Grok 4.6 Is on Amazon Bedrock. Here Is How to Wire Grok Build to It

On August 19, 2026, AWS made SpaceXAI's Grok 4.6 available on Amazon Bedrock. The launch added US and Global cross-Region inference through Bedrock Runtime, plus OpenAI-compatible API access.

That creates an obvious builder question: can Grok Build, SpaceXAI's coding CLI, run its own model through an AWS account rather than a separate provider key and billing boundary?

Yes. Grok Build can call Grok 4.6 on Bedrock directly, without a local inference proxy or a long-lived provider key. The working setup uses Grok Build's custom-model support, Bedrock's OpenAI-compatible endpoints, and a small credential helper that converts an existing AWS session into a short-lived bearer token.

I wired and tested three Grok 4.6 routes:

All three run from the official grok command. Selecting the Bedrock route happens inside Grok Build with /model.

The comparison is operational: Claude Code can run Claude through Amazon Bedrock, and Codex can run OpenAI models through Amazon Bedrock. This setup gives Grok Build the equivalent path for Grok. The CLI remains the model provider's own coding harness, while AWS supplies authentication, inference access, routing, and billing.

The three Grok Build entries do not select different model families. They select three Bedrock access paths for the same Grok 4.6 model.

TL;DR

• Grok 4.6 became available on Amazon Bedrock on August 19, 2026. Grok Build has no native Bedrock provider, but its custom models and named credential helpers cover the integration.
• The same AWS profile used by other developer tools remains the source of identity; the helper only turns that session into a regional Bedrock bearer token.
• Grok Build reads expires_in from the helper response and reruns the helper before the token expires.
• Runtime US, Runtime Global, and Mantle require different model IDs, and Mantle Grok 4.6 is available in us-west-2.
• One grok process can list and switch among all three routes for the same Grok 4.6 model. The model picker becomes the routing control.

Why the credential helper exists

AWS credentials and a Bedrock bearer token represent the same underlying IAM identity, but they are different request credentials.

A client with native Bedrock support can read an AWS profile and authenticate the request itself. Grok Build treats a custom model as an OpenAI-compatible service. It expects bearer authentication and does not interpret an AWS profile directly.

The credential helper closes that narrow gap:

AWS profile
    ↓
AWS credential provider chain
    ↓
regional short-lived Bedrock token
    ↓
Grok Build → Bedrock OpenAI-compatible endpoint

The helper does not proxy inference. Grok Build sends the model request directly to Amazon Bedrock. The helper runs only when Grok needs a token.

Amazon Bedrock short-term API keys inherit the permissions of the IAM principal that creates them. Their lifetime cannot exceed the underlying AWS session. Grok Build's per-model authentication providers accept a command that returns an access token and its lifetime, then refresh that token automatically.

Verify the AWS identity first

This setup starts with a working AWS profile that already has permission to invoke the selected Grok model.

aws sts get-caller-identity --profile YOUR_AWS_PROFILE

Read the returned account and principal before continuing. A valid AWS session in the wrong account produces a configuration that looks correct and fails at inference time.

Install or update Grok Build:

curl -fsSL https://x.ai/cli/install.sh | bash
grok update --stable
grok --version

I validated this configuration with Grok Build 1.0.5.

Install the Bedrock token generator

Keep the Python dependency under Grok's own directory rather than changing the system Python environment:

mkdir -p "$HOME/.grok/bedrock-auth" "$HOME/.grok/bin"

python3 -m pip install \
  --upgrade \
  --target "$HOME/.grok/bedrock-auth" \
  aws-bedrock-token-generator

AWS documents the package in its guide to generating Amazon Bedrock API keys.

Create ~/.grok/bin/bedrock-token-helper:

#!/usr/bin/env python3
"""Print a short-lived regional Bedrock token for Grok Build."""

import argparse
import json
import os
import sys
from datetime import timedelta

sys.path.insert(0, os.path.expanduser("~/.grok/bedrock-auth"))

from aws_bedrock_token_generator import provide_token


TOKEN_TTL_SECONDS = 2700


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--profile", required=True)
    parser.add_argument("--region", required=True)
    args = parser.parse_args()

    os.environ["AWS_PROFILE"] = args.profile
    os.environ["AWS_REGION"] = args.region
    os.environ["AWS_DEFAULT_REGION"] = args.region

    try:
        token = provide_token(
            region=args.region,
            expiry=timedelta(seconds=TOKEN_TTL_SECONDS),
        )
    except Exception as error:
        print(f"Unable to generate Bedrock token: {error}", file=sys.stderr)
        return 1

    print(
        json.dumps(
            {
                "access_token": token,
                "expires_in": TOKEN_TTL_SECONDS,
            }
        )
    )
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

Then restrict execution to the current user:

chmod 700 "$HOME/.grok/bin/bedrock-token-helper"

The command must write only JSON to standard output. Diagnostic messages belong on standard error because Grok parses standard output as the credential response.

