Cloud Provider Configuration

Cloud providers need extra fields on a provider target: a deployment name for Azure, a region for Bedrock, a project for Vertex AI, and so on. This page shows a minimal target for each cloud and the fields it adds. The shared target fields, routing, and fallback are in Provider Configuration.

Syntax

Get these values from your provider account first:

Provider	You need
Azure OpenAI	Resource URL, deployment name, a supported API version, and an API key
AWS Bedrock	Region, an enabled model ID, and AWS credentials that can invoke it
Vertex AI	Project, region, an enabled model, and Google credentials
Google AI Studio or Anthropic	Model ID and API key
Cloudflare Workers AI	Account ID, model ID, and API token
Snowflake Cortex	Account identifier, an enabled model, and a credential

Copy the target for your provider into providers.targets and replace the account values. model must be a model that your account can use. After the gateway loads the file, the model shows in /v1/models.

Put API keys in environment variables that secret_key_ref.env names, in the process that starts the gateway. Bedrock and Vertex AI use their own cloud authentication instead.

Fields

Azure OpenAI

Inside policy-config.yaml

providers:
  targets:
    - id: azure-primary
      provider: azure
      provider_type: azure-openai
      format: openai
      model: your-azure-openai-model
      base_url: https://replace-with-resource-name.openai.azure.com
      secret_key_ref:
        env: VERDICTAN_AZURE_OPENAI_API_KEY
      azure_api_version: your-supported-api-version
      azure_deployment: your-azure-deployment

Field	Type	Default	Description
base_url	string		Azure resource URL
azure_api_version	string	2024-02-01 at runtime	API version on the deployment route. Set a version that your resource supports. With gateway 0.1.26 or later, /v1/responses requests use the Azure v1 route, which does not send a dated version. See Azure OpenAI.
azure_deployment	string	The model value	Deployment name in the request path
path_template	string	Profile default	Request path with a {model} placeholder

AWS Bedrock

Inside policy-config.yaml

providers:
  targets:
    - id: bedrock-claude
      provider: aws-bedrock
      provider_type: aws-bedrock
      format: anthropic
      model: anthropic.replace-with-bedrock-model-id
      base_url: https://bedrock-runtime.us-east-1.amazonaws.com
      aws_region: us-east-1
      bedrock_model_family: anthropic_messages

Field	Type	Default	Description
aws_region	string		Region for SigV4 signing. Required. The gateway does not take it from AWS_REGION.
bedrock_model_family	anthropic_messages		Request contract. This is the only value.
aws_profile	string	Default chain	Named profile in the AWS credential chain
aws_access_key_env, aws_secret_key_env	string		Names of the environment variables that hold the access key ID and the secret access key. Set both or neither.
aws_session_token_env	string		Name of the environment variable that holds a session token. Needs the other two fields.

Bedrock targets do not use secret_key_ref or api_key_prefix. The gateway signs with the variables that the credential fields name. Without these fields, it uses AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN, then the AWS credential chain. SageMaker targets use the same fields and order. Check that the model family and request type are available in your region before rollout.

Google Vertex AI

Inside policy-config.yaml

providers:
  targets:
    - id: vertex-gemini
      provider: vertex-ai
      provider_type: google-vertex
      format: google-gemini
      model: your-gemini-model
      gcp_project: my-gcp-project
      gcp_region: us-central1

Field	Type	Default	Description
gcp_project	string		Project ID in the Vertex AI endpoint. Lint requires it.
gcp_region	string	us-central1	Region in the Vertex AI endpoint

Vertex AI targets use Google authentication, not secret_key_ref.

Google AI Studio

Inside policy-config.yaml

providers:
  targets:
    - id: gemini-studio
      provider: google-ai-studio
      provider_type: google-ai-studio
      format: google-gemini
      model: your-gemini-model
      secret_key_ref:
        env: VERDICTAN_GOOGLE_AI_STUDIO_API_KEY

AI Studio needs only the shared fields. The gateway sends the key in the x-goog-api-key header and uses the google-gemini wire format.

Anthropic

Inside policy-config.yaml

providers:
  targets:
    - id: anthropic-prod
      provider: anthropic
      provider_type: anthropic
      format: anthropic
      model: your-anthropic-model
      secret_key_ref:
        env: VERDICTAN_ANTHROPIC_API_KEY
      anthropic_version: "2023-06-01"

Field	Type	Default	Description
anthropic_version	string	2023-06-01	Value of the anthropic-version header
api_key_header	string	x-api-key	Header that carries the key
api_key_prefix	string	Empty	Text before the key

Cloudflare AI

Inside policy-config.yaml

providers:
  targets:
    - id: cloudflare-llm
      provider: cloudflare-ai
      provider_type: cloudflare-ai
      format: openai
      model: your-cloudflare-model
      cloudflare_account_id: your-cloudflare-account-id
      secret_key_ref:
        env: VERDICTAN_CLOUDFLARE_AI_API_KEY

Field	Type	Default	Description
cloudflare_account_id	string	CLOUDFLARE_ACCOUNT_ID variable	Account ID for the base URL
cloudflare_account_id_env	string		Name of a variable that holds the account ID

Without base_url, the gateway uses https://api.cloudflare.com/client/v4/accounts/{account_id}/ai/v1.

