Skip to main content
Last updated on

Tutorial: Onboard Amazon Bedrock Mantle to Unity Gateway

In this tutorial, you connect Amazon Bedrock Powered by AWS Mantle (Bedrock Mantle) to Unity Gateway so your team can use its models. Mantle is Amazon Bedrock's engine for running model requests. You set up authentication, choose who has access, and send a test request in your browser.

This tutorial authenticates with an AWS role through a Unity Catalog service credential. For other providers and authentication options, see Create and manage providers.

Requirements​

You need:

  • A Databricks workspace enabled for Unity Catalog, with access to Unity Gateway and Unity Catalog.
  • An approved catalog and schema in Unity Catalog, with USE CATALOG on the catalog and USE SCHEMA and CREATE SERVICE on the schema. If needed, ask your administrator to create a catalog or create a schema.
  • To create a credential in step 3, the CREATE SERVICE CREDENTIAL privilege on the metastore, or an administrator who completes that step for you.
  • To configure the AWS role in steps 2 and 3, permission to create an AWS Identity and Access Management (IAM) role, attach policies, and update its trust policy, or an AWS administrator who completes those tasks.
  • Access to Claude Haiku 4.5 on the Bedrock Mantle endpoint in your workspace's AWS region. Complete the model's Amazon Bedrock prerequisites.
  • A Databricks account group to receive access to the provider.

This tutorial uses bedrock_mantle for the provider and bedrock_mantle_credential for the service credential. Use your organization's approved names. Replace <catalog>, <schema>, and <team-group> with your catalog, schema, and account group. Replace <provider-owner> with the email address or application ID of the user or service principal that registers and owns the provider.

If you already have a service credential for Mantle, ask its owner to check the service credential requirements. Complete step 1, then continue at step 4 using that credential.

Step 1: Choose the example model and region​

Use these settings with the Anthropic Messages API:

Setting

Example value

AWS region

us-east-1 (US East, N. Virginia)

Model

Claude Haiku 4.5

Mantle model ID

anthropic.claude-haiku-4-5

API

Anthropic Messages

Setting

Example value

AWS region

us-east-1 (US East, N. Virginia)

Model

Claude Haiku 4.5

Mantle model ID

anthropic.claude-haiku-4-5

API

Anthropic Messages

The example uses us-east-1. Use your workspace's AWS region for both the IAM policy and the provider. For a different region or model, check Amazon Bedrock endpoints and choose a Mantle model that supports Anthropic Messages. You verify model access by sending the request in step 6.

Step 2: Create an AWS IAM role​

Your AWS administrator completes this step unless you have the required IAM permissions.

  1. Follow Create an IAM role to create a dedicated role with a temporary trust policy. Use the permissions policy below instead of the AWS Glue or Secrets Manager examples.

  2. Record the role's Amazon Resource Name (ARN).

  3. Create an IAM permissions policy from this JSON. Replace <aws-region>, <aws-account-id>, and <iam-role-name> with your values. Include any role path in <iam-role-name>.

    JSON
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "InvokeBedrockMantle",
          "Effect": "Allow",
          "Action": "bedrock-mantle:CreateInference",
          "Resource": "arn:aws:bedrock-mantle:<aws-region>:<aws-account-id>:project/*"
        },
        {
          "Sid": "AssumeThisRole",
          "Effect": "Allow",
          "Action": "sts:AssumeRole",
          "Resource": "arn:aws:iam::<aws-account-id>:role/<iam-role-name>"
        }
      ]
    }

    Have your AWS administrator restrict the policy to your organization's approved projects and models. See Bedrock Mantle IAM permissions.

  4. Attach the policy to the IAM role.

Step 3: Create and validate a service credential​

If an administrator creates the credential for you, have them complete all three sections below before you continue to step 4.

Create the credential​

  1. Go to Catalog > Connect > Credentials.
  2. Click Create credential and select Service Credential.
  3. Enter bedrock_mantle_credential in Credential name and the role ARN from step 2 in IAM role (ARN).
  4. Click Create.
  5. In the role-configuration instructions, click Copy policy to copy the Trust policy JSON. Keep the instructions open.

Update the role's trust policy​

Your AWS administrator completes this section.

  1. In the AWS IAM console, open the role you created in step 2.

  2. Open Trust relationships and click Edit trust policy.

  3. Replace the temporary trust policy with the complete JSON copied from Databricks, then click Update policy.

    If you reuse a role, follow Update the IAM role policy to preserve trust statements that other workloads require.

