Grok 4.7 on Amazon Bedrock: Model ID, Pricing, Regions and Code

Yes, Grok is on Amazon Bedrock. xAI's Grok 4.7 joined the Bedrock model catalog on September 28, 2026, one week after xAI released it on September 21. It costs $2 per million input tokens and $6 per million output tokens with global routing, takes a 500,000-token context window, reads text and images, and thinks at four effort levels: low, medium, high and xhigh. You call it as global.xai.grok-4.7 or us.xai.grok-4.7, never the bare model ID. Here is the part that catches people on the first day: Grok on Bedrock speaks the OpenAI SDK, not an xAI one, and an AWS setup that works for every other Bedrock model can still be refused for Grok because of a permission most IAM policies have never needed.

Ethan's team builds a document-review tool for a small legal firm. They had tried Grok 4.6 through xAI's own API in the summer and liked how it handled long contracts, but the firm's IT lead would only sign off on a model that billed through the firm's existing AWS account and stayed inside its IAM rules. When Grok 4.7 appeared on Bedrock, Ethan asked Jake to move the prototype over before Friday. Jake expected an afternoon. The code change took ten minutes. The rest of the afternoon went on a base URL, an access error that named a resource nobody had heard of, and a price estimate that came out twice as high as the xAI pricing page suggested. This page is that afternoon, written down so yours stays short: what Grok 4.7 is, the exact model IDs, what it costs on Bedrock, working code for every API, the Regions, the features that are and are not there, and every error we hit, in order.

New to Bedrock itself? The plain-English guide to Amazon Bedrock explains the idea in ten minutes: one AWS service that rents you models from many companies, billed on your AWS account and governed by IAM. Grok arriving on that shelf is the news. The shelf rules are the same ones that apply to every other model there, and most of the surprises below come from those rules, not from Grok.

What Grok 4.7 is, and when it came out

Grok 4.7 is xAI's frontier model, built for coding, agentic tasks and knowledge work. It takes text and images as input and returns text. It is the successor to Grok 4.6, and xAI's own pitch for it is long-running agents: work that takes many steps over a long stretch of time, where the model has to plan, notice its own mistakes and recover, rather than answer one question and stop. In plain terms, it is the model xAI wants you to hand a whole repository, a stack of documents or a browser session, not just a chat prompt.

The dates matter because search results for the Grok 4.7 release date are a mess. Early reports in September pointed at a launch around September 12, 2026, and that date still shows up in old articles and prediction-market threads. It did not happen then. xAI released Grok 4.7 on September 21, 2026, through its own API, Grok Build, Cursor and a list of partner platforms. Amazon Web Services added it to Bedrock on September 28, 2026. So if you are asking "is Grok 4.7 out?" the answer is yes, and has been since September 21; if you are asking whether it is on Bedrock, the answer is yes since September 28.

One thing that confuses people searching for "grok 4.7 news" is that the consumer Grok app is a different product from the model. At launch, xAI said the grok.com site and the mobile apps would move to Grok 4.7 at a later date and were still running Grok 4.6. If you are a developer, that does not matter: the API, Bedrock and the coding tools have had 4.7 since launch. If you are a casual user wondering why the app does not feel different, that is why.

What changed from Grok 4.6, in the order that matters for most teams:

• A larger base model. xAI moved Grok 4.7 to a new, larger base model, reported at about 2.1 trillion parameters, and trained it longer on multi-hour tasks.
• Better repo-scale coding. More dependable work across whole codebases, with planning and error recovery, which is where the coding benchmark gains below come from.
• Mixed-document handling. Better at documents that combine text, tables and images, and at producing documents and presentations.
• Browser-use agents. Better at filling in forms and navigating web portals when used as an agent with a browser tool.
• Wider effort levels. The four reasoning effort settings are spaced further apart than on Grok 4.6, so the difference between low and xhigh is larger.
• A stronger safety stack. More resistance to jailbreak attempts.
• More tokens per task. The trade-off: on hard tasks Grok 4.7 writes roughly twice as many output tokens as Grok 4.6 did. That is the reason Jake's first price estimate was wrong, and the pricing section shows how to plan for it.

