<div id="readability-page-1" class="page"><div><img src="https://devstarsj.github.io/assets/https://images.unsplash.com/photo-1667372393119-3d4c48d07fc9?w=1200">This guide walks through how to connect OpenClaw to AWS Bedrock and run Claude Sonnet 4.6 as your primary model on macOS. Using Bedrock lets you leverage your AWS account’s capacity with stable, reliable inference — and once it’s set up, it just works.The tricky part isn’t the AWS side. It’s knowing exactly how OpenClaw manages its config, because a few things will silently undo your work if you’re not careful.<img src="https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=800" alt="AWS Bedrock Console"> Photo by NASA on Unsplash<h2 id="environment">Environment</h2><ul><li>macOS (gateway running as a launchd LaunchAgent)</li><li>OpenClaw 2026.2.17</li><li>AWS account with Bedrock IAM access</li><li><code>~/.aws/credentials</code> with a <code>[default]</code> profile already configured</li></ul><hr><h2 id="prerequisites-enable-aws-bedrock-model-access">Prerequisites: Enable AWS Bedrock Model Access</h2>Head to the AWS Console → Bedrock → Model Access and enable access for Claude Sonnet 4.6. Also enable the Cross-region inference profile while you’re there.Verify it works from the CLI:<div><pre><code>aws bedrock-runtime converse \
 --model-id "global.anthropic.claude-sonnet-4-6" \
 --messages '[{"role":"user","content":[{"text":"hi"}]}]'
</code></pre></div>If you get a valid response, you’re ready to proceed.<hr><h2 id="step-1-fully-stop-openclaw">Step 1: Fully Stop OpenClaw</h2>This is non-negotiable. If OpenClaw’s gateway is running when you edit <code>openclaw.json</code>, it will detect the change and immediately overwrite your edits with its own in-memory config.<div><pre><code>launchctl bootout gui/$UID/ai.openclaw.gateway
pkill -9 -f "openclaw-gateway"
sleep 2
ps aux | grep openclaw | grep -v grep
</code></pre></div>Make sure no openclaw process is running before you continue.<hr><h2 id="step-2-add-aws-environment-variables-to-the-launchagent-plist">Step 2: Add AWS Environment Variables to the LaunchAgent plist</h2>Because OpenClaw’s gateway runs under macOS launchd, environment variables you <code>export</code> in your shell are not inherited by the process. You have to inject them directly into the plist file.Open <code>~/Library/LaunchAgents/ai.openclaw.gateway.plist</code> and add the following inside the <code>&lt;dict&gt;</code> block under <code>EnvironmentVariables</code>:<div><pre><code>&lt;key&gt;AWS_REGION&lt;/key&gt;
&lt;string&gt;us-east-1&lt;/string&gt;
&lt;key&gt;AWS_DEFAULT_REGION&lt;/key&gt;
&lt;string&gt;us-east-1&lt;/string&gt;
&lt;key&gt;AWS_ACCESS_KEY_ID&lt;/key&gt;
&lt;string&gt;YOUR_ACCESS_KEY_ID&lt;/string&gt;
&lt;key&gt;AWS_SECRET_ACCESS_KEY&lt;/key&gt;
&lt;string&gt;YOUR_SECRET_ACCESS_KEY&lt;/string&gt;
</code></pre></div><blockquote>⚠️ Do not set both <code>AWS_PROFILE</code> and <code>AWS_ACCESS_KEY_ID</code> — they conflict with each other. Use one or the other.</blockquote><blockquote>⚠️ If <code>~/.openclaw/.env</code> contains <code>AWS_PROFILE=default</code>, that will conflict too. Remove it.</blockquote><hr><h2 id="step-3-edit-openclawjson-directly">Step 3: Edit openclaw.json Directly</h2>Never use the <code>openclaw config</code> wizard. Running the wizard overwrites your entire <code>openclaw.json</code> with defaults, wiping everything you’ve configured.Open <code>~/.openclaw/openclaw.json</code> directly and merge in the following:<div><pre><code>{
 "models": {
 "bedrockDiscovery": {
 "enabled": true,
 "region": "us-east-1"
 },
 "providers": {
 "amazon-bedrock": {
 "baseUrl": "https://bedrock-runtime.us-east-1.amazonaws.com",
 "api": "bedrock-converse-stream",
 "auth": "aws-sdk",
 "models": [
 {
 "id": "global.anthropic.claude-sonnet-4-6",
 "name": "Claude Sonnet 4.6 (Bedrock Global)",
 "reasoning": false,
 "input": ["text", "image"],
 "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
 "contextWindow": 200000,
 "maxTokens": 8192
 }
 ]
 }
 }
 },
 "agents": {
 "defaults": {
 "model": {
 "primary": "amazon-bedrock/global.anthropic.claude-sonnet-4-6",
 "fallbacks": ["anthropic/claude-sonnet-4-6", "anthropic/claude-haiku-4-5"]
 },
 "models": {
 "amazon-bedrock/global.anthropic.claude-sonnet-4-6": {},
 "anthropic/claude-sonnet-4-6": {},
 "anthropic/claude-haiku-4-5": {}
