---
title: "Grok 4.6 Is on Amazon Bedrock. Here Is How to Wire Grok Build to It"
description: "SpaceXAI's Grok 4.6 is now on Amazon Bedrock. Connect Grok Build directly with an AWS profile, a short-lived credential helper, and three switchable model routes."
canonical_url: "https://artificialcuriositylabs.ai/posts/2026-08-21-grok-build-on-amazon-bedrock/"
md_url: "https://artificialcuriositylabs.ai/posts/2026-08-21-grok-build-on-amazon-bedrock.md"
published_at: "2026-08-21T07:00:00.000Z"
tags:
  - "agents"
  - "bedrock"
  - "coding-agents"
---

On August 19, 2026, [AWS made SpaceXAI's Grok 4.6 available on Amazon Bedrock](https://aws.amazon.com/about-aws/whats-new/2026/08/amazon-bedrock-grok-4-6/). The launch added US and Global cross-Region inference through Bedrock Runtime, plus OpenAI-compatible API access.

That creates an obvious builder question: can [Grok Build](https://github.com/xai-org/grok-build), SpaceXAI's coding CLI, run its own model through an AWS account rather than a separate provider key and billing boundary?

Yes. Grok Build can call Grok 4.6 on Bedrock directly, without a local inference proxy or a long-lived provider key. The working setup uses Grok Build's custom-model support, Bedrock's OpenAI-compatible endpoints, and a small credential helper that converts an existing AWS session into a short-lived bearer token.

I wired and tested three Grok 4.6 routes:

| Model picker entry | Bedrock path | Model ID | Client Region |
|---|---|---|---|
| Runtime US | US cross-Region inference | `us.xai.grok-4.6` | `us-east-1` |
| Runtime Global | Global cross-Region inference | `global.xai.grok-4.6` | `us-east-1` |
| Mantle | In-Region inference | `xai.grok-4.6` | `us-west-2` |

All three run from the official `grok` command. Selecting the Bedrock route happens inside Grok Build with `/model`.

The comparison is operational: [Claude Code can run Claude through Amazon Bedrock](https://code.claude.com/docs/en/amazon-bedrock), and [Codex can run OpenAI models through Amazon Bedrock](https://developers.openai.com/codex/amazon-bedrock). This setup gives Grok Build the equivalent path for Grok. The CLI remains the model provider's own coding harness, while AWS supplies authentication, inference access, routing, and billing.

The three Grok Build entries do not select different model families. They select three Bedrock access paths for the same Grok 4.6 model.

## Why the credential helper exists

AWS credentials and a Bedrock bearer token represent the same underlying IAM identity, but they are different request credentials.

A client with native Bedrock support can read an AWS profile and authenticate the request itself. Grok Build treats a custom model as an OpenAI-compatible service. It expects bearer authentication and does not interpret an AWS profile directly.

The credential helper closes that narrow gap:

```text
AWS profile
    ↓
AWS credential provider chain
    ↓
regional short-lived Bedrock token
    ↓
Grok Build → Bedrock OpenAI-compatible endpoint
```

The helper does not proxy inference. Grok Build sends the model request directly to Amazon Bedrock. The helper runs only when Grok needs a token.

[Amazon Bedrock short-term API keys](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html) inherit the permissions of the IAM principal that creates them. Their lifetime cannot exceed the underlying AWS session. [Grok Build's per-model authentication providers](https://github.com/xai-org/grok-build/blob/main/crates/codegen/xai-grok-shell/README.md#per-model-auth-providers) accept a command that returns an access token and its lifetime, then refresh that token automatically.

## Verify the AWS identity first

This setup starts with a working AWS profile that already has permission to invoke the selected Grok model.

```bash
aws sts get-caller-identity --profile YOUR_AWS_PROFILE
```

Read the returned account and principal before continuing. A valid AWS session in the wrong account produces a configuration that looks correct and fails at inference time.

Install or update [Grok Build](https://docs.x.ai/build/overview):

```bash
curl -fsSL https://x.ai/cli/install.sh | bash
grok update --stable
grok --version
```

I validated this configuration with Grok Build `1.0.5`.

## Install the Bedrock token generator

Keep the Python dependency under Grok's own directory rather than changing the system Python environment:

```bash
mkdir -p "$HOME/.grok/bedrock-auth" "$HOME/.grok/bin"

python3 -m pip install \
  --upgrade \
  --target "$HOME/.grok/bedrock-auth" \
  aws-bedrock-token-generator
```

AWS documents the package in its guide to [generating Amazon Bedrock API keys](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-generate.html).

Create `~/.grok/bin/bedrock-token-helper`:

```python
#!/usr/bin/env python3
"""Print a short-lived regional Bedrock token for Grok Build."""

import argparse
import json
import os
import sys
from datetime import timedelta

sys.path.insert(0, os.path.expanduser("~/.grok/bedrock-auth"))

from aws_bedrock_token_generator import provide_token


TOKEN_TTL_SECONDS = 2700


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--profile", required=True)
    parser.add_argument("--region", required=True)
    args = parser.parse_args()

    os.environ["AWS_PROFILE"] = args.profile
    os.environ["AWS_REGION"] = args.region
    os.environ["AWS_DEFAULT_REGION"] = args.region

    try:
        token = provide_token(
            region=args.region,
            expiry=timedelta(seconds=TOKEN_TTL_SECONDS),
        )
    except Exception as error:
        print(f"Unable to generate Bedrock token: {error}", file=sys.stderr)
        return 1

    print(
        json.dumps(
            {
                "access_token": token,
                "expires_in": TOKEN_TTL_SECONDS,
            }
        )
    )
    return 0


if __name__ == "__main__":
    raise SystemExit(main())
```

Then restrict execution to the current user:

```bash
chmod 700 "$HOME/.grok/bin/bedrock-token-helper"
```

The command must write only JSON to standard output. Diagnostic messages belong on standard error because Grok parses standard output as the credential response.