Grok 4.7 is also offered in a faster variant, Grok 4.7 Fast, which runs about twice as fast at twice the price. At launch, Fast is available only in Cursor and Grok Build, not on the xAI API and not on Bedrock. If you see "grok 4 fast" in search suggestions, that is the name family; on Bedrock today there is one Grok 4.7 model.

Grok 4.7 Bedrock model ID: the one string that decides whether you get an answer

Every model on Bedrock has a model ID, and the newest ones also have inference profile IDs. For Grok 4.7, the difference is not a detail. The plain model ID cannot be used to send a request on bedrock-runtime, because Grok 4.7 is not offered for in-Region inference. You must name a cross-Region inference profile. There are two.

Most search results for "bedrock grok models" or "aws bedrock grok" show a list of IDs without explaining what each one actually does. The short version: the prefix before xai. is a routing promise, not a model choice. us. and global. send your request to exactly the same Grok 4.7. The difference is which data centers AWS is allowed to use to answer it, and what that costs. If you have ever read our guide to Regions and Availability Zones, the profile is the layer above the Region: it lets one call from Ohio be served from Oregon when Ohio is busy.

The base URL also changes depending on which API you use. For the OpenAI-compatible Responses and Chat Completions APIs, the base URL is https://bedrock-runtime.REGION.amazonaws.com/openai/v1, where REGION is the Region your client connects to, for example us-east-1. For the AWS-native Converse and InvokeModel APIs, you use the normal boto3 bedrock-runtime client with a region_name, and AWS builds the URL for you. The Region you connect to and the Region that serves the request are not always the same; that is the whole point of a cross-Region profile.

Full ARNs are needed for IAM policies, not for requests. A Grok 4.7 foundation model ARN looks like arn:aws:bedrock:us-east-1::foundation-model/xai.grok-4.7, and an inference profile ARN looks like arn:aws:bedrock:us-east-1:111122223333:inference-profile/us.xai.grok-4.7. If ARNs still read like line noise, our explainer on what an AWS ARN is takes each field apart in order.

A note on the Bedrock Mantle endpoint, which some readers met with GPT-6: Grok 4.7 is not served on bedrock-mantle. Only bedrock-runtime is supported. If you copied a Mantle base URL from a GPT-6 project, the Grok request will fail before it reaches the model.

How to turn on Grok 4.7 in Amazon Bedrock

Turning a model on in Bedrock is mostly about permissions now, not a sign-up form. Here is the order that worked for Jake on a clean account and on the firm's existing one.

1. Pick a Region where the profile is offered. For us.xai.grok-4.7, your client must connect to one of the four US Regions. For global.xai.grok-4.7, any of the 28 listed Regions works, including London, Frankfurt, Mumbai, Sydney and Tokyo. The full list is in the Regions section below.
2. Open the Bedrock console and find Grok 4.7 in the model catalog. Filter the catalog by provider and choose xAI. The model card shows the model ID, the profile IDs, the context window and the lifecycle dates. If the account has never used a third-party model, accept the provider terms when the console asks; models from outside AWS are billed through AWS Marketplace.
3. Run one prompt in the playground. Open the chat or text playground, select xAI and Grok 4.7, and send a short prompt. If the playground answers, the account side is done and anything that fails later is your code or your IAM.
4. Create an API key, or use IAM credentials. For the OpenAI SDK route, generate an Amazon Bedrock API key in the console. A long-term key is quickest for testing; for production, short-term keys generated from IAM credentials are safer because they expire. For boto3 and the Converse API, your normal AWS credentials work.
5. Give the caller the right IAM permissions. The identity that calls Grok needs bedrock:InvokeModel (and bedrock:InvokeModelWithResponseStream if you stream) on three things: the inference profile, the foundation model in every Region the profile can route to, and your account's default project, arn:aws:bedrock:REGION:ACCOUNT-ID:project/default. The last one is the line most existing policies are missing.
6. Send a test request from code. Use one of the four snippets in the next section. Print the full response object the first time, not just the text, so you can see the token counts.