Validate the credential and grant access​

The service credential owner or metastore administrator completes these checks and grants:

  1. Return to Catalog > Connect > Credentials and open bedrock_mantle_credential.

  2. Click Validate Configuration. If checks fail, compare the role's trust policy with the generated policy and retry before continuing.

  3. If the credential is restricted to specific workspaces, add your workspace to its bindings.

  4. If someone else registers and owns the provider, grant them ACCESS on the credential:

    SQL
    GRANT ACCESS ON SERVICE CREDENTIAL bedrock_mantle_credential
    TO `<provider-owner>`;

The provider's owner must retain ACCESS on the credential.

Step 4: Register the model provider service​

Unity Gateway saves your provider's connection settings as a model provider service in Unity Catalog.

  1. In the workspace sidebar, click Unity Gateway.
  2. Open the Providers tab and click Provider.
  3. Enter bedrock_mantle as the name, and select your approved catalog and schema.
  4. Select Amazon Bedrock Mantle as the provider.
  5. Enter us-east-1, or the workspace region selected in step 1, in AWS region.
  6. Set Auth method to Service credential and select bedrock_mantle_credential or your existing credential.
  7. Under Models, clear Allow all and auto-import new models.
  8. Select anthropic.claude-haiku-4-5, or the model from step 1.
  9. Click Create.

Open <catalog>.<schema>.bedrock_mantle in Catalog Explorer and confirm its provider and model.

Step 5: Grant access​

  1. In the model provider service's Permissions tab, click Grant.
  2. In Principals, select your account group.
  3. Under Privileges, select EXECUTE.
  4. Click Confirm.
  5. Ask the catalog or schema owner to grant the group USE CATALOG and USE SCHEMA if it does not already have them.

An administrator with grant permissions can also run:

SQL
GRANT USE CATALOG ON CATALOG <catalog> TO `<team-group>`;
GRANT USE SCHEMA ON SCHEMA <catalog>.<schema> TO `<team-group>`;
GRANT EXECUTE ON MODEL PROVIDER SERVICE <catalog>.<schema>.bedrock_mantle
TO `<team-group>`;

These grants let the group query the provider without access to the service credential. See Discover and govern access to external model providers (model provider services).

Step 6: Test the provider in your browser​

This test incurs AWS usage charges. Ensure any applicable Unity Gateway budget has capacity. After testing, you can clean up tutorial resources.

  1. In Catalog Explorer, open <catalog>.<schema>.bedrock_mantle.

  2. On the Overview tab, under Make your first request, select the model from step 1. If an API selector appears, select Anthropic Messages.

  3. Click Try in Browser.

  4. Replace the contents of Request with this complete JSON object:

    JSON
    {
      "model": "anthropic.claude-haiku-4-5",
      "max_tokens": 256,
      "messages": [
        {
          "role": "user",
          "content": "Say hello in one sentence."
        }
      ]
    }

    To change the prompt, edit messages[0].content. If you chose another model, update model with its Mantle model ID.

  5. Click Send request.

  6. Confirm that Response includes an assistant message. The response text varies, but the structure matches this excerpt:

    JSON
    {
      "type": "message",
      "role": "assistant",
      "content": [
        {
          "type": "text",
          "text": "Hello! How can I help you today?"
        }
      ]
    }

  7. Have a group member repeat the test with their own Databricks identity to verify access.

If the request fails, check the matching item:

  • For a role-assumption error, recheck credential validation and the generated trust policy.
  • For a Databricks permission error, check the caller's catalog, schema, and provider grants, the owner's ACCESS on the credential, and the credential's workspace bindings.
  • For an AWS access-denied error, check the IAM policy for bedrock-mantle:CreateInference and your AWS model access.
  • For a model-not-found or unsupported-API error, check the Mantle model ID, region, selected model, and request format.
  • For a budget-block error, review the applicable budget before retrying.

Optional: Clean up​

If you created resources only for this tutorial, remove them when you finish:

  1. Open the provider in Unity Gateway or Catalog Explorer and select Delete from its menu.
  2. If no other resources use the service credential, delete it.
  3. Ask your AWS administrator to remove the dedicated IAM role and policy after checking that no other workloads use them.
  4. Ask the catalog or schema owner to revoke only tutorial-specific grants that the group no longer needs. Keep the approved catalog, schema, and any pre-existing grants.

Next steps​

On this page