I Tried Grok 4.6 on Amazon Bedrock Runtime Using the AWS CLI
This page has been translated by machine translation. View original
Introduction
In August 2026, xAI's Grok 4.6 became available on Amazon Bedrock.
An earlier article covered the results of trying Grok 4.6 on the bedrock-mantle endpoint.
In this article, I used aws bedrock-runtime converse in the AWS CLI to check whether Grok 4.6 can be used on the bedrock-runtime endpoint with IAM authentication alone.
What I Verified
Test Environment
| Item | Value |
|---|---|
| OS / architecture | Linux 7.1.6-400.asahi.fc44.aarch64+16k aarch64 |
| AWS CLI version | aws-cli/2.36.25 |
Global Inference Profile
First, I checked from the Tokyo Region whether the Global inference profile global.xai.grok-4.6 was in a usable state.
$ aws bedrock get-inference-profile \
--region ap-northeast-1 \
--inference-profile-identifier global.xai.grok-4.6
{
"inferenceProfileName": "Global xAI Grok 4.6",
"description": "Routes requests to Grok 4.6 globally across all supported AWS Regions.",
"createdAt": "2026-08-18T23:30:25.922000+00:00",
"updatedAt": "2026-08-18T23:30:25.922000+00:00",
"inferenceProfileArn": "arn:aws:bedrock:ap-northeast-1:<account-id>:inference-profile/global.xai.grok-4.6",
"models": [
{
"modelArn": "arn:aws:bedrock:::foundation-model/xai.grok-4.6"
},
{
"modelArn": "arn:aws:bedrock:ap-northeast-1::foundation-model/xai.grok-4.6"
}
],
"inferenceProfileId": "global.xai.grok-4.6",
"status": "ACTIVE",
"type": "SYSTEM_DEFINED"
}
The status was ACTIVE. The profile is in a usable state, and whether it can actually be invoked is checked in the next section. The account ID has been replaced with <account-id>.
Running Converse
Next, I sent an actual inference request with aws bedrock-runtime converse.
$ aws bedrock-runtime converse \
--region ap-northeast-1 \
--model-id global.xai.grok-4.6 \
--messages '[{"role":"user","content":[{"text":"動作確認です。日本語で「Grok 4.6 on Amazon Bedrock は利用可能です」と一文だけ返してください。"}]}]'
{
"output": {
"message": {
"role": "assistant",
"content": [
{
"reasoningContent": {
"redactedContent": "<base64、記事には転記しない>"
}
},
{
"text": "Grok 4.6 on Amazon Bedrock は利用可能です"
}
]
}
},
"stopReason": "end_turn",
"usage": {
"inputTokens": 58,
"outputTokens": 222,
"totalTokens": 280,
"cacheReadInputTokens": 0
},
"metrics": {
"latencyMs": 23082
}
}
stopReason was end_turn, so it finished normally, and it responded in Japanese to the Japanese prompt. All I used was the default profile set up with aws configure, or temporary credentials obtained with aws sso login. I didn't need to issue a Bearer Token (API key) or install any tools other than the AWS CLI. The response includes reasoningContent.redactedContent, which holds the encrypted reasoning content.
CloudTrail Records
I checked how the Converse call was recorded in CloudTrail, in particular which Region the Global inference profile routed the request to.
$ aws cloudtrail lookup-events \
--region ap-northeast-1 \
--lookup-attributes AttributeKey=EventName,AttributeValue=Converse \
--max-results 10
Here is an excerpt of the retrieved events, covering the part that corresponds to the Converse run in the previous section.
{
"eventName": "Converse",
"awsRegion": "ap-northeast-1",
"requestParameters": {
"modelId": "global.xai.grok-4.6"
},
"additionalEventData": {
"inferenceRegion": "us-west-2",
"inputTokens": 58,
"outputTokens": 222
},
"managementEvent": true,
"eventCategory": "Management"
}
The request's awsRegion is ap-northeast-1. additionalEventData.inferenceRegion is us-west-2, which shows that the Global inference profile routed this request to Oregon. Since eventCategory is Management and managementEvent is true, this call was recorded as a management event, and no additional data event configuration was needed. The token counts in additionalEventData match the usage from the previous section, confirming that this is the record of the same call. Every Converse call I tried in this session had an inferenceRegion of us-west-2.