A minimal IAM policy that allows Grok 4.7 through both profiles looks like this. Replace the account ID with yours. The wildcard Region on the foundation model is there because a global profile can route to any Region; if your security team will not accept a wildcard, list the Regions explicitly.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "GrokProfiles",
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": [
        "arn:aws:bedrock:*:111122223333:inference-profile/us.xai.grok-4.7",
        "arn:aws:bedrock:*:111122223333:inference-profile/global.xai.grok-4.7",
        "arn:aws:bedrock:*::foundation-model/xai.grok-4.7"
      ]
    },
    {
      "Sid": "DefaultProject",
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": "arn:aws:bedrock:*:111122223333:project/default"
    }
  ]
}

If you have never written one of these by hand, our walk-through of IAM policy JSON, line by line explains Effect, Action and Resource with examples. The thing to remember for Grok is that the policy has three kinds of resource, not one, and a missing kind returns the same AccessDenied as a missing policy.

How to use the Grok API on Bedrock: working code for every API

Grok 4.7 on Bedrock supports four APIs: Responses, Chat Completions, Converse and InvokeModel. The first two are OpenAI-compatible, which is why the quickest way to use Grok on Bedrock is the OpenAI Python SDK. That sounds odd, so to be clear: the OpenAI SDK here is only a client library. With the base URL pointed at Bedrock and a Bedrock API key, the request goes to AWS and is answered by xAI's model. Nothing is sent to OpenAI.

Step 1: install the client

For the Responses or Chat Completions APIs, install the OpenAI package. For Converse or InvokeModel, install boto3. You can install both; they do not conflict.

pip install openai
pip install boto3

Step 2: set the key and base URL

The OpenAI SDK reads two environment variables. Set them in your shell, your container or your secrets manager. Change the Region in the URL to the one you are calling from.

export OPENAI_API_KEY="your-bedrock-api-key"
export OPENAI_BASE_URL="https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1"

On Windows PowerShell the same two lines are $env:OPENAI_API_KEY = "your-bedrock-api-key" and $env:OPENAI_BASE_URL = "https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1". Do not commit either value to a repository. If a Bedrock key leaks, delete it in the console; a long-term key stays valid until you do.

1. Responses API with the OpenAI SDK

The Responses API is the one to prefer for new code, because it is the only one that can return Grok's reasoning (in encrypted form) for multi-turn conversations, and it is where the effort setting lives.

from openai import OpenAI

client = OpenAI()

response = client.responses.create(
    model="us.xai.grok-4.7",
    reasoning={"effort": "medium"},
    input="Summarize the termination clause in this contract in five bullet points: ..."
)
print(response.output_text)
print(response.usage)

2. Chat Completions API with the OpenAI SDK

If your project already uses the chat completions shape, for example because it was written for the xAI API or another OpenAI-compatible service, this is the smallest change. Swap the base URL, the key and the model name, and leave the rest.

from openai import OpenAI

client = OpenAI()

response = client.chat.completions.create(
    model="global.xai.grok-4.7",
    messages=[
        {"role": "system", "content": "You are a careful contract reviewer."},
        {"role": "user", "content": "List every date mentioned in this lease: ..."}
    ]
)
print(response.choices[0].message.content)

Chat Completions does not return reasoning tokens. The model still reasons, and you are still billed for that reasoning as output, but you will not see it. For many apps that is fine.

