BYOK - Please add tutorial for Using Custom Models in Github Copilot with AWS Bedrock

[teq-thuynguyen]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Copilot in GitHub

Body

Following this tutorial: https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-for-organization/use-your-own-api-keys

Please add more detail guiding to config with AWS Bedrock.
I have tried to config bedrock with long-term api keys, but when chatting, I got error as below:

Sorry, your request failed. Please try again.

Copilot Request id: c0b837d4-48d4-457c-9b56-7a02c3703d83

GH Request Id: FF88:238BC9:E9A772:10FBF28:69E70717

Reason: Server error: 500

I need detail for bedrock config.

[Gecko51]

Bedrock BYOK works but it's finicky. Four things to check, in order of likelihood:

1. Model access not enabled in Bedrock. Bedrock console, Model access, make sure the specific model you're configuring has "Access granted". New AWS accounts don't have access to most models by default and you have to request it per-model per-region.

2. Wrong region for the model. Not every model is in every region. Pick a region where your chosen model is GA (us-east-1 and us-west-2 are the safest bets), and make sure the region you set in the Copilot BYOK config matches exactly.

3. Foundation model ID vs inference profile. For the newer Anthropic models on Bedrock (Claude 3.5 Sonnet v2, 3.7 Sonnet, Sonnet 4, etc.) AWS routes cross-region and requires an inference profile ID, not the raw model ID. If you're passing anthropic.claude-3-5-sonnet-20241022-v2:0 directly, switch to the prefixed variant like us.anthropic.claude-3-5-sonnet-20241022-v2:0 (or eu. / apac. depending on where you're calling from), or use the full inference profile ARN.

4. IAM policy on the user/role tied to those long-term keys. Minimum you need:

{
  "Effect": "Allow",
  "Action": [
    "bedrock:InvokeModel",
    "bedrock:InvokeModelWithResponseStream",
    "bedrock:GetInferenceProfile"
  ],
  "Resource": "*"
}

For cross-region inference profiles you also need invoke permission on the profile's underlying model ARNs in each region the profile routes to. While you debug, Resource: "*" is fine, tighten later.

Fastest way to isolate it: run the exact same call from your terminal with the exact same AWS credentials:

aws bedrock-runtime invoke-model \
  --model-id us.anthropic.claude-3-5-sonnet-20241022-v2:0 \
  --region us-east-1 \
  --body '{"anthropic_version":"bedrock-2023-05-31","max_tokens":100,"messages":[{"role":"user","content":"hi"}]}' \
  --cli-binary-format raw-in-base64-out \
  out.json

If that 500s too, it's AWS-side (IAM, model access, region, or model ID format). Fix that first, the Copilot integration will light up afterwards. If the CLI works but Copilot still 500s with the same creds and model ID, open a support ticket and include both request IDs you already have, since Bedrock BYOK is still in public preview and a few integration edge cases are getting ironed out.

[teq-thuynguyen]

thanks @Gecko51 I tried the above steps before submitting this ticket. I also tested the setup and chatted with the model on Bedrock locally using a script, and only GitHub Copilot is returning a 500 error. Thank you for your assistance. I will create a separate support ticket.