AWS Bedrock via Leanroute: BYOK, Unified Logs, and Multi-Provider Routing

TL;DR

AWS Bedrock is a managed model service, not a gateway. It hosts Anthropic, Meta, Mistral, Cohere, and AWS's own models on AWS infrastructure, and it does an excellent job at that specific thing. It does not solve the four problems teams usually reach for a gateway to solve: unified spend caps across providers, OpenAI-compatible wire format on top of Bedrock's SigV4 API, cross-provider routing (Bedrock + non-Bedrock in one request stream), and unified logs. This post walks through how teams route Bedrock through Leanroute to get those four things while keeping Bedrock as the underlying provider, why that combination is cheaper and less brittle than either building it yourself or replacing Bedrock, and where the honest limits are.

Who This Post Is For

Three audiences show up:

Teams already on Bedrock who want the gateway layer without leaving AWS. They picked Bedrock for a legitimate reason (existing AWS commit, VPC endpoint requirement, compliance) and are not looking to switch. They just want cost caps, unified logs, and the ability to mix a Bedrock request with a non-Bedrock request in the same app.

Teams evaluating Bedrock as one of several providers. They want to use Anthropic via Bedrock (for AWS enterprise pricing) and also use OpenAI or DeepSeek directly (for models Bedrock does not host). They are looking at whether one endpoint can front both.

Teams comparing "Bedrock vs a gateway" and treating them as either-or. They aren't. Bedrock is a provider, a gateway sits in front of providers. The right frame is "Bedrock through a gateway," not "Bedrock or a gateway."

What Bedrock Does Well

Honest first, so the "here's what a gateway adds" section makes sense in contrast:

Enterprise-grade model hosting on AWS infrastructure. Bedrock is the reason a lot of enterprises can use Claude in production at all. The legal team accepted the Anthropic model because it runs on AWS's DPA and data boundary, not Anthropic's directly. That is real value that no gateway can add.

Provisioned throughput. For high-volume, latency-sensitive workloads, Bedrock's provisioned throughput contracts guarantee capacity that on-demand pricing on any provider does not. If your app needs deterministic tokens-per-second at peak, Bedrock's provisioning is the answer.

VPC endpoints. Bedrock traffic can stay entirely inside your VPC via a Bedrock VPC endpoint. If your compliance rules require model traffic never leave AWS's private network, only Bedrock (and its equivalents on other clouds) can do that.

AWS billing consolidation. If your CFO has one AWS bill and does not want a second vendor invoice, Bedrock keeps everything on the AWS statement.

Bedrock Agents and Knowledge Bases. If you're using these deeply, you're on Bedrock as a platform, not just as a model provider. That's a different tool, not a gateway question.

None of that is what a gateway does. If any of the above is your critical requirement, keep Bedrock, and skip the rest of this post.

What Bedrock Does Not Do (and Where a Gateway Fills In)

Unified spend caps across providers. Bedrock enforces limits per-model within Bedrock. If you also use OpenAI directly for GPT-6, Bedrock cannot cap that OpenAI spend, and OpenAI cannot cap Bedrock spend. A gateway sitting in front of both enforces one org-wide cap.

OpenAI-compatible wire format. Bedrock uses SigV4-signed requests, its own JSON schema, and provider-specific request bodies (Anthropic Messages format for Claude, Cohere format for Command, etc.). This is fine if you're writing a Bedrock-native app; it's friction if you're writing an app that also talks to non-Bedrock models. A gateway translates: your app speaks OpenAI wire everywhere, the gateway speaks Bedrock's shape to Bedrock and OpenAI's shape to OpenAI.

Cross-provider routing in one request stream. "Route this Claude request to Bedrock, but if it fails, fall back to Anthropic direct." Bedrock does not know about Anthropic direct. A gateway does.

Unified logs. Bedrock logs land in CloudWatch. OpenAI logs land wherever OpenAI shows them. Anthropic direct logs land in the Anthropic console. A gateway logs every request across every provider in one place, with cost normalization.

Automatic cheaper-model routing across providers. "If this workload can be served by DeepSeek V4 Flash at $0.14/$0.42, don't send it to Claude Sonnet 5 at $2/$10." Bedrock cannot make that decision because DeepSeek is not on Bedrock. A gateway can.

How the Combination Works

The setup is intentionally boring:

Step 1: Add your AWS credentials to Leanroute as a Bedrock provider key. IAM user with bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream on the models you want. Keys are AES-256-GCM encrypted at rest.

Step 2: Your app talks OpenAI wire to Leanroute. Same base URL as any other Leanroute call:

curl https://api.leanroute.dev/v1/chat/completions \
  -H "Authorization: Bearer $LEANROUTE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "bedrock/anthropic.claude-sonnet-5",
    "messages": [{"role":"user","content":"Hello Claude on Bedrock"}]
  }'

Step 3: Leanroute signs the request with SigV4 and hits Bedrock on your behalf. Response comes back in OpenAI's chat completions shape, regardless of which Bedrock provider was underneath.