Add the three Bedrock models

Add the following to ~/.grok/config.toml, replacing YOUR_AWS_PROFILE with the profile verified earlier:

[auth_provider.bedrock-us-east-1]
command = '"$HOME/.grok/bin/bedrock-token-helper" --profile YOUR_AWS_PROFILE --region us-east-1'
timeout_secs = 30

[auth_provider.bedrock-us-west-2]
command = '"$HOME/.grok/bin/bedrock-token-helper" --profile YOUR_AWS_PROFILE --region us-west-2'
timeout_secs = 30

[model.bedrock-grok-us]
model = "us.xai.grok-4.6"
base_url = "https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1"
name = "Grok 4.6 - Bedrock Runtime US"
description = "US cross-Region inference through Bedrock Runtime"
api_backend = "chat_completions"
auth_provider = "bedrock-us-east-1"
context_window = 500000

[model.bedrock-grok-global]
model = "global.xai.grok-4.6"
base_url = "https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1"
name = "Grok 4.6 - Bedrock Runtime Global"
description = "Global cross-Region inference through Bedrock Runtime"
api_backend = "chat_completions"
auth_provider = "bedrock-us-east-1"
context_window = 500000

[model.bedrock-grok-mantle]
model = "xai.grok-4.6"
base_url = "https://bedrock-mantle.us-west-2.api.aws/openai/v1"
name = "Grok 4.6 - Bedrock Mantle"
description = "In-Region inference through Bedrock Mantle in us-west-2"
api_backend = "chat_completions"
auth_provider = "bedrock-us-west-2"
context_window = 500000

[models]
default = "bedrock-grok-us"
default_reasoning_effort = "medium"

The model IDs are not interchangeable. Amazon Bedrock's Grok 4.6 model card distinguishes Runtime inference profiles from the Mantle base model:

• Runtime US uses us.xai.grok-4.6.
• Runtime Global uses global.xai.grok-4.6.
• Mantle in us-west-2 uses xai.grok-4.6.

The xai namespace remains part of the public model ID even though the vendor is now SpaceXAI.

Launch once and switch models

Start Grok Build with its normal command:

grok

Use /model inside the CLI to select:

bedrock-grok-us
bedrock-grok-global
bedrock-grok-mantle

The selected entry determines the endpoint, Region, model ID, and credential provider. One Grok session can move among all three Grok 4.6 routes without restarting a proxy or exporting a new API key.

For a non-interactive smoke test:

grok --model bedrock-grok-us \
  -p "Reply with exactly: BEDROCK_GROK_OK"

Repeat with bedrock-grok-global and bedrock-grok-mantle. A successful response proves more than token generation: it confirms the AWS identity, regional token, endpoint, model ID, and Grok request path work together.

Token refresh is part of the design

The helper requests a 45-minute token and returns "expires_in": 2700. Grok Build uses that field to cache the token in memory and rerun the provider before expiry. Its authentication guide states that external credentials refresh proactively and retry after an authentication rejection.

The AWS profile remains the actual source of authority. If it uses IAM Identity Center, credential_process, or another refreshable provider, each helper run resolves the current session through that provider chain.

There is one hard boundary: an expired upstream AWS login cannot refresh itself through Grok. Reauthenticate the AWS profile, then retry the model request. No Bedrock token helper can extend an AWS session that has already expired.

What this setup does not solve

This pattern gives Grok Build direct Bedrock inference and automatic credential rotation. It does not turn Grok Build into a native AWS client.

Native Bedrock integrations can expose AWS-specific configuration directly. Grok Build sees an OpenAI-compatible model endpoint plus bearer credentials. That difference is why the helper exists and why the Runtime and Mantle routes must be declared explicitly.

The setup also depends on current model availability. Grok 4.6 on Mantle is a us-west-2 route in the current AWS model card. A model appearing in one Region does not imply that the same base model ID works in every Mantle Region.

So what

The durable pattern is smaller than a proxy:

one AWS identity
    + one regional token helper
    + explicit model routes
    = one Grok Build CLI with a Bedrock model picker

The coding harness stays Grok Build, and the model stays Grok 4.6. Amazon Bedrock supplies model access, routing, and billing. The developer launches the official grok command and selects the required AWS route.

The open question is whether Grok Build will add a native Bedrock provider. If it does, the helper can disappear and the three model entries can collapse into AWS-aware configuration. Until then, named credential providers are the smallest integration layer that preserves direct inference and short-lived identity.