3. Converse API with boto3

The Converse API is the AWS-native shape that works the same way across every Bedrock model. Use it if your code already talks to other Bedrock models through Converse, or if you want application inference profiles for cost tagging, which work only with Converse and InvokeModel.

import boto3

client = boto3.client("bedrock-runtime", region_name="us-east-1")

response = client.converse(
    modelId="us.xai.grok-4.7",
    messages=[
        {"role": "user", "content": [{"text": "Explain this error log in plain English: ..."}]}
    ]
)
print(response["output"]["message"]["content"][0]["text"])
print(response["usage"])

4. The AWS CLI

For a quick check from a terminal, the AWS CLI's converse command sends the same request. It is the fastest way to tell an IAM problem from a code problem: if the CLI works with the same credentials, your code is wrong; if the CLI fails too, it is permissions.

aws bedrock-runtime converse \
  --region us-east-1 \
  --model-id us.xai.grok-4.7 \
  --messages '[{"role":"user","content":[{"text":"Say hello in five words."}]}]'

Which one should you use? Ethan's tool ended up on the Responses API, because the firm wanted the effort setting per request and multi-turn reviews kept their reasoning context. The nightly batch summaries use Converse, because those calls carry an application inference profile tag so the firm can see review costs separately in the bill. Both call the same model.

Grok 4.7 reasoning effort: low, medium, high and xhigh

Reasoning is always on for Grok 4.7. You do not switch it on or off; you choose how hard the model thinks. There are four levels, and high is the default.

Because the levels are spaced further apart on Grok 4.7 than they were on Grok 4.6, the jump in tokens from one level to the next is bigger too. Moving a high-volume route from the default high to low is the single cheapest change you can make, and for many routes the answers do not get noticeably worse. Measure it: run 50 real prompts at both levels, compare the answers and the token counts, and keep the cheaper one if a reviewer cannot tell the difference.

On the Responses API you set effort with the reasoning parameter. To keep the model's reasoning across turns, ask for the encrypted reasoning content and send it back with the next turn. You cannot read it, but the model can, and it keeps a long review consistent from one question to the next.

response = client.responses.create(
    model="us.xai.grok-4.7",
    reasoning={"effort": "high"},
    include=["reasoning.encrypted_content"],
    input="Compare clause 7 and clause 12 and tell me if they conflict."
)
print(response.output_text)

Two limits to plan around. First, the Chat Completions API does not return reasoning tokens at all, so a multi-turn chat built on it cannot hand reasoning back. Second, reasoning tokens are billed as output tokens whether you see them or not. A request that prints a one-line answer can still bill thousands of output tokens at high or xhigh effort. That is not a bug, and it is the most common reason a Grok bill is higher than the estimate.

Bedrock Grok pricing: the table, the tiers, and a worked month

Grok 4.7 on Bedrock is billed per token, with no monthly fee and no minimum. Prices depend on which inference profile you use and which service tier you pick. All prices are per million tokens, Standard tier.

The global price matches xAI's own Grok API price of $2 in and $6 out, so on Bedrock you pay the same per token as going direct, plus 10% if you need US-only routing. The cache read price applies to input tokens that Bedrock's implicit prompt caching recognizes from a recent request, such as a long system prompt or a contract you ask several questions about. You do not set anything up for implicit caching; it happens on its own when the start of a prompt repeats.

Service tiers: Standard, Priority and Flex

Grok 4.7 supports three of Bedrock's service tiers. Reserved capacity is not offered for it. You choose the tier per request with the service_tier field.

The Priority and Flex figures in that table are the Standard global rates with the multipliers applied; for the US profile, apply the same multipliers to $2.20 and $6.60. Flex is the easiest money to save. Ethan's nightly summaries moved to Flex on day two, and nobody has noticed the slower replies because nobody is awake to wait for them.

