Requirements

Name	Version
terraform	> 1.3
aws	~> 6.0

Providers

Name	Version
aws	~> 6.0
sops	n/a

Modules

No modules.

Resources

Name	Type
aws_iam_access_key.admin_key	resource
aws_iam_access_key.bedrock_opencode	resource
aws_iam_access_key.sops_secrets_operator	resource
aws_iam_openid_connect_provider.github_actions	resource
aws_iam_role.bedrock_batch	resource
aws_iam_role.github_actions_sops_kms	resource
aws_iam_role_policy.bedrock_batch_invoke	resource
aws_iam_role_policy.bedrock_batch_s3	resource
aws_iam_role_policy.github_actions_sops_kms	resource
aws_iam_user.admin	resource
aws_iam_user.bedrock_opencode	resource
aws_iam_user.sops_secrets_operator	resource
aws_iam_user_policy.bedrock_opencode	resource
aws_iam_user_policy.sops_secrets_operator_kms	resource
aws_iam_user_policy_attachment.admin_attach	resource
aws_kms_alias.sops	resource
aws_kms_key.sops	resource
aws_s3_bucket.bedrock_batch	resource
aws_s3_bucket.private	resource
aws_s3_bucket.public	resource
aws_s3_bucket.web	resource
aws_s3_bucket_policy.public	resource
aws_s3_bucket_policy.web	resource
aws_s3_bucket_public_access_block.bedrock_batch	resource
aws_s3_bucket_public_access_block.public	resource
aws_s3_bucket_public_access_block.web	resource
aws_s3_bucket_website_configuration.web	resource
aws_caller_identity.current	data source
sops_file.secret_vars	data source

Inputs

No inputs.

Outputs

Name	Description
admin_access_keys	Admin IAM user access keys
bedrock_batch_bucket_name	S3 bucket for Bedrock batch inference input and output data
bedrock_batch_service_role_arn	Service role ARN to pass as roleArn when creating Bedrock batch inference jobs
bedrock_opencode_access_key	Access key for OpenCode to invoke Anthropic models via AWS Bedrock
bedrock_opencode_iam_user_arn	IAM user ARN for OpenCode Bedrock access
github_actions_sops_kms_role_arn	IAM role ARN for GitHub Actions SOPS KMS access
sops_kms_key_arn	KMS key ARN for future SOPS AWS KMS recipients
sops_secrets_operator_access_key	Access key for the k3s sops-secrets-operator to decrypt SOPS AWS KMS secrets
sops_secrets_operator_iam_user_arn	IAM user ARN for the k3s sops-secrets-operator
web_bucket_endpoints	Website endpoints for public web S3 buckets

AWS Bedrock batch inference (50% discount)

Batch inference bills at 50% of the on-demand Standard tier for asynchronous workloads (results within 24h; small jobs finish in minutes). Deployed resources: the opencode-bedrock IAM user, the bedrock-batch-inference service role, and the mitw-bedrock-batch bucket.

1. Build a JSONL input file with at least 100 records (one model per job):

   {"recordId":"task-001","modelInput":{"anthropic_version":"bedrock-2023-05-31","max_tokens":2048,"messages":[{"role":"user","content":"..."}]}}
   

2. Upload and submit (use a per-job input prefix so only this job's files are processed):

   export AWS_PROFILE=opencode-bedrock AWS_REGION=us-west-2
   aws s3 cp tasks.jsonl s3://mitw-bedrock-batch/input/my-job/tasks.jsonl
   aws bedrock create-model-invocation-job \
     --job-name "my-job-$(date +%s)" \
     --role-arn "$(AWS_PROFILE=makeitwork tofu output -raw bedrock_batch_service_role_arn)" \
     --model-id us.anthropic.claude-opus-4-6-v1 \
     --input-data-config "s3InputDataConfig={s3Uri=s3://mitw-bedrock-batch/input/my-job/}" \
     --output-data-config "s3OutputDataConfig={s3Uri=s3://mitw-bedrock-batch/output/}"

3. Monitor until Completed (Submitted → Validating → Scheduled → InProgress):

   aws bedrock get-model-invocation-job --job-identifier "<jobArn>" --query status --output text

4. Collect results and join outputs to inputs on recordId:

   aws s3 cp s3://mitw-bedrock-batch/output/<job-id>/ . --recursive

Verify the discount in Cost Explorer (Service: Amazon Bedrock, group by Usage Type): batch jobs appear as Batch usage at 50% of Standard. Interactive sessions remain on-demand; use batch for bulk, latency-tolerant work only. Models must be invocable by the account (currently Opus 4.6/4.5, Sonnet 4.6/4.5).