Full CloudTrail event (sensitive information masked)
{
"eventVersion": "1.11",
"userIdentity": "<masked>",
"eventTime": "2026-08-21T11:20:00Z",
"eventSource": "bedrock.amazonaws.com",
"eventName": "Converse",
"awsRegion": "ap-northeast-1",
"sourceIPAddress": "<masked>",
"userAgent": "aws-cli/2.36.25 md/awscrt#0.36.2 ua/2.1 os/linux#7.1.6-400.asahi.fc44.aarch64+16k ... md/command#bedrock-runtime.converse",
"requestParameters": {
"modelId": "global.xai.grok-4.6"
},
"responseElements": null,
"additionalEventData": {
"inferenceRegion": "us-west-2",
"inputTokens": 58,
"outputTokens": 222
},
"requestID": "<masked>",
"eventID": "<masked>",
"readOnly": true,
"resources": [
{
"accountId": "<masked>",
"type": "AWS::Bedrock::Model",
"ARN": "arn:aws:bedrock:ap-northeast-1::foundation-model/xai.grok-4.6"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "<masked>",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "bedrock-runtime.ap-northeast-1.amazonaws.com"
}
}
US Geo Inference Profile
Since Global worked without any problems, I'll check whether the other option, the US Geo inference profile us.xai.grok-4.6, works with the same steps.
$ aws bedrock get-inference-profile \
--region us-east-1 \
--inference-profile-identifier us.xai.grok-4.6
{
"inferenceProfileName": "US xAI Grok 4.6",
"description": "Routes requests to Grok 4.6 in us-east-1, us-east-2, us-west-2.",
"createdAt": "2026-08-18T23:28:38.594000+00:00",
"updatedAt": "2026-08-18T23:28:38.594000+00:00",
"inferenceProfileArn": "arn:aws:bedrock:us-east-1:<account-id>:inference-profile/us.xai.grok-4.6",
"models": [
{
"modelArn": "arn:aws:bedrock:us-east-1::foundation-model/xai.grok-4.6"
},
{
"modelArn": "arn:aws:bedrock:us-east-2::foundation-model/xai.grok-4.6"
},
{
"modelArn": "arn:aws:bedrock:us-west-2::foundation-model/xai.grok-4.6"
}
],
"inferenceProfileId": "us.xai.grok-4.6",
"status": "ACTIVE",
"type": "SYSTEM_DEFINED"
}
The status was ACTIVE. From the description and models, we can see that this profile is configured to route requests to three Regions: us-east-1, us-east-2, and us-west-2.
Running on US Geo
I ran Converse in the same way as with Global and also looked at the CloudTrail record.
$ aws bedrock-runtime converse \
--region us-east-1 \
--model-id us.xai.grok-4.6 \
--messages '[{"role":"user","content":[{"text":"動作確認です。日本語で「Grok 4.6 on Amazon Bedrock は利用可能です」と一文だけ返してください。"}]}]'
{
"output": {
"message": {
"role": "assistant",
"content": [
{
"reasoningContent": {
"redactedContent": "<base64、記事には転記しない>"
}
},
{
"text": "Grok 4.6 on Amazon Bedrock は利用可能です"
}
]
}
},
"stopReason": "end_turn",
"usage": {
"inputTokens": 58,
"outputTokens": 213,
"totalTokens": 271,
"cacheReadInputTokens": 0
},
"metrics": {
"latencyMs": 3783
}
}
stopReason was end_turn, and from us-east-1, Converse worked with IAM authentication alone via the US Geo inference profile, just as it did with Global.
Here is an excerpt of the corresponding CloudTrail event.
$ aws cloudtrail lookup-events \
--region us-east-1 \
--lookup-attributes AttributeKey=EventName,AttributeValue=Converse \
--max-results 10
{
"eventName": "Converse",
"awsRegion": "us-east-1",
"requestParameters": {
"modelId": "us.xai.grok-4.6"
},
"additionalEventData": {
"inferenceRegion": "us-west-2",
"inputTokens": 58,
"outputTokens": 213
},
"managementEvent": true,
"eventCategory": "Management"
}
The request's awsRegion was us-east-1 and the inferenceRegion was us-west-2. This is the same result as the Global run; which of the three Regions a request goes to depends on the timing of the run.