Bedrock Grok pricing vs the xAI API

On xAI's own API, Grok 4.7 is $2 in and $6 out for normal prompts, with cached input at $0.50, and the rates double to $4 in, $12 out and $1 cached for prompts over 200,000 tokens. The Bedrock model card lists one Standard rate per profile and no separate long-context rate. Before you plan a workload around very long prompts, check the Bedrock pricing page for your Region on the day you build, because long-context pricing is the line most likely to be added or clarified after launch. Our guide to Bedrock pricing and how to cut the bill explains how tokens are counted and where the bill shows up.

There is no free tier for Grok on Bedrock. People search "grok api free" and "is grok api free" a lot, and the honest answer for the API is no: you pay per token, on Bedrock and on xAI's API. What is cheap is a small test. A few hundred short prompts cost cents.

A worked month: what Ethan's review tool costs

The firm reviews about 400 contracts a month. Each review sends a contract of around 30,000 tokens plus a 2,000-token system prompt, then asks five follow-up questions about the same contract. Here is how Jake worked out the bill, at global Standard pricing.

1. First question per contract: 32,000 input tokens, all at the full input price. 400 contracts times 32,000 is 12.8 million tokens, which at $2 per million is $25.60.
2. Five follow-ups per contract: each re-sends the contract and system prompt, which caching recognizes. That is 400 times 5 times 32,000, or 64 million cached tokens at $0.50 per million: $32.00. Without caching it would have been $128.
3. Output: this is where the first estimate went wrong. The visible answers average 600 tokens, but at high effort the reasoning adds several thousand more. Jake measured an average of 6,000 output tokens per call across a sample. 2,400 calls times 6,000 is 14.4 million output tokens at $6 per million: $86.40.
4. Total: about $144 a month. Dropping the follow-up questions to medium effort brought the measured output average down, and the bill with it.

Two lessons from that arithmetic. Output, not input, is the expensive side of a Grok bill, because of reasoning. And the only way to price a reasoning model honestly is to read the usage block on real requests, not to count the words in the answer. Once traffic is flowing, the Grok line appears in your AWS bill under Marketplace, and our guide to reading Cost Explorer shows how to filter for it.

Grok 4.7 Regions: where you can call it, and where your data goes

Grok 4.7 runs only through cross-Region inference. In-Region inference, where the request stays in the Region you call, is not offered in any Region. That means the question is not "which Region hosts Grok?" but "which Regions can I call it from, and which Regions might answer?"

That is 28 Regions in total. From the four US Regions you can choose either profile. From everywhere else, global is the only choice, and with global routing your request can be processed in any commercial Region. There is no EU profile, no Asia Pacific profile and no in-country profile for Grok 4.7 at launch.

For most teams that is fine. For a team that has promised a client "your data stays in the EU" or "your data stays in Australia", it is a blocker today. Do not route around it by calling the global profile from Frankfurt and hoping; the profile name is the promise, and global promises nothing about location. Either pick a model that has the profile your contract needs, or wait for Grok to gain one. The profile list for new models on Bedrock usually grows in the weeks after launch, so check the model card each time you plan.

Ethan's firm is in the US and only needed a US promise, so us.xai.grok-4.7 from us-east-1 was the answer, at the 10% premium. For the firm's internal tools that touch no client data, Jake used the global profile to save the 10%.

What works with Grok on Bedrock, and what does not

A model being on Bedrock does not mean every Bedrock feature works with it. For Grok 4.7 on the bedrock-runtime endpoint, here is the list that decides your design.

The row that changes architecture most is server-side tool use. Grok 4.7 can still call tools, the way an agent does, but on Bedrock it does not run built-in tools on the server for you. Your code defines the tools, Grok asks for one, your code runs it and sends the result back. If you want a managed place to run that loop in production, with memory, identity and observability, that is what Bedrock AgentCore is for, and it works with any model you can call from your agent code.

The row that changes cost tracking is application inference profiles. If you want Grok spend per team or per app in Cost Explorer, wrap the system profile in an application inference profile and call it through Converse or InvokeModel. The OpenAI-compatible routes cannot use one, so tag costs in your own logs there instead.

