From d9a1ee4ffe96e5facdcd5070880017017d56de45 Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 00:42:25 +0000 Subject: [PATCH 1/2] docs: correct Bedrock OpenAI support and default-project access Ground both local and cloud IAM examples in warp-terraform PR #1658 and keep the BYOLLM provider overview consistent. Co-Authored-By: Oz --- .../enterprise-features/bring-your-own-llm.mdx | 4 ++-- .../enterprise-features/byollm-aws-bedrock.mdx | 14 ++++++++++---- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/src/content/docs/enterprise/enterprise-features/bring-your-own-llm.mdx b/src/content/docs/enterprise/enterprise-features/bring-your-own-llm.mdx index 70dcb9335..439b48d97 100644 --- a/src/content/docs/enterprise/enterprise-features/bring-your-own-llm.mdx +++ b/src/content/docs/enterprise/enterprise-features/bring-your-own-llm.mdx @@ -17,7 +17,7 @@ BYOLLM is only available on Warp's Enterprise plan. [Contact sales](https://www. BYOLLM supports two cloud providers today, each with its own dedicated setup guide: -* **[BYOLLM: AWS Bedrock](/enterprise/enterprise-features/byollm-aws-bedrock/)** - Route inference through Claude models hosted in your AWS account. Interactive requests use each member's AWS CLI session credentials, and cloud agent runs assume an IAM role via OIDC. +* **[BYOLLM: AWS Bedrock](/enterprise/enterprise-features/byollm-aws-bedrock/)** - Route inference through supported Anthropic (Claude) and OpenAI models hosted in your AWS account. Interactive requests use each member's AWS CLI session credentials, and cloud agent runs assume an IAM role via OIDC. * **[BYOLLM: Gemini Enterprise (Vertex AI)](/enterprise/enterprise-features/byollm-gemini-enterprise/)** - Route inference through Gemini and Claude partner models hosted in your Google Cloud project, using short-lived Workload Identity Federation (WIF) credentials rooted in the member's Warp session. :::caution @@ -28,7 +28,7 @@ Use the comparison below to pick a provider, then follow its setup guide for con | Aspect | AWS Bedrock | Gemini Enterprise (Vertex AI) | | --- | --- | --- | -| Models | Claude (Anthropic) | Gemini (native) and Claude (Vertex AI partner models) | +| Models | Anthropic (Claude) and OpenAI | Gemini (native) and Claude (Vertex AI partner models) | | Credential mechanism | AWS CLI session (interactive); IAM role via OIDC (cloud agents) | Workload Identity Federation (WIF), rooted in the Warp session | | Works with cloud agents | Yes | Not yet (planned) | | Setup guide | [BYOLLM: AWS Bedrock](/enterprise/enterprise-features/byollm-aws-bedrock/) | [BYOLLM: Gemini Enterprise](/enterprise/enterprise-features/byollm-gemini-enterprise/) | diff --git a/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx b/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx index 0fb15a885..39f8a7a22 100644 --- a/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx +++ b/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx @@ -8,7 +8,7 @@ description: >- --- import { VARS } from '@data/vars'; -Warp's **AWS Bedrock** BYOLLM integration routes agent inference through your own AWS account using **Amazon Bedrock**. Your team keeps using Warp's agents as usual, while eligible requests execute against Claude models hosted in your AWS account, billed to your AWS account and governed by your IAM controls. +Warp's **AWS Bedrock** BYOLLM integration routes agent inference through your own AWS account using **Amazon Bedrock**. Your team keeps using agents in Warp as usual, while eligible requests execute against supported Anthropic (Claude) and OpenAI models hosted in your AWS account, billed to your AWS account and governed by your IAM controls. AWS Bedrock is one of the providers supported by [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/). For Google Cloud-based routing, see [BYOLLM: Gemini Enterprise](/enterprise/enterprise-features/byollm-gemini-enterprise/). @@ -56,7 +56,7 @@ This approach ensures access management stays with your cloud provider, giving a ### Model availability -BYOLLM supports the intersection of models that Warp supports and models available on your provider. On AWS Bedrock, only **Claude models** (Anthropic) are available; OpenAI and Google models are not available on Bedrock. To route Gemini models (or Claude partner models on Vertex AI) through your Google Cloud project, use [Gemini Enterprise BYOLLM](/enterprise/enterprise-features/byollm-gemini-enterprise/) instead. +BYOLLM supports the intersection of models that Warp supports and models available on your provider. On AWS Bedrock, Warp supports Anthropic (Claude) and OpenAI