AWS Bedrock

The SDK patches boto3’s Bedrock clients so calls to Amazon Bedrock are policy-checked and audited the same way OpenAI / Anthropic / Google calls are. Two boto3 services are covered:

bedrock-runtime — Converse, ConverseStream, plus the legacy InvokeModel shapes. The agentic loop runs in Python, so the SDK can intercept every turn.
bedrock-agent-runtime — InvokeAgent for managed Bedrock Agents whose Action Groups execute on AWS-managed infrastructure.

After egisai.init() runs, both clients are patched in place on every new boto3.client(…) instance.

Supported surface

Method	Sync	Async (`aioboto3`)	Streaming	Tool / action gating
`bedrock-runtime.Converse`	✅	✅	—	Enforced before dispatch
`bedrock-runtime.ConverseStream`	✅	✅	✅	Enforced before dispatch
`bedrock-runtime.InvokeModel`	✅	✅	—	n/a (no structured tools)
`bedrock-agent-runtime.InvokeAgent`	✅	✅	✅	Advisory — see below

Install

pip install egisai boto3

The Bedrock patch is part of the core SDK; no extra extra is required.

Use — Bedrock Converse

import egisai
import boto3

egisai.init(app="bedrock-bot", env="production")

client = boto3.client("bedrock-runtime", region_name="us-east-1")
response = client.converse(
    modelId="anthropic.claude-3-5-sonnet-20241022-v2:0",
    messages=[{"role": "user", "content": [{"text": "Hello!"}]}],
)
print(response["output"]["message"]["content"][0]["text"])

Streaming

stream = client.converse_stream(
    modelId="anthropic.claude-3-5-sonnet-20241022-v2:0",
    messages=[{"role": "user", "content": [{"text": "Tell me a story."}]}],
)
for event in stream["stream"]:
    if "contentBlockDelta" in event:
        delta = event["contentBlockDelta"]["delta"]
        if "text" in delta:
            print(delta["text"], end="", flush=True)

Tool use

When the model returns toolUse blocks, the SDK runs output-side policies (deny_tool_call, deny_mcp_call, semantic_guard, deny_bash_command, deny_db_query, deny_financial_action) against them before they return to your dispatch code. A blocked tool call either raises PermissionError or returns a refusal-shaped response, depending on on_block. Tool results you feed back in the next call’s messages are scanned by the input phase, so PII in a CRM or database lookup gets caught before the model is shown it.

Use — managed Bedrock Agents

client = boto3.client("bedrock-agent-runtime", region_name="us-east-1")
response = client.invoke_agent(
    agentId="ABCDEFGHIJ",
    agentAliasId="TSTALIASID",
    sessionId="sess_42",
    inputText="Look up the customer record for Jane.",
)
for event in response["completion"]:
    chunk = event.get("chunk")
    if chunk and "bytes" in chunk:
        print(chunk["bytes"].decode(), end="", flush=True)

Bedrock Agents enforcement is advisory. Bedrock Agents run their Action Groups on AWS-managed infrastructure that does not expose a pre-execution or post-execution hook the SDK can sit between. The patch records what happened — tool dispatches, action results, the matched policy — but cannot prevent the dispatch or substitute the result before the agent is shown it. Audit rows are honestly stamped enforcement_status="advisory" so SOC 2 / GDPR auditors can query for them.If your application requires hard pre-execution gating OR tool-result PII masking for Bedrock workloads, use one of:

Bedrock Converse — drive the agentic loop yourself in Python. Tool results round-trip Python and the next call’s input phase scans them. This is the recommended path for regulated workloads.
Claude Agent SDK — the SDK’s subprocess-loop framework with real PreToolUse + PostToolUse hooks. See Claude Agent SDK.

When a call is blocked

By default a blocked call raises PermissionError. Switch modes at init if you’d rather receive a refusal-shaped Converse response:

egisai.init(..., on_block="stub")

The stub mirrors the real Converse / ConverseStream / InvokeAgent response shape so your existing code keeps working.

Get started

Core concepts

Integrations

Gateway

Coverage

Guides

Operations

Supported surface

Install

Use — Bedrock Converse

Streaming

Tool use

Use — managed Bedrock Agents

When a call is blocked

What’s next

Claude Agent SDK

Agent frameworks

​Supported surface

​Install

​Use — Bedrock Converse

​Streaming

​Tool use

​Use — managed Bedrock Agents

​When a call is blocked

​What’s next

Claude Agent SDK

Agent frameworks

Supported surface

Install

Use — Bedrock Converse

Streaming

Tool use

Use — managed Bedrock Agents

When a call is blocked

What’s next