Grok 4.7 vs Grok 4.6, GPT-6 Astra and Sol, and Claude Sonnet 5.5 on Bedrock

The comparisons people search most are Grok 4.7 vs 4.6, Grok 4.7 vs Opus, Grok 4.7 vs GPT-6 Astra and Grok 4.7 vs Claude. Here is what we can say with real numbers, and where the honest answer is "test it on your own work".

Grok 4.7 vs Grok 4.6

On independent evaluation by Artificial Analysis, Grok 4.7 scores 46 on its Intelligence Index against 44 for Grok 4.6, and 56 on its Coding Agent Index against 47. Its measured hallucination rate fell from 34% to 29%. On Terminal-Bench 4.0, a test of agents working in a command line, it went from 20.3% to 37.6%. The cost of those gains is tokens: Grok 4.7 uses roughly twice as many output tokens per task, about 81,000 against about 36,000 to 38,000 in the tests reported, so a task can cost noticeably more even at the same per-token price.

If you are on Grok 4.6 today and your work is short chat answers, the upgrade gain is small and the token increase is real; try 4.7 at low or medium effort before switching everything. If your work is coding agents or long documents, the gains are large and worth the tokens.

Grok 4.7 vs the other new models on Bedrock

On price per token, Grok 4.7 has the cheapest output of the four, $6 against $10 for Sol and Sonnet 5.5, with the same $2 input. On context, it has half the window of the others. On token use per task, it is on the heavy side, so the cheaper rate does not always mean a cheaper task. Our guides to GPT-6 on Bedrock and Claude Sonnet 5.5 on Bedrock cover those two in the same format as this page, so the details line up.

What about Grok 4.7 vs Opus 5, or vs Fable 5.1? Those comparisons are popular searches, but those are different-tier models with different prices, and no single benchmark settles them. We will not repeat leaderboard numbers we cannot check. The method that works: take 20 real tasks from your own backlog, run them on each model you are considering at the same effort level, and compare the answers, the time and the usage block. A day of that tells you more than any chart, including ours.

Ethan's team ran exactly that test on 20 real contracts. Grok 4.7 and Sonnet 5.5 found the same issues on most of them, Grok was cheaper per contract at medium effort, and Sonnet handled the three very long contracts that went past 500,000 tokens with attachments. The firm uses Grok by default and Sonnet for the long tail. That split, by job not by brand, is usually the right answer.

Where else Grok 4.7 runs: xAI API, Cursor, Copilot and more

Bedrock is one of many places to use Grok 4.7. At launch it was available through:

• The xAI API, xAI's own developer platform, with its own console, API keys and billing.
• Grok Build, xAI's coding environment.
• Cursor and GitHub Copilot, the two code editors and assistants most developers will meet it in first.
• OpenRouter, Vercel and Cloudflare, which route requests to many models behind one API.
• Oracle Cloud and Amazon Bedrock, the cloud platforms.

Which one is right depends on who pays and who governs. The xAI API is the most direct and gets new features first. Bedrock is right when your company already bills through AWS, controls access with IAM, logs with CloudWatch and wants Guardrails in front of every model. A router is right when you want to switch models often without changing code. Cursor and Copilot are right when the model is for a person writing code, not for an app you are building.

If you are moving an app from the xAI API to Bedrock, the change is small because both speak the OpenAI-compatible shape: change the base URL, change the key, and change the model name from xAI's name to us.xai.grok-4.7 or global.xai.grok-4.7. Features that depend on xAI's own server-side tools will not move with it, because Bedrock does not run server-side tools for Grok.

Grok vs Groq: two different things

A surprising number of searches for "grok api key" are really looking for "groq api key", and the other way round. They are different companies. Grok is xAI's family of AI models. Groq is a company that makes fast inference chips and runs a cloud API that serves other companies' open models. A Groq API key will not call Grok, and an xAI or Bedrock key will not call Groq. If an error says your key is invalid and you are sure it is right, check you are not using the other company's key.

