AWS Builder Center

Builder Center

Getting Started with Kimi Code & Kimi K3 on Amazon Bedrock

Learn how to run Kimi K3 on Amazon Bedrock with Kimi Code CLI, choose an inference profile, configure bearer-token authentication, and fix common errors.

Agasthi Kothurkar

Principal Solutions Architect
Moonshot AI's Kimi K3 is  now available  on  Amazon Bedrock , making it possible to use the model through AWS-managed inference while working from your preferred development tools. For developers who prefer a terminal-based workflow, the Kimi Code CLI can connect to Bedrock through its OpenAI-compatible endpoint.
This hands-on guide walks through the complete setup: choosing a cross-Region inference profile, configuring a Bedrock bearer token, installing Kimi Code, updating  config.toml , and testing the connection. By the end, you will have Kimi Code CLI running Kimi K3 on Amazon Bedrock from your terminal.
This article's focus is on practical integration with Bedrock rather than model evaluation.

Why Kimi K3

According to Moonshot AI, Kimi K3 is its most capable model and the first open model to reach 2.8 trillion parameters. A few things make it well suited to long-running coding and knowledge workflows:
  • Massive scale: 2.8 trillion parameters, the first open-weight model on Bedrock at this size.
  • Native vision: image understanding is built in, not bolted on.
  • 1-million-token context window: sustain context across large repositories, documents, and images.
  • Efficiency: an approximate 2.5x improvement in scaling efficiency over Kimi K2.
  • Explicit prompt caching: Kimi K3 is the first open-weight model on Amazon Bedrock to support explicit prompt caching, reducing latency and input costs when you reuse context across model calls.

Setup Prerequisites

  • An active AWS account with Amazon Bedrock access, with the Kimi K3 model enabled.
  • A Bedrock API key for the CLI to authenticate with, or valid AWS credentials if you will generate a short-term key (see Step 1).
  • Python 3 if you will use the optional AWS token generator.
  • AWS Identity and Access Management (IAM) permissions to call the model:  bedrock:InvokeModel ,  bedrock:InvokeModelWithResponseStream , and  bedrock:CallWithBearerToken .

Choose a Kimi K3 inference profile on Amazon Bedrock

Kimi K3 is invoked through a cross-Region inference profile:
Profile
Model ID
When to use
Global
 global.moonshotai.kimi-k3 
Recommended for workloads without regional restrictions. Routes each request to any supported commercial AWS Region worldwide and costs approximately 10% less than a geographic profile.
US Geo
 us.moonshotai.kimi-k3 
Keeps processing within the US geography for data residency requirements.
For Kimi Code CLI workloads without data residency restrictions, use  global.moonshotai.kimi-k3 . Choose  us.moonshotai.kimi-k3  when processing must remain within the US geography.
See the  Bedrock documentation  for the full list of supported Regions.

Configure Kimi Code CLI for Amazon Bedrock

The following steps connect Kimi Code CLI to the Amazon Bedrock OpenAI-compatible endpoint so you can use Kimi K3 from your terminal. If you would rather call the model directly from code, Bedrock also exposes the Responses and Chat Completions APIs alongside the native Invoke and Converse APIs, and supports explicit prompt caching to cut latency and input cost on repeated context — see the  Resources  section for the API guide and sample code.

Step 1 - Configure a Bedrock bearer token

Kimi Code's OpenAI-compatible provider requires an Amazon Bedrock API key as a bearer token. It does not sign requests with AWS credentials directly.
Generate a short-term API key from Amazon Bedrock console > API keys, using the same AWS Region configured in  base_url . Set the standard Bedrock environment variable, then pass the same token to Kimi Code:
Bash
export AWS_BEARER_TOKEN_BEDROCK='<Your-Bedrock-API-Key>'
export KIMI_API_KEY="$AWS_BEARER_TOKEN_BEDROCK"
If  AWS_BEARER_TOKEN_BEDROCK  is already set to a valid token in your environment, only the second command is needed.
Alternatively, generate a short-term token from your default AWS credential chain. First install the AWS token generator and set the Region:
Bash
python3 -m pip install aws-bedrock-token-generator
export AWS_REGION=us-west-2
Before generating the token, verify that your AWS credentials are current:
Bash
aws sts get-caller-identity
This command must succeed. If it returns  ExpiredToken , refresh your AWS credentials using your normal sign-in method before continuing. See  Fix Kimi Code 401 authentication failures on Bedrock  for more details.
After the credential check succeeds, generate the token:
Bash
export KIMI_API_KEY="$(
  python3 -c 'from aws_bedrock_token_generator import provide_token; print(provide_token(region="us-west-2"))'
)"
If you use a Region other than  us-west-2 , update both this command and the  base_url  in Step 3.
Short-term keys remain valid for up to 12 hours, or until the underlying AWS session expires. Do not save them in  ~/.zshrc  or  ~/.bashrc , and avoid printing or sharing them. Because Kimi Code receives a fixed token through the environment, generate a new one and restart Kimi Code when it expires.
Amazon Bedrock also offers  long-term API keys , but AWS recommends using them only for exploration.