models. To route Gemini models (or Claude partner models on Vertex AI) through your Google Cloud project, use [Gemini Enterprise BYOLLM](/enterprise/enterprise-features/byollm-gemini-enterprise/) instead. To determine which models you can use with BYOLLM: @@ -103,13 +103,16 @@ Grant your team members the necessary permissions in AWS. Use least-privilege IA "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:inference-profile/*", - "arn:aws:bedrock:*:*:application-inference-profile/*" + "arn:aws:bedrock:*:*:application-inference-profile/*", + "arn:aws:bedrock:AWS_REGION:AWS_ACCOUNT_ID:project/default" ] } ] } ``` +Replace `AWS_REGION` and `AWS_ACCOUNT_ID` with your Bedrock region and AWS account ID. OpenAI Responses API requests through `bedrock-runtime` require invoke permissions on the account's default project as well as the model resources. + :::note This policy covers Warp's current usage. By default, Warp uses [global inference profiles](https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html) for models when available. Admins can override the inference profile per model on the **Models** page of the [Admin Panel](/enterprise/team-management/admin-panel/). ::: @@ -216,13 +219,16 @@ Attach the minimum Bedrock invoke permissions policy to the role: "Resource": [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:inference-profile/*", - "arn:aws:bedrock:*:*:application-inference-profile/*" + "arn:aws:bedrock:*:*:application-inference-profile/*", + "arn:aws:bedrock:AWS_REGION:AWS_ACCOUNT_ID:project/default" ] } ] } ``` +Replace `AWS_REGION` and `AWS_ACCOUNT_ID` with your Bedrock region and AWS account ID. Cloud agents need the same default-project invoke permissions for OpenAI Responses API requests through `bedrock-runtime` as local agents. + :::note This policy covers Warp's current usage. By default, Warp uses [global inference profiles](https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html) for models when available. Admins can override the inference profile per model on the **Models** page of the [Admin Panel](/enterprise/team-management/admin-panel/). ::: From e10871a4ccb026719eba3cb46c1f138e6e549a89 Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 01:07:29 +0000 Subject: [PATCH 2/2] docs: use wildcard Bedrock default-project resources Apply the requested wildcard scope consistently to local and cloud IAM examples and remove their OpenAI-specific caveats. Co-Authored-By: Oz --- .../enterprise/enterprise-features/byollm-aws-bedrock.mdx | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx b/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx index 39f8a7a22..6528ea7a9 100644 --- a/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx +++ b/src/content/docs/enterprise/enterprise-features/byollm-aws-bedrock.mdx @@ -104,15 +104,13 @@ Grant your team members the necessary permissions in AWS. Use least-privilege IA "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:inference-profile/*", "arn:aws:bedrock:*:*:application-inference-profile/*", - "arn:aws:bedrock:AWS_REGION:AWS_ACCOUNT_ID:project/default" + "arn:aws:bedrock:*:*:project/default" ] } ] } ``` -Replace `AWS_REGION` and `AWS_ACCOUNT_ID` with your Bedrock region and AWS account ID. OpenAI Responses API requests through `bedrock-runtime` require invoke permissions on the account's default project as well as the model resources. - :::note This policy covers Warp's current usage. By default, Warp uses [global inference profiles](https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html) for models when available. Admins can override the inference profile per model on the **Models** page of the [Admin Panel](/enterprise/team-management/admin-panel/). ::: @@ -220,15 +218,13 @@ Attach the minimum Bedrock invoke permissions policy to the role: "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:inference-profile/*", "arn:aws:bedrock:*:*:application-inference-profile/*", - "arn:aws:bedrock:AWS_REGION:AWS_ACCOUNT_ID:project/default" + "arn:aws:bedrock:*:*:project/default" ] } ] } ``` -Replace `AWS_REGION` and `AWS_ACCOUNT_ID` with your Bedrock region and AWS account ID. Cloud agents need the same default-project invoke permissions for OpenAI Responses API requests through `bedrock-runtime` as local agents. - :::note This policy covers Warp's current usage. By default, Warp uses [global inference profiles](https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html) for models when available. Admins can override the inference profile per model on the **Models** page of the [Admin Panel](/enterprise/team-management/admin-panel/). :::