 }
 }
 }
}
</code></pre></div><hr><h2 id="step-4-lock-the-config-file-critical">Step 4: Lock the Config File (Critical!)</h2><div><pre><code>chmod 444 ~/.openclaw/openclaw.json
</code></pre></div>If you skip this step, the gateway will overwrite your config on the next restart. The read-only flag prevents this — any attempt by the gateway or UI to save settings will simply fail.When you need to make changes in the future, follow this sequence:<div><pre><code>launchctl bootout → pkill → chmod 644 → edit JSON → chmod 444 → launchctl bootstrap
</code></pre></div><hr><h2 id="step-5-restart-the-gateway-and-verify">Step 5: Restart the Gateway and Verify</h2><div><pre><code>launchctl bootstrap gui/$UID ~/Library/LaunchAgents/ai.openclaw.gateway.plist
sleep 5
openclaw models list
</code></pre></div>A successful output looks like:<div><pre><code>amazon-bedrock/global.anthropic.claude-sonnet-4-6 text+image 195k default,configured
</code></pre></div>If you see <code>default,configured</code> — you’re done.<hr><h2 id="common-pitfalls">Common Pitfalls</h2><h3 id="1-never-run-openclaw-config-wizard">1. Never run <code>openclaw config</code> wizard</h3>It will reset your entire <code>openclaw.json</code> to factory defaults.<h3 id="2-openclaw-overwrites-config-while-running">2. OpenClaw overwrites config while running</h3>Always fully stop the gateway before making any changes to <code>openclaw.json</code>.<h3 id="3-the-control-ui-also-overwrites-the-config">3. The Control UI also overwrites the config</h3>Locking the file with <code>chmod 444</code> causes any UI save attempt to fail gracefully, protecting your config.<h3 id="4-dont-add-bedrock-to-authprofiles">4. Don’t add Bedrock to <code>auth.profiles</code></h3>The <code>aws-sdk</code> auth method belongs only in <code>models.providers.amazon-bedrock.auth</code>. Don’t add it to the top-level auth profiles section.<h3 id="5-session-model-overrides-take-precedence">5. Session model overrides take precedence</h3>Check <code>sessions.json</code> for any <code>modelOverride</code> or <code>providerOverride</code> fields. Remove them if they’re pointing to a different model.<h3 id="6-bedrockdiscovery-needs-gateway-level-environment-variables">6. <code>bedrockDiscovery</code> needs gateway-level environment variables</h3>The discovery feature reads AWS credentials from the process environment — which means they must be in the launchd plist, not just your shell.<hr><h2 id="summary-checklist">Summary Checklist</h2><ul><li>Enable Claude Sonnet 4.6 access in AWS Bedrock (Model Access)</li><li>Fully stop OpenClaw gateway (<code>launchctl bootout</code>)</li><li>Add AWS credentials to the LaunchAgent plist</li><li>Merge Bedrock provider config into <code>openclaw.json</code></li><li>Lock the file: <code>chmod 444 ~/.openclaw/openclaw.json</code></li><li>Restart gateway: <code>launchctl bootstrap</code></li><li>Verify: <code>openclaw models list</code> shows <code>default,configured</code></li><li>Remove any session model overrides if present</li></ul><hr>The most common failure mode is the gateway silently overwriting your config. Once you know the pattern — stop → edit → lock → restart — the whole thing is straightforward. <div>이 글이 도움이 되셨다면 공감 및 광고 클릭을 부탁드립니다 :) </div></div></div>

Dev Note

This guide walks through how to connect OpenClaw to AWS Bedrock and run Claude Sonnet 4.6 as your primary model on macOS. Using Bedrock lets you leverage your AWS account’s capacity with stable, reliable inference — and once it’s set up, it just works.
The tricky part isn’t the AWS side. It’s knowing exactly how OpenClaw manages its config, because a few things will silently undo your work if you’re not careful.
Photo by NASA on Unsplash
Environment
macOS (gateway running as a launchd LaunchAgent)
OpenClaw 2026.2.17
AWS account with Bedrock IAM access
~/.aws/credentials with a [default] profile already configured
Prerequisites: Enable AWS Bedrock Model Access
Head to the AWS Console → Bedrock → Model Access and enable access for Claude Sonnet 4.6. Also enable the Cross-region inference profile while you’re there.
Verify it works from the CLI:
aws bedrock-runtime converse \
 --model-id "global.anthropic.claude-sonnet-4-6" \
 --messages '[{"role":"user","content":[{"text":"hi"}]}]'
If you get a valid response, you’re ready to proceed.