Step 4: The same endpoint can hit non-Bedrock providers. Same key, same wire, just change the model prefix:

# Later that same day, same key, DeepSeek direct:
"model": "deepseek/deepseek-v4-pro"

# Or Anthropic direct, if you want to A/B Bedrock vs direct:
"model": "anthropic/claude-sonnet-5"

Your app writes to one wire format. The gateway handles the SigV4 signing on Bedrock requests and the OAuth-style bearer auth on the others.

The Failover Pattern

The most common shape we see: Bedrock primary, Anthropic direct fallback.

Bedrock has intermittent throttling under load, and anyone who has run Claude on Bedrock at scale has seen ThrottlingException on InvokeModel. Leanroute's failover rule for that shape:

primary:  bedrock/anthropic.claude-sonnet-5
fallback: anthropic/claude-sonnet-5
trigger:  bedrock 5xx OR ThrottlingException OR timeout > 8s

Requests hit Bedrock first (cheaper if you have AWS commitments, keeps traffic in your VPC where possible). When Bedrock throttles, the fallback fires transparently and your app sees a successful response from Anthropic direct. The failover event lands in your Leanroute logs so you can trend "Bedrock unavailable rate" over time and take it to your AWS TAM if it climbs.

The Cost Pattern

Bedrock's list prices roughly match Anthropic direct for Claude models. What Bedrock adds on the cost side:

Provisioned throughput commit. If you have this, Bedrock can be 20-40% cheaper than on-demand at high volume. Leanroute routes to Bedrock first when the commit is worth using.

Enterprise Discount Program. Bedrock spend counts against your AWS EDP. If you have a 3-year AWS commit, sending Claude spend through Bedrock instead of Anthropic direct helps you hit the commit.

Cross-region cost differences. Bedrock in us-east-1 costs the same as us-west-2 for most models; some newer models are only in us-east-1. Leanroute picks the correct region based on model availability.

Meanwhile, non-Bedrock providers in the same account:

DeepSeek V4 Flash at $0.14/$0.42 per 1M tokens. 14x cheaper than Claude for the same-tier workloads DeepSeek can handle. Bedrock does not host DeepSeek; Leanroute can route the tier-appropriate portion of traffic there.

GPT-5.6 Luna at $0.20/$0.80. OpenAI's small model, not on Bedrock, useful for classification and routing decisions.

The combination (Bedrock for the workloads that need Claude on AWS infra, DeepSeek or GPT-5.6 for the workloads that don't) is where the real cost saving lives. Neither Bedrock alone nor a gateway alone gets there.

Where the Combination's Honest Limits Live

Being straight:

Bedrock Agents and Knowledge Bases don't route through a gateway. If your app uses these, the gateway sits alongside, not in front. You'll have two integration points.

VPC-endpoint-only requirements can't fully use a hosted gateway. If Bedrock traffic literally cannot leave your VPC, Leanroute's Singapore-hosted proxy is the wrong shape. For that use case you'd want a self-hosted gateway (LiteLLM, Bifrost, Kong AI Gateway) inside your VPC, or use Bedrock direct. We're honest about this: it's the shape where managed gateways lose.

Provisioned throughput management still happens in AWS. Leanroute routes to your provisioned Bedrock capacity; it does not provision it for you or renew the contract. That stays in the AWS console.

IAM permissions belong to your AWS account. We recommend a scoped IAM user with only bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream on the specific model ARNs you want to expose. If you rotate the AWS credentials, you rotate them in Leanroute too.

When This Setup Is Right

You're on Bedrock for a legitimate reason (AWS commit, VPC compliance, EDP burn) and want the gateway benefits without leaving.
You're evaluating Bedrock as one of two-to-four providers, not the only one.
Your app is OpenAI-wire and you don't want to write SigV4 signing code yourself.
You want failover from Bedrock to Anthropic direct when Bedrock throttles.
You want unified logs and cost attribution across Bedrock plus non-Bedrock providers.

When This Setup Is Wrong

Your compliance rule is "no LLM traffic leaves our VPC." Managed gateways cannot help; use self-hosted.
You're building on Bedrock Agents or Bedrock Knowledge Bases as a platform, not just consuming Bedrock as a model provider.
You have zero interest in non-AWS providers and are staying Bedrock-only forever. In that case, use the AWS SDK directly and skip the abstraction.

The Broader Point

Bedrock and a gateway are complements, not competitors. The teams that get this right route Bedrock through a gateway alongside their other providers, get one wire format and one log stream, and save money by mixing cheaper-tier models across providers where their workloads allow. The teams that treat them as either-or either overpay (Bedrock-only for workloads that don't need Claude) or over-engineer (custom SigV4 signing code in their app when a gateway would handle it).

If you're on Bedrock today and want to see how the gateway layer works on top, sign up for Leanroute, paste in your AWS IAM credentials, and route your first request. Starter is $15/mo with a 14-day free trial.

Sources: