I tried Grok 4.6 on Amazon Bedrock Runtime using the AWS CLI

I tried calling Grok 4.6, which became available on Amazon Bedrock, from the AWS CLI's aws bedrock-runtime converse using only IAM authentication. No Bearer Token issuance is required, and I also confirmed how to use the Global and US Geo inference profiles differently.

suzuki.ryo

2026.08.21

This page has been translated by machine translation. View original

Introduction

In August 2026, xAI's Grok 4.6 became available on Amazon Bedrock.

In a previously published article, we introduced the results of trying Grok 4.6 with the bedrock-mantle endpoint.

In this article, we verified whether Grok 4.6 can be used with IAM authentication alone via the bedrock-runtime endpoint using the AWS CLI's aws bedrock-runtime converse.

Verification Details

Verification Environment

Item	Value
OS / Architecture	Linux 7.1.6-400.asahi.fc44.aarch64+16k aarch64
AWS CLI Version	aws-cli/2.36.25

Global Inference Profile

First, we confirmed from the Tokyo region whether the Global inference profile global.xai.grok-4.6 is available.

$ aws bedrock get-inference-profile \
  --region ap-northeast-1 \
  --inference-profile-identifier global.xai.grok-4.6

{
    "inferenceProfileName": "Global xAI Grok 4.6",
    "description": "Routes requests to Grok 4.6 globally across all supported AWS Regions.",
    "createdAt": "2026-08-18T23:30:25.922000+00:00",
    "updatedAt": "2026-08-18T23:30:25.922000+00:00",
    "inferenceProfileArn": "arn:aws:bedrock:ap-northeast-1:<account-id>:inference-profile/global.xai.grok-4.6",
    "models": [
        {
            "modelArn": "arn:aws:bedrock:::foundation-model/xai.grok-4.6"
        },
        {
            "modelArn": "arn:aws:bedrock:ap-northeast-1::foundation-model/xai.grok-4.6"
        }
    ],
    "inferenceProfileId": "global.xai.grok-4.6",
    "status": "ACTIVE",
    "type": "SYSTEM_DEFINED"
}

The status was ACTIVE. The profile is in an available state, and whether it can actually be called will be verified in the next section. The account ID has been replaced with <account-id>.

Running Converse

Next, we sent an actual inference request using aws bedrock-runtime converse.

$ aws bedrock-runtime converse \
  --region ap-northeast-1 \
  --model-id global.xai.grok-4.6 \
  --messages '[{"role":"user","content":[{"text":"動作確認です。日本語で「Grok 4.6 on Amazon Bedrock は利用可能です」と一文だけ返してください。"}]}]'

{
    "output": {
        "message": {
            "role": "assistant",
            "content": [
                {
                    "reasoningContent": {
                        "redactedContent": "<base64、記事には転記しない>"
                    }
                },
                {
                    "text": "Grok 4.6 on Amazon Bedrock は利用可能です"
                }
            ]
        }
    },
    "stopReason": "end_turn",
    "usage": {
        "inputTokens": 58,
        "outputTokens": 222,
        "totalTokens": 280,
        "cacheReadInputTokens": 0
    },
    "metrics": {
        "latencyMs": 23082
    }
}

The stopReason was end_turn, indicating successful completion, and it responded in Japanese to the Japanese prompt. We only used the default profile already configured with aws configure, or temporary credentials obtained via aws sso login. No Bearer Token (API key) issuance or installation of tools other than the AWS CLI was required. The response includes reasoningContent.redactedContent, which contains the encrypted reasoning content.

CloudTrail Records

We checked how the Converse call is recorded in CloudTrail, particularly to which region the Global inference profile routed the request.

$ aws cloudtrail lookup-events \
  --region ap-northeast-1 \
  --lookup-attributes AttributeKey=EventName,AttributeValue=Converse \
  --max-results 10

Below is an excerpt from the retrieved events corresponding to the Converse execution in the previous section.

{
  "eventName": "Converse",
  "awsRegion": "ap-northeast-1",
  "requestParameters": {
    "modelId": "global.xai.grok-4.6"
  },
  "additionalEventData": {
    "inferenceRegion": "us-west-2",
    "inputTokens": 58,
    "outputTokens": 222
  },
  "managementEvent": true,
  "eventCategory": "Management"
}

The awsRegion of the request destination is ap-northeast-1. The additionalEventData.inferenceRegion is us-west-2, showing that the Global inference profile routed this request to Oregon. Since eventCategory is Management and managementEvent is true, this call was recorded as a management event, and no additional data event configuration was needed. The token count in additionalEventData matches the usage in the previous section, confirming it is a record of the same call. All Converse calls tried in this session had inferenceRegion set to us-west-2.

Full CloudTrail Event (Sensitive Information Masked)

{
  "eventVersion": "1.11",
  "userIdentity": "<masked>",
  "eventTime": "2026-08-21T11:20:00Z",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "Converse",
  "awsRegion": "ap-northeast-1",
  "sourceIPAddress": "<masked>",
  "userAgent": "aws-cli/2.36.25 md/awscrt#0.36.2 ua/2.1 os/linux#7.1.6-400.asahi.fc44.aarch64+16k ... md/command#bedrock-runtime.converse",
  "requestParameters": {
    "modelId": "global.xai.grok-4.6"
  },
  "responseElements": null,
  "additionalEventData": {
    "inferenceRegion": "us-west-2",
    "inputTokens": 58,
    "outputTokens": 222
  },
  "requestID": "<masked>",
  "eventID": "<masked>",
  "readOnly": true,
  "resources": [
    {
      "accountId": "<masked>",
      "type": "AWS::Bedrock::Model",
      "ARN": "arn:aws:bedrock:ap-northeast-1::foundation-model/xai.grok-4.6"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "<masked>",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock-runtime.ap-northeast-1.amazonaws.com"
  }
}

US Geo Inference Profile

Since Global worked without issue, let's check whether the other option, the US Geo inference profile us.xai.grok-4.6, also works with the same procedure.

$ aws bedrock get-inference-profile \
  --region us-east-1 \
  --inference-profile-identifier us.xai.grok-4.6

{
    "inferenceProfileName": "US xAI Grok 4.6",
    "description": "Routes requests to Grok 4.6 in us-east-1, us-east-2, us-west-2.",
    "createdAt": "2026-08-18T23:28:38.594000+00:00",
    "updatedAt": "2026-08-18T23:28:38.594000+00:00",
    "inferenceProfileArn": "arn:aws:bedrock:us-east-1:<account-id>:inference-profile/us.xai.grok-4.6",
    "models": [
        {
            "modelArn": "arn:aws:bedrock:us-east-1::foundation-model/xai.grok-4.6"
        },
        {
            "modelArn": "arn:aws:bedrock:us-east-2::foundation-model/xai.grok-4.6"
        },
        {
            "modelArn": "arn:aws:bedrock:us-west-2::foundation-model/xai.grok-4.6"
        }
    ],
    "inferenceProfileId": "us.xai.grok-4.6",
    "status": "ACTIVE",
    "type": "SYSTEM_DEFINED"
}

The status was ACTIVE. From the description and models, we can see that this profile is configured to route requests to 3 regions: us-east-1, us-east-2, and us-west-2.

Running with US Geo

We ran Converse following the same flow as Global and also checked the CloudTrail records.

$ aws bedrock-runtime converse \
  --region us-east-1 \
  --model-id us.xai.grok-4.6 \
  --messages '[{"role":"user","content":[{"text":"動作確認です。日本語で「Grok 4.6 on Amazon Bedrock は利用可能です」と一文だけ返してください。"}]}]'

{
    "output": {
        "message": {
            "role": "assistant",
            "content": [
                {
                    "reasoningContent": {
                        "redactedContent": "<base64、記事には転記しない>"
                    }
                },
                {
                    "text": "Grok 4.6 on Amazon Bedrock は利用可能です"
                }
            ]
        }
    },
    "stopReason": "end_turn",
    "usage": {
        "inputTokens": 58,
        "outputTokens": 213,
        "totalTokens": 271,
        "cacheReadInputTokens": 0
    },
    "metrics": {
        "latencyMs": 3783
    }
}

The stopReason was end_turn, and Converse worked with IAM authentication alone from us-east-1 via the US Geo inference profile, just like with Global.

Below is an excerpt of the corresponding CloudTrail event.

$ aws cloudtrail lookup-events \
  --region us-east-1 \
  --lookup-attributes AttributeKey=EventName,AttributeValue=Converse \
  --max-results 10

{
  "eventName": "Converse",
  "awsRegion": "us-east-1",
  "requestParameters": {
    "modelId": "us.xai.grok-4.6"
  },
  "additionalEventData": {
    "inferenceRegion": "us-west-2",
    "inputTokens": 58,
    "outputTokens": 213
  },
  "managementEvent": true,
  "eventCategory": "Management"
}

The awsRegion of the request destination was us-east-1, and the inferenceRegion was us-west-2. This is the same result as with the Global execution, and which of the 3 regions the request is routed to depends on the timing of execution.

Full CloudTrail Event (Sensitive Information Masked)

{
  "eventVersion": "1.11",
  "userIdentity": "<masked>",
  "eventTime": "2026-08-21T12:28:40Z",
  "eventSource": "bedrock.amazonaws.com",
  "eventName": "Converse",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "<masked>",
  "userAgent": "aws-cli/2.36.28 md/awscrt#0.36.2 ua/2.1 os/linux#7.1.6-400.asahi.fc44.aarch64+16k ... md/command#bedrock-runtime.converse",
  "requestParameters": {
    "modelId": "us.xai.grok-4.6"
  },
  "responseElements": null,
  "additionalEventData": {
    "inferenceRegion": "us-west-2",
    "inputTokens": 58,
    "outputTokens": 213
  },
  "requestID": "<masked>",
  "eventID": "<masked>",
  "readOnly": true,
  "resources": [
    {
      "accountId": "<masked>",
      "type": "AWS::Bedrock::Model",
      "ARN": "arn:aws:bedrock:us-east-1::foundation-model/xai.grok-4.6"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "<masked>",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "bedrock-runtime.us-east-1.amazonaws.com"
  }
}

The AWS CLI was updated to aws-cli/2.36.28 before this execution.

Data Retention Settings

Since model availability may vary depending on the data retention mode, we checked the account's data retention mode in us-east-1, where the US Geo inference profile was executed.

$ aws bedrock get-account-data-retention --region us-east-1

{
    "mode": "provider_data_share",
    "updatedAt": "2026-06-09T23:46:41.595000+00:00"
}

In this region, the account's data retention mode was provider_data_share. Next, we specified none as data_retention_mode in the additional-model-request-fields of the Converse request to verify whether it can be executed in zero data retention mode.

$ aws bedrock-runtime converse \
  --region us-east-1 \
  --model-id us.xai.grok-4.6 \
  --messages '[{"role":"user","content":[{"text":"ゼロデータ保持モードの動作確認です。日本語で「成功」とだけ返してください。"}]}]' \
  --additional-model-request-fields '{"data_retention_mode":"none"}'

The stopReason was end_turn, and we were able to obtain "成功" (success) as the response.

Differences in Supported Features

The features supported by the bedrock-runtime endpoint are described in the "Capabilities and Features" section of the Grok 4.6 model card.

Support status for the bedrock-runtime endpoint

Supported:
- Projects (default project only)
- Invocation logs
- Response streaming
- Prompt caching
- Reasoning

Not Supported:
- Server-side tool use
- Intelligent prompt routing
- Count tokens
- Structured outputs
- Application inference profiles

The same section also lists the support status for the bedrock-mantle endpoint covered in the preceding Mantle article (provided for reference and comparison).

Support status for the bedrock-mantle endpoint

Supported:
- Client-side tool calling
- Reasoning
- Projects
- Abuse detection
- Response streaming
- Structured outputs
- Prompt caching

According to the model card, Server-side tool use and Structured outputs are listed as Not Supported for the bedrock-runtime endpoint. If you need to use features only supported by bedrock-mantle, please use bedrock-mantle.

Pricing Differences

Global and US Geo also differ in pricing. The "Pricing" section of the model card lists the price per 1M tokens for the Standard tier.

Inference option	Input	Output	Cache read
In-Region	$2.20	$6.60	$0.55
Geo CRIS	$2.20	$6.60	$0.55
Global CRIS	$2.00	$6.00	$0.50

In-Region and Geo CRIS (us.xai.grok-4.6) are the same price, while Global CRIS (global.xai.grok-4.6) is approximately 10% cheaper for input, output, and cache read.

Summary

Grok 4.3 was only supported via bedrock-mantle. With Grok 4.6, bedrock-runtime is now also available as an option, making it possible to use it with a simple implementation using IAM authentication from the AWS CLI or SDK.

Additionally, it has become easier to integrate Grok 4.6 into workloads that use OpenAI or Anthropic models via Bedrock Runtime. According to xAI, Grok 4.6 offers benchmark performance comparable to Fabble5 and GPT5.6 Sol at a cost equivalent to Sonnet or Terra. Please give it a try.