Configure AWS Bedrock as a Custom AI Provider

Connect AWS Bedrock to Netskope AI Gateway as a custom AI provider, route requests through the gateway for unified security, policy enforcement, and monitoring.

Supported Models

• Anthropic Claude (3.x, 4.x) – full support
• OpenAI imported models – full support
• Other providers (Meta, Mistral, Amazon Titan) – limited support through bypass mode

Prerequisites

• Netskope AI Gateway 1.6 and above required for the Bedrock Mantle endpoint
• Active AWS account with Bedrock service enabled
• AWS credentials (API key)
• Bedrock models enabled in your AWS account
• Target region for Bedrock API (for example, us-east-1, eu-west-1)

AWS Bedrock Provider Types and Schema Compatibility

AI Gateway supports two AWS Bedrock provider types — bedrock-runtime and bedrock-mantle — each requiring a different AI Schema. You must match the provider type with the correct schema when configuring your custom provider. Mismatched configurations cause traffic to be labeled as ‘Other’ resulting in bypassed DLP and guardrail inspections.

The table below details the available provider types and their compatibility.

For the Bedrock Runtime endpoint, set the AI Schema to AWS Bedrock. For the Bedrock Mantle endpoint, specify the AI Schema based on the underlying model:

• If the endpoint is accessing an Anthropic model, select Claude as the AI Schema.
• If the endpoint is accessing an OpenAI or OpenAI-compatible model, select OpenAI (Compatible) as the AI Schema.

See Request URL Format (Bedrock Mantle) below for example requests using each schema.

Add AWS Bedrock as a Custom Provider

1. Log in to your Netskope tenant UI.

2. Go to Settings > Security Cloud Platform > AI Gateway > AI Providers.

3. Select Add Custom Provider.

4. Enter the following values:

   

   • Name: Enter a name. The name always has cust as a prefix.
     Example: cust-bedrock (or any unique prefix like cust-*)
   • AI Schema: AWS Bedrock for the bedrock-runtime endpoint
     Claude or OpenAI (Compatible) for the bedrock-mantle endpoint, depending on the underlying model (see the schema compatibility table above)
   • Host: Domain name used to access AWS Bedrock.
   • Bedrock Runtime: bedrock-runtime.{region}.amazonaws.com — for example, https://bedrock-runtime.us-east-1.amazonaws.com
   • Bedrock Mantle: bedrock-mantle.{region}.api.aws — for example, https://bedrock-mantle.us-east-1.api.aws
   • Protocol & Port: HTTPS 443
     HTTPS port number on which the AI provider receives traffic.
   • Certificate: System

5. Click Save.

Configure Authentication

AWS Bedrock requires authentication on each request. This applies to both the bedrock-runtime and bedrock-mantle endpoint types. Currently, the gateway supports static credentials using an API key-style bearer token in the Authorization header.

Authorization: Bearer {bedrock-api-key}

Request URL Format (Bedrock Mantle)

Bedrock Mantle requests use the same authentication method as Bedrock Runtime (see Configure Authentication above), but follow a different URL structure depending on the AI Schema selected for the provider.

For providers using the OpenAI (Compatible) schema:
https://{gateway}/v1/{provider-name}/v1/chat/completions

For providers using the Claude schema:
https://{gateway}/v1/{provider-name}/anthropic/v1/messages

Schema Override

The x-ns-aig-schema header supports only the bedrock-mantle endpoint. Use it to force the gateway to process a Bedrock Mantle request with a specific schema.

x-ns-aig-schema: claude
x-ns-aig-schema: openai

• Use only with bedrock-mantle when the model uses a Claude or OpenAI-compatible schema.
• Useful for testing Bedrock Mantle models compatible with another schema.
• Overrides manual schema selection for specialized or custom Bedrock Mantle models.

Known Limitations (Bedrock Runtime)

1. Supported endpoints: Only /invoke (InvokeModel) and /invoke-with-response-stream (InvokeModelWithResponseStream) are supported. The /converse API is not supported — use /invoke instead.
2. Bypass mode: For unsupported providers/models on AWS Bedrock, the gateway may forward requests without content inspection.
3. URL format: Requests must use /model/{model-id}/invoke structure.
4. Model availability: Models must be enabled in the AWS Bedrock console for your account and region.

References

Endpoints supported by Amazon Bedrock

Amazon Bedrock API Reference