Step 1: Fully Stop OpenClaw
This is non-negotiable. If OpenClaw’s gateway is running when you edit openclaw.json, it will detect the change and immediately overwrite your edits with its own in-memory config.
launchctl bootout gui/$UID/ai.openclaw.gateway
pkill -9 -f "openclaw-gateway"
sleep 2
ps aux | grep openclaw | grep -v grep
Make sure no openclaw process is running before you continue.
Step 2: Add AWS Environment Variables to the LaunchAgent plist
Because OpenClaw’s gateway runs under macOS launchd, environment variables you export in your shell are not inherited by the process. You have to inject them directly into the plist file.
Open ~/Library/LaunchAgents/ai.openclaw.gateway.plist and add the following inside the <dict> block under EnvironmentVariables:
<key>AWS_REGION</key>
<string>us-east-1</string>
<key>AWS_DEFAULT_REGION</key>
<string>us-east-1</string>
<key>AWS_ACCESS_KEY_ID</key>
<string>YOUR_ACCESS_KEY_ID</string>
<key>AWS_SECRET_ACCESS_KEY</key>
<string>YOUR_SECRET_ACCESS_KEY</string>
⚠️ Do not set both AWS_PROFILE and AWS_ACCESS_KEY_ID — they conflict with each other. Use one or the other.
⚠️ If ~/.openclaw/.env contains AWS_PROFILE=default, that will conflict too. Remove it.
Step 3: Edit openclaw.json Directly
Never use the openclaw config wizard. Running the wizard overwrites your entire openclaw.json with defaults, wiping everything you’ve configured.
Open ~/.openclaw/openclaw.json directly and merge in the following:
{
 "models": {
 "bedrockDiscovery": {
 "enabled": true,
 "region": "us-east-1"
 },
 "providers": {
 "amazon-bedrock": {
 "baseUrl": "https://bedrock-runtime.us-east-1.amazonaws.com",
 "api": "bedrock-converse-stream",
 "auth": "aws-sdk",
 "models": [
 {
 "id": "global.anthropic.claude-sonnet-4-6",
 "name": "Claude Sonnet 4.6 (Bedrock Global)",
 "reasoning": false,
 "input": ["text", "image"],
 "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 },
 "contextWindow": 200000,
 "maxTokens": 8192
 }
 ]
 }
 }
 },
 "agents": {
 "defaults": {
 "model": {
 "primary": "amazon-bedrock/global.anthropic.claude-sonnet-4-6",
 "fallbacks": ["anthropic/claude-sonnet-4-6", "anthropic/claude-haiku-4-5"]
 },
 "models": {
 "amazon-bedrock/global.anthropic.claude-sonnet-4-6": {},
 "anthropic/claude-sonnet-4-6": {},
 "anthropic/claude-haiku-4-5": {}
 }
 }
 }
}
Step 4: Lock the Config File (Critical!)
chmod 444 ~/.openclaw/openclaw.json
If you skip this step, the gateway will overwrite your config on the next restart. The read-only flag prevents this — any attempt by the gateway or UI to save settings will simply fail.
When you need to make changes in the future, follow this sequence:
launchctl bootout → pkill → chmod 644 → edit JSON → chmod 444 → launchctl bootstrap
Step 5: Restart the Gateway and Verify
launchctl bootstrap gui/$UID ~/Library/LaunchAgents/ai.openclaw.gateway.plist
sleep 5
openclaw models list
A successful output looks like:
amazon-bedrock/global.anthropic.claude-sonnet-4-6 text+image 195k default,configured
If you see default,configured — you’re done.
Common Pitfalls
1. Never run openclaw config wizard
It will reset your entire openclaw.json to factory defaults.
2. OpenClaw overwrites config while running
Always fully stop the gateway before making any changes to openclaw.json.
3. The Control UI also overwrites the config
Locking the file with chmod 444 causes any UI save attempt to fail gracefully, protecting your config.
4. Don’t add Bedrock to auth.profiles
The aws-sdk auth method belongs only in models.providers.amazon-bedrock.auth. Don’t add it to the top-level auth profiles section.
5. Session model overrides take precedence
Check sessions.json for any modelOverride or providerOverride fields. Remove them if they’re pointing to a different model.
6. bedrockDiscovery needs gateway-level environment variables
The discovery feature reads AWS credentials from the process environment — which means they must be in the launchd plist, not just your shell.
Summary Checklist
Enable Claude Sonnet 4.6 access in AWS Bedrock (Model Access)
Fully stop OpenClaw gateway (launchctl bootout)
Add AWS credentials to the LaunchAgent plist
Merge Bedrock provider config into openclaw.json
Lock the file: chmod 444 ~/.openclaw/openclaw.json
Restart gateway: launchctl bootstrap
Verify: openclaw models list shows default,configured
Remove any session model overrides if present
The most common failure mode is the gateway silently overwriting your config. Once you know the pattern — stop → edit → lock → restart — the whole thing is straightforward.

Connecting OpenClaw to AWS Bedrock: A Real-World Setup Guide

댓글