Skip to content

docs(aigw): update the AWS assumed-role trust ARN for SaaS #1086

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vrv-panw merged 1 commit into from
Sep 18, 2026
+16 −16
Merged

docs(aigw): update the AWS assumed-role trust ARN for SaaS #1086

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions aigw/integrations/llms/claude-platform-aws/setup-assumed-role.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,8 +110,8 @@ Open the role, navigate to the **Trust relationships** tab, and click **Edit tru

Add the AI Gateway's AWS account as a trusted principal:

```sh Portkey Account ARN
arn:aws:iam::299329113195:role/portkey-app
```sh AI Gateway Account ARN
arn:aws:iam::039293892788:role/AirsGwEnterpriseRole
```

<Note>
Expand All @@ -127,7 +127,7 @@ This ARN is for the [hosted Strata Cloud Manager](https://stratacloudmanager.pal
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::299329113195:role/portkey-app"
"AWS": "arn:aws:iam::039293892788:role/AirsGwEnterpriseRole"
},
"Action": "sts:AssumeRole",
"Condition": {}
Expand All @@ -145,7 +145,7 @@ This ARN is for the [hosted Strata Cloud Manager](https://stratacloudmanager.pal
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::299329113195:role/portkey-app"
"AWS": "arn:aws:iam::039293892788:role/AirsGwEnterpriseRole"
},
"Action": "sts:AssumeRole",
"Condition": {
Expand Down Expand Up @@ -193,4 +193,4 @@ curl https://aigw.portkey.ai/v1/chat/completions \
| `Outbound web identity federation is disabled` | Federation not enabled on the AWS account | Run `aws iam enable-outbound-web-identity-federation` |
| `Access denied` / `not authorized to perform` | Missing IAM permissions | Verify the permission policy includes the required `aws-external-anthropic:*` actions |
| `Invalid signature` | Incorrect region or credentials | Confirm the region matches your workspace and the role ARN is correct |
| `Trust policy error` | AI Gateway ARN not in trust policy | Add `arn:aws:iam::299329113195:role/portkey-app` as a trusted principal |
| `Trust policy error` | AI Gateway ARN not in trust policy | Add `arn:aws:iam::039293892788:role/AirsGwEnterpriseRole` as a trusted principal |
10 changes: 5 additions & 5 deletions aigw/product/ai-gateway/virtual-keys/bedrock-amazon-assumed-role.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,12 +46,12 @@ Search for the policy you created above and add it to the role.
Once the role is created, open the role and navigate to the *Trust relationships* tab and click *Edit trust policy*.
This is where you will add the AI Gateway AWS account as a trusted entity.

```sh Portkey Account ARN
arn:aws:iam::299329113195:role/portkey-app
```sh AI Gateway Account ARN
arn:aws:iam::039293892788:role/AirsGwEnterpriseRole
```

<Note>
The above ARN only works for our [hosted app](https://stratacloudmanager.paloaltonetworks.com/).<br />
The above ARN applies to the SaaS deployment of the AI Gateway, managed through [Strata Cloud Manager](https://stratacloudmanager.paloaltonetworks.com/).<br />

To enable **Assumed Role for AWS in your AI Gateway Enterprise deployment**, you can refer to [this guide](https://github.com/Portkey-AI/helm/blob/main/charts/portkey-gateway/docs/Bedrock.md). If you face any issue, please reach out to us at support@portkey.ai.
</Note>
Expand All @@ -65,7 +65,7 @@ Paste the following JSON into the trust policy editor and click *Update Trust Po
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::299329113195:role/portkey-app"
"AWS": "arn:aws:iam::039293892788:role/AirsGwEnterpriseRole"
},
"Action": "sts:AssumeRole",
"Condition": {}
Expand All @@ -83,7 +83,7 @@ If you set an external ID, add it to the condition as shown below.
{
"Effect": "Allow",
"Principal": {
"AWS": "<Portkey Account ARN>"
"AWS": "<AI Gateway Account ARN>"
},
"Action": "sts:AssumeRole",
"Condition": {
Expand Down
12 changes: 6 additions & 6 deletions aigw/product/model-catalog/connect-bedrock-with-amazon-assumed-role.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ description: "How to create an integrate Bedrock using Amazon Assumed Role Authe
Create a new integration on the AI Gateway, select **Bedrock** as the provider and **AWS Assumed Role** as the authentication method.

## Create an AWS Role for the AI Gateway to Assume
This role you create will be used by Porktey to execute InvokeModel commands on Bedrock models in your AWS account. The setup process will establish a minimal-permission ("least privilege") role and set it up to allow Porktey to assume this role.
This role you create will be used by the AI Gateway to execute InvokeModel commands on Bedrock models in your AWS account. The setup process will establish a minimal-permission ("least privilege") role and set it up to allow the AI Gateway to assume this role.

### Create a permission policy in your AWS account using the following JSON

Expand Down Expand Up @@ -43,12 +43,12 @@ Search for the policy you created above and add it to the role.
Once the role is created, open the role and navigate to the *Trust relationships* tab and click *Edit trust policy*.
This is where you will add the AI Gateway AWS account as a trusted entity.

```sh Portkey Account ARN
arn:aws:iam::299329113195:role/portkey-app
```sh AI Gateway Account ARN
arn:aws:iam::039293892788:role/AirsGwEnterpriseRole
```

<Note>
The above ARN only works for our [hosted app](https://stratacloudmanager.paloaltonetworks.com/).<br />
The above ARN applies to the SaaS deployment of the AI Gateway, managed through [Strata Cloud Manager](https://stratacloudmanager.paloaltonetworks.com/).<br />

To enable **Assumed Role for AWS in your AI Gateway Enterprise deployment**, you can refer to [this guide](https://github.com/Portkey-AI/helm/blob/main/charts/portkey-gateway/docs/Bedrock.md). If you face any issue, please reach out to us at support@portkey.ai.
</Note>
Expand All @@ -62,7 +62,7 @@ Paste the following JSON into the trust policy editor and click *Update Trust Po
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::299329113195:role/portkey-app"
"AWS": "arn:aws:iam::039293892788:role/AirsGwEnterpriseRole"
},
"Action": "sts:AssumeRole",
"Condition": {}
Expand All @@ -80,7 +80,7 @@ If you set an external ID, add it to the condition as shown below.
{
"Effect": "Allow",
"Principal": {
"AWS": "<Portkey Account ARN>"
"AWS": "<AI Gateway Account ARN>"
},
"Action": "sts:AssumeRole",
"Condition": {
Expand Down
Loading