What about the Grok app, grok.com and "Grok 4 for Windows"?

Searches like "grok 4 download", "grok 4 for windows 11", "grok 4 login" and "grok 4 free" are about the consumer chat product, not the model on AWS. Bedrock is an API for developers; there is no Bedrock app to download, and Bedrock does not give you a Grok chat window outside the console playground. If you want to chat with Grok as a person, use xAI's own site or app, which at Grok 4.7's launch was still on Grok 4.6. If you want Grok inside your own software, billed to AWS, this page is the right one.

Grok API not working on Bedrock? Every error we hit, and the fix

Most "why is Grok not working" moments on Bedrock come from five places: the model ID, the base URL, the permissions, the API you picked, and quotas. Here they are in the order Jake met them.

ValidationException: on-demand throughput isn't supported

The message says that invoking the model with on-demand throughput is not supported and asks you to retry with the ID or ARN of an inference profile. Cause: you sent xai.grok-4.7, the bare model ID. Fix: send us.xai.grok-4.7 or global.xai.grok-4.7. This is the most common Grok API error 400 on Bedrock, and it happens to almost everyone once.

AccessDeniedException (403) with a policy that looks right

Cause, in order of likelihood. First: your policy allows the inference profile but not the default project, arn:aws:bedrock:REGION:ACCOUNT-ID:project/default. Add it. Second: your policy allows the foundation model in one Region, but the profile routed the request to another; use a wildcard Region or list them all. Third: a Service Control Policy from your organization denies Bedrock or denies a Region the profile uses. Fourth: the account has not accepted the provider terms for xAI models in the console. Jake hit the first one, and it is the error this page was written for: the message names the project, which nobody on the team had heard of.

404 or "model not found" from the OpenAI SDK

Cause: the base URL is wrong. The usual mistakes are pointing OPENAI_BASE_URL at api.openai.com or at an xAI URL, leaving off /openai/v1, using a Mantle URL copied from a GPT-6 project, or using a Region that does not offer the profile you named, such as calling us.xai.grok-4.7 from Frankfurt. Print the client's base URL at startup the first time; it saves an hour.

401 or "invalid API key"

Cause: an expired short-term Bedrock key, a deleted long-term key, a key from a different account, or an OpenAI or xAI key in the environment instead of the Bedrock one. If your shell already has an OPENAI_API_KEY from another project, the SDK will happily use the wrong one. Set the variable in the same place your code runs.

Application inference profile rejected on Responses or Chat Completions

Cause: application inference profiles work with Grok only through the Converse and InvokeModel APIs. Fix: call the system profile ID on the OpenAI-compatible routes, and use your application profile only from boto3.

ThrottlingException or 429: too many requests

Cause: you have hit your account's default quota for Grok 4.7 requests or tokens per minute. Fixes: add retries with exponential backoff, move batch work to the Flex tier, use the global profile which spreads load wider, and request a quota increase in Service Quotas if the load is steady. A burst of 429s on launch week is also normal while capacity grows.

The answer is good but the bill is twice the estimate

Not an error, but the one that worries people most. Cause: reasoning tokens. At high and xhigh effort, Grok 4.7 writes many tokens you never see, and they bill as output. Fix: read usage on real calls, lower the effort on routes that do not need it, and use caching for repeated documents. Compare with the worked month above.

Count tokens fails

The Count Tokens API is not supported for Grok 4.7 on Bedrock. Estimate input size by sending a real request with a small output limit and reading the usage block, or count locally with an approximate tokenizer and leave a margin.

If the AccessDenied in your logs mentions Claude rather than Grok, the causes overlap heavily; our full checklist for AccessDeniedException on Bedrock walks every one of them in order.