Step 2 - Install the Kimi Code CLI

Bash
curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash
Verify the install:
Bash
❯ kimi --version
2.0.1

Step 3 - Configure Kimi K3 in Kimi Code

The default configuration file is created at  ~/.kimi-code/config.toml . Update it with the entries below. Set  base_url  to your closest AWS Region based on capacity and model availability, and choose the model ID for the inference profile you want (see  Choosing an inference profile ). Tweak other config variables if needed ( Check Resources section for configuration documentation)
toml
default_model = "bedrock-kimi-k3"
default_permission_mode = "manual"
default_plan_mode = false
merge_all_available_skills = true
telemetry = false

[providers.bedrock]
type = "openai"
base_url = "https://bedrock-runtime.us-west-2.amazonaws.com/openai/v1"
api_key_env = "KIMI_API_KEY"

[models.bedrock-kimi-k3]
provider = "bedrock"
model = "global.moonshotai.kimi-k3"
max_context_size = 1048576
capabilities = ["thinking", "always_thinking", "image_in", "tool_use"]
display_name = "Kimi K3 on Bedrock"
You can confirm the file is valid at any time with the built-in validator:
Bash
> kimi doctor config
Kimi doctor

OK config.toml  /Users/xxxx/.kimi-code/config.toml

All checked config files are valid.
A valid file reports  OK config.toml  and  All checked config files are valid. 
Kimi Code CLI configured to run Kimi K3 on Amazon Bedrock

Figure 1: Kimi Code 2.0.1 configured to use Kimi K3 on Amazon Bedrock.

Step 4 - Test Kimi Code with Kimi K3 on Bedrock

Run a simple prompt to confirm everything is wired up:
Bash
kimi -p "What is Amazon Bedrock"
Example output:
plaintext
~/Documents/Code/Kimi* ❯ kimi -p "What is Amazon Bedrock"
kimi version 2.0.1

Amazon Bedrock is a fully managed AWS service for building generative AI applications. Instead of training or hosting models yourself, you call foundation models through a single API and AWS handles the infrastructure.

Key points:

- Model choice: foundation models from multiple providers — Anthropic (Claude), Meta (Llama), Mistral, Cohere, Amazon's own Nova/Titan models, and others — through one consistent API.
- Serverless: no servers or GPU clusters to provision. Pay per use (per token for most models), or provision throughput for predictable workloads.
- Customization: fine-tune some models with your own data, or use Retrieval-Augmented Generation (RAG) via Knowledge Bases to ground responses in your documents.
- Agents: Bedrock Agents let models take actions — calling your APIs, running Lambda functions, querying databases — to build multi-step workflows.
- Guardrails: configurable safety filters for content, topics, and PII redaction.
- Privacy: your prompts and data aren't used to train the base models, and data stays within your AWS Region/account boundaries.

Fix Kimi Code 401 authentication failures on Bedrock

If Kimi Code returns  401 Authentication failed: Please make sure your API Key is valid , first check the AWS credentials used to generate the token:
Bash
aws sts get-caller-identity
If this command returns  ExpiredToken , refresh your AWS credentials using your normal sign-in method. Then generate a new bearer token:
Bash
export KIMI_API_KEY="$(
  python3 -c 'from aws_bedrock_token_generator import provide_token; print(provide_token(region="us-west-2"))'
)"
The token generator signs locally and can produce a token even when the underlying temporary AWS credentials have expired. The resulting token looks valid, but Bedrock rejects it with an HTTP 401 response.
If your environment already contains a valid standard Bedrock token, pass it directly to Kimi Code:
Bash
export KIMI_API_KEY="$AWS_BEARER_TOKEN_BEDROCK"
Restart Kimi Code after exporting the replacement token.

Availability and pricing

Kimi K3 is available today on Amazon Bedrock through the US Geo ( us. ) and Global ( global. ) cross-Region inference profiles. For supported Regions, see the  Bedrock documentation . For pricing, see  Amazon Bedrock pricing .

Resources

# amazon-bedrock# large-language-model# agentic-ai# agentic-ide# openai-open-weight-models
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article