From b566bb4d0aff231871234201b23fe7ac49c24c4d Mon Sep 17 00:00:00 2001 From: xnoto Date: Tue, 25 Aug 2026 17:07:35 -0600 Subject: [PATCH] feat: allow short-term bearer tokens for opencode bedrock user The Anthropic Messages API surface on bedrock-runtime is the only one that accepts service_tier (flex/priority) for Claude models, and it authenticates with Bedrock API keys rather than SigV4. Short-term tokens are presigned client-side from the user's credentials and inherit its permissions; the bedrock:bearerTokenType=SHORT_TERM condition keeps long-term API keys forbidden. --- aws-bedrock.tf | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/aws-bedrock.tf b/aws-bedrock.tf index 58fc06a..cbcbaef 100644 --- a/aws-bedrock.tf +++ b/aws-bedrock.tf @@ -163,6 +163,21 @@ resource "aws_iam_user_policy" "bedrock_opencode" { Action = ["bedrock:ListModelInvocationJobs"] Resource = "*" }, + { + # The Anthropic Messages API surface (the only one accepting + # service_tier for Claude) requires bearer-token auth. Short-term + # tokens are presigned client-side from this user's credentials; + # the condition keeps long-term API keys forbidden. + Sid = "AllowShortTermBearerToken" + Effect = "Allow" + Action = ["bedrock:CallWithBearerToken"] + Resource = "*" + Condition = { + StringEquals = { + "bedrock:bearerTokenType" = "SHORT_TERM" + } + } + }, { # Model access page is retired: first invoke auto-subscribes the # account, which Bedrock performs via AWS Marketplace on the caller's