How long Grok 4.7 stays on Bedrock, and how to move to the next Grok

New Grok versions arrive every few months, and this page is written to stay useful when the next one lands. Two things make that easy: Bedrock's lifecycle rules and a habit of keeping the model ID in one place.

Grok 4.7 is Active on Bedrock. Its end of life will be no sooner than September 28, 2027, and when an end date is announced there will be a legacy period of at least six months before it is switched off. So nothing you build on Grok 4.7 today will break suddenly. You will get notice, and time to move.

When a newer Grok appears on Bedrock, here is how to check and switch without guessing:

1. Check the model catalog. In the Bedrock console, filter by provider xAI. Every Grok model offered in your Region is listed with its model card, and the card names the profile IDs.
2. Compare the model cards. Look at four things: profile IDs (did it gain an EU or Asia Pacific profile?), price per million, context window, and the supported and unsupported feature lists. Those are the lines that change.
3. Update IAM first. Add the new model's foundation model and profile ARNs to your policy before you change any code, so the first request does not fail on permissions.
4. Change one config value. Keep the model ID in an environment variable or config file, never hard-coded in many places. Switching is then a single change and a redeploy.
5. Run your 20-task test again. Same prompts, same effort, compare the answers and the usage blocks. Token use per task is the number most likely to surprise you, as it did from 4.6 to 4.7.
6. Roll out by route. Move one route at a time, keep the old ID on the others until the new one has run a week, then move the rest.

The same steps answer the common searches about older versions, such as "bedrock grok 4.6", "bedrock grok 4.5" or "grok 4.3 on Bedrock". Do not trust a list on a blog for which versions are on the shelf; the model catalog in your Region is the only list that counts, and it is two clicks away.

Grok on Bedrock: the go-live checklist

Before Ethan's tool went live for the firm, Jake ran this list. It covers everything above in the order you will need it.

1. Choose the profile: us.xai.grok-4.7 for a US promise, global.xai.grok-4.7 for everything else.
2. Confirm the Region your client calls offers that profile.
3. Add the profile ARN, the foundation model ARN for every routed Region, and project/default to the IAM policy.
4. Store the Bedrock API key in a secrets manager, prefer short-term keys in production, and never commit it.
5. Pick the API: Responses for multi-turn with reasoning, Chat Completions for the simplest port, Converse for cost tags.
6. Set the effort per route, starting at medium, and lower it where a reviewer cannot tell the difference.
7. Put Flex on every job that can wait, and Priority only on the user-facing routes that need it.
8. Attach a Guardrail if the app faces customers.
9. Turn on invocation logging for audit.
10. Log the usage block of every request, and set a billing alarm at twice your estimate for the first month.
11. Add retries with backoff for 429s, and check your quotas in Service Quotas.
12. Put the model ID in config so the next Grok is a one-line change.

None of that is unusual for Bedrock. What is unusual about Grok is only three things: the OpenAI SDK as the natural client, the default project permission, and how much reasoning a hard request can spend. Get those three right and Grok 4.7 behaves like every other model on the shelf.

The model swap really is three strings: a base URL, a key and a profile ID. The afternoon goes on the things around them, the project permission nobody had heard of, the Region that cannot promise a location, and the reasoning that bills like output because it is output. Fix those in the order on this page and Grok 4.7 on Bedrock is as quiet as any other model on the shelf. Ethan's review tool went live on Friday. The firm's IT lead got the AWS bill and the IAM policy they asked for, the lawyers got faster first drafts, and Jake got his evening back.

Revision note. Written October 3, 2026, five days after Grok 4.7 reached Amazon Bedrock. The profile list is the part most likely to change first: new models on Bedrock often gain extra geo profiles in the weeks after launch, and an EU or Asia Pacific profile for Grok would change the Regions advice above. Long-context pricing on Bedrock is the second thing to recheck. Ethan's contract numbers are rounded on purpose so the arithmetic is easy to redo with your own traffic. When the next Grok version lands on Bedrock, the lifecycle section above is the place to start.