Snowflake Cortex

Inside policy-config.yaml

providers:
  targets:
    - id: snowflake-llm
      provider: snowflake-cortex
      model: your-snowflake-model
      snowflake_account_identifier: myorg-myaccount
      secret_key_ref:
        env: VERDICTAN_SNOWFLAKE_API_KEY

Field	Type	Description
snowflake_account_identifier	string	Account identifier for the base URL
snowflake_account_identifier_env	string	Name of a variable that holds the identifier

Without base_url, the gateway uses https://{account_identifier}.snowflakecomputing.com.

Provider type and wire format

Set provider_type only when the gateway picks the wrong profile from provider and base_url, for example for an OpenAI-compatible endpoint on your own host:

Inside policy-config.yaml

providers:
  targets:
    - id: custom-openai-compatible
      provider: my-custom-provider
      provider_type: openai
      format: openai
      base_url: https://llm.example.com
      model: your-provider-model
      secret_key_ref:
        env: VERDICTAN_CUSTOM_PROVIDER_KEY

Field	Values
provider_type	openai, anthropic, cohere, huggingface, replicate, databricks, watsonx, aws-bedrock, google-ai-studio, google-vertex, sagemaker, azure-openai, cloudflare-ai, snowflake-cortex, generic
format	openai, anthropic, cohere, huggingface, replicate, watsonx, google-gemini

format is the native wire format of the target. The gateway translates between the client's format and this one. format: anthropic selects the Anthropic contract but does not replace the provider fields above.

Other target fields

Field	Type	Default	Description
allow_insecure_tls	boolean	false	Skips TLS verification. Never use it in production.
region	string		Region label for region routing rules
weight	number	1.0	Weight for weighted_round_robin
timeout_seconds	integer	30	Request timeout
stream_timeout_seconds	integer	timeout_seconds	Timeout for streaming requests
quantizations	array of strings		fp32, fp16, bf16, int8, or int4

Examples

Multi-cloud pack

This example needs three cloud accounts. Verify each target alone before you combine them.

Show a three-provider configuration

policy-config.yaml

pack:
  name: multi-cloud
  version: 1.0.0
  enabled: true
providers:
  targets:
  - id: azure-prod
    provider: azure
    provider_type: azure-openai
    format: openai
    model: your-azure-openai-model
    base_url: https://replace-with-resource-name.openai.azure.com
    secret_key_ref:
      env: VERDICTAN_AZURE_OPENAI_API_KEY
    azure_deployment: your-azure-deployment
    azure_api_version: your-supported-api-version
  - id: vertex-eu
    provider: vertex-ai
    provider_type: google-vertex
    format: google-gemini
    model: your-gemini-model
    gcp_project: your-gcp-project
    gcp_region: europe-west4
  - id: cloudflare-edge
    provider: cloudflare-ai
    provider_type: cloudflare-ai
    format: openai
    model: your-cloudflare-model
    cloudflare_account_id: your-cloudflare-account-id
    secret_key_ref:
      env: VERDICTAN_CLOUDFLARE_AI_API_KEY
  routing:
    strategy: ordered
policies:
  chain:
  - audit-logger
policy:
  audit-logger: {}

With ordered routing, a failure moves the request to the next eligible target under the provider attempt rules. To stop at the first eligible target, set providers.routing.allow_fallbacks: false.

Verify the connection

1. Run verdictan policy lint --file policy-config.yaml.
2. Apply the file to a test agent with the config-first workflow.
3. List the gateway models with an application token. Your model is in the list.
4. Send a short request with stream: false for that model. Find the answer and the selected provider in the runtime event.

Lint checks structure only. The request proves the account, region, permissions, endpoint, and translation. If it fails, compare those values with the provider's account settings before you add fallback targets.

Limits and failure behavior

• The schema also lists awq, gptq, and gguf for quantizations, but the gateway rejects them at load time. The gateway accepts fp8, which lint rejects. Use only the five values in the table.
• Bedrock and Vertex AI targets need cloud credentials in the gateway environment. Lint does not check them.
• format and provider_type are independent. A wrong format makes every request to the target fail.
• Retention and training terms in data_policy are your declarations. The gateway does not verify them. See Data Routing Policy.

Next steps

• Provider Configuration: routing, fallback, model groups, and shared fields.
• Execution Targets and Runners: local and SDK execution targets.