Full CloudTrail event (sensitive information masked)
{
"eventVersion": "1.11",
"userIdentity": "<masked>",
"eventTime": "2026-08-21T12:28:40Z",
"eventSource": "bedrock.amazonaws.com",
"eventName": "Converse",
"awsRegion": "us-east-1",
"sourceIPAddress": "<masked>",
"userAgent": "aws-cli/2.36.28 md/awscrt#0.36.2 ua/2.1 os/linux#7.1.6-400.asahi.fc44.aarch64+16k ... md/command#bedrock-runtime.converse",
"requestParameters": {
"modelId": "us.xai.grok-4.6"
},
"responseElements": null,
"additionalEventData": {
"inferenceRegion": "us-west-2",
"inputTokens": 58,
"outputTokens": 213
},
"requestID": "<masked>",
"eventID": "<masked>",
"readOnly": true,
"resources": [
{
"accountId": "<masked>",
"type": "AWS::Bedrock::Model",
"ARN": "arn:aws:bedrock:us-east-1::foundation-model/xai.grok-4.6"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "<masked>",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "bedrock-runtime.us-east-1.amazonaws.com"
}
}
Before this run, I updated the AWS CLI to aws-cli/2.36.28.
Data Retention Settings
Because model availability can change depending on the data retention mode, I checked the account's data retention mode in us-east-1, where I ran the US Geo inference profile.
$ aws bedrock get-account-data-retention --region us-east-1
{
"mode": "provider_data_share",
"updatedAt": "2026-06-09T23:46:41.595000+00:00"
}
In this Region, the account's data retention mode was provider_data_share. Next, I specified none as data_retention_mode in the additional-model-request-fields of the Converse request and checked whether it could run in zero data retention mode.
$ aws bedrock-runtime converse \
--region us-east-1 \
--model-id us.xai.grok-4.6 \
--messages '[{"role":"user","content":[{"text":"ゼロデータ保持モードの動作確認です。日本語で「成功」とだけ返してください。"}]}]' \
--additional-model-request-fields '{"data_retention_mode":"none"}'
stopReason was end_turn, and I got "成功" ("success") as the response.
Differences in Supported Features
The features supported on the bedrock-runtime endpoint are listed in the "Capabilities and Features" section of the Grok 4.6 model card.
bedrock-runtime エンドポイントでのサポート状況
Supported:
- Projects (default project only)
- Invocation logs
- Response streaming
- Prompt caching
- Reasoning
Not Supported:
- Server-side tool use
- Intelligent prompt routing
- Count tokens
- Structured outputs
- Application inference profiles
The same section also lists the support status for the bedrock-mantle endpoint covered in the earlier Mantle article (quoted here for reference and comparison).
bedrock-mantle エンドポイントでのサポート状況
Supported:
- Client-side tool calling
- Reasoning
- Projects
- Abuse detection
- Response streaming
- Structured outputs
- Prompt caching
According to the model card, Server-side tool use and Structured outputs are Not Supported on the bedrock-runtime endpoint. If you want to use features that only bedrock-mantle supports, use bedrock-mantle.
Pricing Differences
Global and US Geo also differ in price. The "Pricing" section of the model card lists Standard tier prices per 1M tokens.
| Inference option | Input | Output | Cache read |
|---|---|---|---|
| In-Region | $2.20 | $6.60 | $0.55 |
| Geo CRIS | $2.20 | $6.60 | $0.55 |
| Global CRIS | $2.00 | $6.00 | $0.50 |
In-Region and Geo CRIS (us.xai.grok-4.6) cost the same, while Global CRIS (global.xai.grok-4.6) is about 10% cheaper for input, output, and cache reads.
Summary
Grok 4.3 was supported only on bedrock-mantle. With Grok 4.6, bedrock-runtime is now also an option, so you can use it from the AWS CLI or SDKs with a simple implementation that relies on IAM authentication.
It has also become easier to incorporate Grok 4.6 into workloads that already use OpenAI or Anthropic models on Bedrock Runtime. According to xAI, Grok 4.6 offers benchmark performance comparable to Fabble5 and GPT5.6 Sol at a cost equivalent to Sonnet and Terra. Please give it a try.
