AI Provider

Hud's agentic workflows — PR analysis and remediation — run on Claude, using your own AI provider account. Model usage is billed to that account, and nothing runs until a provider is connected.

You can connect Claude in one of three ways:

To connect one, go to Settings → Agentic Workflows in Hud and open AI Provider.

📘

One provider per account

The AI provider applies to all agentic workflows in your Hud account. Saving a new provider replaces the previous one.

We'll add support for more models and AI providers over time. If you need help setting up your provider, contact [email protected].

Claude Code (Anthropic API key)

1. Create an API key in the Anthropic Console.
2. In Hud, select Claude Code, paste the key, and save.

Claude Code on Bedrock (Bedrock API key)

1. In the AWS console, open Amazon Bedrock → API keys and create a long-term API key. Short-term keys expire within hours, and workflows stop running when they do.
2. Make sure the key's identity can invoke Claude models. See Bedrock permissions.
3. In Hud, select Claude Code on Bedrock, set Authentication to API key, paste the key, enter the Region, and save.

Claude Code on Bedrock (IAM role)

Instead of sharing a key, you create an IAM role in your AWS account and let Hud assume it. Hud gets short-lived credentials each time it runs a workflow, and you can revoke access at any time by editing or deleting the role.

1. Get your values from Hud

In Hud, open AI Provider, select Claude Code on Bedrock, and set Authentication to IAM role. The drawer shows the values your role's trust policy needs:

• Hud AWS account IDs — your role must trust both.
• Your account's External ID — a unique ID Hud generates for your account. It makes sure only Hud, acting for your account, can assume the role.

Keep the drawer open; you'll come back to it in the last step.

2. Create the role

In the AWS console, go to IAM → Roles → Create role and choose Custom trust policy. Paste this policy, replacing the placeholders with the values from the drawer:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::<HUD_AWS_ACCOUNT_ID_1>:root",
          "arn:aws:iam::<HUD_AWS_ACCOUNT_ID_2>:root"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "sts:ExternalId": "<EXTERNAL_ID>" }
      }
    }
  ]
}

3. Grant Bedrock access

Attach a permissions policy that lets the role invoke Claude models. See Bedrock permissions for a ready-to-use policy.

4. Tag the role

Add the tag hud = allowed to the role. Hud only assumes roles that have this tag.

5. Connect it in Hud

Back in the AI Provider drawer, paste the Role ARN (for example arn:aws:iam::123456789012:role/HudBedrockAccess), enter the Region (for example us-east-1), and save.

Bedrock permissions

Both Bedrock options need permission to invoke Anthropic Claude models. Hud runs several Claude models (Opus and Sonnet) and adds newer ones over time, so allow all Claude models rather than specific versions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:*:*:inference-profile/*anthropic.claude-*",
        "arn:aws:bedrock:*::foundation-model/anthropic.claude-*"
      ]
    }
  ]
}

Things to know:

• Pick a us- or eu- region. Hud calls Claude through Bedrock's cross-region inference profiles: eu. profiles for eu- regions and us. profiles for all other regions.
• Keep the region wildcard (*) in the policy. Cross-region inference can route a request to any region in the profile, so the role needs access in all of them.
• Make sure Claude is available in your AWS account. If you haven't used Anthropic models on Bedrock before, AWS may ask you to submit a short use-case form in the Bedrock console first.

Good to know

• API keys are stored encrypted and are never shown again after you save them — the settings page only shows the last 4 characters. To change a setting such as the region, re-enter the key.
• Removing the AI provider stops all agentic workflows until you connect a new one.