## Add the three Bedrock models

Add the following to `~/.grok/config.toml`, replacing `YOUR_AWS_PROFILE` with the profile verified earlier:

```toml
[auth_provider.bedrock-us-east-1]
command = '"$HOME/.grok/bin/bedrock-token-helper" --profile YOUR_AWS_PROFILE --region us-east-1'
timeout_secs = 30

[auth_provider.bedrock-us-west-2]
command = '"$HOME/.grok/bin/bedrock-token-helper" --profile YOUR_AWS_PROFILE --region us-west-2'
timeout_secs = 30

[model.bedrock-grok-us]
model = "us.xai.grok-4.6"
base_url = "https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1"
name = "Grok 4.6 - Bedrock Runtime US"
description = "US cross-Region inference through Bedrock Runtime"
api_backend = "chat_completions"
auth_provider = "bedrock-us-east-1"
context_window = 500000

[model.bedrock-grok-global]
model = "global.xai.grok-4.6"
base_url = "https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1"
name = "Grok 4.6 - Bedrock Runtime Global"
description = "Global cross-Region inference through Bedrock Runtime"
api_backend = "chat_completions"
auth_provider = "bedrock-us-east-1"
context_window = 500000

[model.bedrock-grok-mantle]
model = "xai.grok-4.6"
base_url = "https://bedrock-mantle.us-west-2.api.aws/openai/v1"
name = "Grok 4.6 - Bedrock Mantle"
description = "In-Region inference through Bedrock Mantle in us-west-2"
api_backend = "chat_completions"
auth_provider = "bedrock-us-west-2"
context_window = 500000

[models]
default = "bedrock-grok-us"
default_reasoning_effort = "medium"
```

The model IDs are not interchangeable. [Amazon Bedrock's Grok 4.6 model card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-xai-grok-4-6.html) distinguishes Runtime inference profiles from the Mantle base model:

- Runtime US uses `us.xai.grok-4.6`.
- Runtime Global uses `global.xai.grok-4.6`.
- Mantle in `us-west-2` uses `xai.grok-4.6`.

The `xai` namespace remains part of the public model ID even though the vendor is now SpaceXAI.

## Launch once and switch models

Start Grok Build with its normal command:

```bash
grok
```

Use `/model` inside the CLI to select:

```text
bedrock-grok-us
bedrock-grok-global
bedrock-grok-mantle
```

The selected entry determines the endpoint, Region, model ID, and credential provider. One Grok session can move among all three Grok 4.6 routes without restarting a proxy or exporting a new API key.

For a non-interactive smoke test:

```bash
grok --model bedrock-grok-us \
  -p "Reply with exactly: BEDROCK_GROK_OK"
```

Repeat with `bedrock-grok-global` and `bedrock-grok-mantle`. A successful response proves more than token generation: it confirms the AWS identity, regional token, endpoint, model ID, and Grok request path work together.

## Token refresh is part of the design

The helper requests a 45-minute token and returns `"expires_in": 2700`. Grok Build uses that field to cache the token in memory and rerun the provider before expiry. Its authentication guide states that external credentials refresh proactively and retry after an authentication rejection.

The AWS profile remains the actual source of authority. If it uses IAM Identity Center, `credential_process`, or another refreshable provider, each helper run resolves the current session through that provider chain.

There is one hard boundary: an expired upstream AWS login cannot refresh itself through Grok. Reauthenticate the AWS profile, then retry the model request. No Bedrock token helper can extend an AWS session that has already expired.

## What this setup does not solve

This pattern gives Grok Build direct Bedrock inference and automatic credential rotation. It does not turn Grok Build into a native AWS client.

Native Bedrock integrations can expose AWS-specific configuration directly. Grok Build sees an OpenAI-compatible model endpoint plus bearer credentials. That difference is why the helper exists and why the Runtime and Mantle routes must be declared explicitly.

The setup also depends on current model availability. Grok 4.6 on Mantle is a `us-west-2` route in the current AWS model card. A model appearing in one Region does not imply that the same base model ID works in every Mantle Region.

## So what

The durable pattern is smaller than a proxy:

```text
one AWS identity
    + one regional token helper
    + explicit model routes
    = one Grok Build CLI with a Bedrock model picker
```

The coding harness stays Grok Build, and the model stays Grok 4.6. Amazon Bedrock supplies model access, routing, and billing. The developer launches the official `grok` command and selects the required AWS route.

The open question is whether Grok Build will add a native Bedrock provider. If it does, the helper can disappear and the three model entries can collapse into AWS-aware configuration. Until then, named credential providers are the smallest integration layer that preserves direct inference and short-lived identity.