Skip to content
Edit page
Copy page

Build and govern AI workloads and APIs on AWS

WSO2 API Platform works alongside the AWS services you already use. Govern AI traffic to Amazon Bedrock, bring APIs running on Amazon API Gateway under one control plane, and run gateways on Amazon EKS with AWS identity and observability.

End-to-end guides and tutorials

Step-by-step guides for AWS. Guides are part of this documentation. Tutorials are published on the WSO2 API Platform Learn Hub and written for the product version they name.

AI Gateway with Amazon Bedrock

Route, secure, and govern traffic to foundation models on Amazon Bedrock through WSO2 AI Gateway, without changing your client applications.

Amazon Bedrock as an LLM provider

Connect Amazon Bedrock and manage its models and credentials centrally.

AWS authentication

Sign requests with AWS Signature Version 4 (SigV4) using IAM credentials, a workload role, or cross-account role assumption.

Amazon Bedrock Guardrails

Enforce the content filters, denied topics, and sensitive-information policies that you define in Amazon Bedrock on traffic through the gateway.

Token limits, semantic caching, and the other AI API policies work the same way for every provider. See AI APIs.

Routing, token limits, cost control, and the other AI Workspace policies work the same way for every provider. See the AI Workspace overview.

Routing, token limits, cost control, and the gateway's other policies work the same way for every provider. See the AI Gateway documentation.

Before you go to production

  • Credentials: give the gateway its own IAM identity with access only to the models it needs, and never give Bedrock credentials to a client application. On a gateway you run, prefer temporary credentials or an AWS workload role over long-term keys.
  • Regions and data residency: the Region in the endpoint URL, the signing Region, the model or inference profile, and the guardrail must all be compatible. Confirm every possible destination Region before you use cross-Region inference for regulated workloads.

Federate with Amazon API Gateway

Manage the APIs you run on Amazon API Gateway from the WSO2 control plane. WSO2 API Platform governs only the API metadata. Consumers continue to call Amazon API Gateway directly.

Discover APIs on Amazon API Gateway

Import APIs that already run on Amazon API Gateway and check their compliance.

Publish discovered APIs

Move a discovered API through its lifecycle and make it available in the Developer Portal.

Credentials

The gateway connection uses the access key of an AWS Identity and Access Management (IAM) user. The guide attaches the AWS managed AmazonAPIGatewayAdministrator policy, which grants more than read access to your APIs. Create a dedicated IAM user for this connection only, store its secret access key in a secrets manager, rotate the key regularly, and deactivate it when you remove the gateway. Never use root account credentials.

Run gateways on Amazon EKS

Run the gateway on your own AWS infrastructure, give it an AWS identity, and send its telemetry to AWS observability services.

Deploy on Amazon EKS

The Kubernetes deployment docs aren't specific to AWS, but they apply to Amazon Elastic Kubernetes Service (Amazon EKS).

Workload identity

Give each gateway workload a dedicated IAM role. For EKS, prefer EKS Pod Identity, and use IAM roles for service accounts (IRSA) as a supported alternative.

Amazon CloudWatch and AWS X-Ray

Export gateway logs, metrics, and traces through Fluent Bit, an OpenTelemetry Collector, or AWS Distro for OpenTelemetry (ADOT).

Architecture and responsibility model

WSO2 API Platform and AWS split the work like this:

Scenario WSO2 role AWS role Runtime traffic
Amazon Bedrock through AI Gateway Proxies and governs AI requests Hosts the selected model and optional Bedrock guardrail Goes through WSO2 AI Gateway to Amazon Bedrock
Amazon API Gateway discovery Control plane, governance, catalog, and compliance Hosts and runs the API Goes directly to Amazon API Gateway
Gateway deployed on AWS Runs the gateway software and policies Provides compute, workload identity, and observability backends Depends on the deployed gateway topology

Learn more

Related pages in the AWS documentation:

To browse every guide by goal, see the Guides overview.