardroom

Follow the seven steps above, run hermes doctor when something breaks, and you'll have a working Hermes Agent Bedrock setup.