feat: add AWS Bedrock access for OpenCode with batch inference support

[xnoto]

Summary

Adds AWS Bedrock access for OpenCode (Claude Opus) with full batch inference support for the 50% Batch API discount.

• aws-bedrock.tf (new):
  • opencode-bedrock IAM user + access key, scoped to Anthropic models via both foundation-model/anthropic.* and inference-profile/*.anthropic.* ARNs — Opus 4.x rejects base model IDs and must be called through inference profiles
  • bedrock-batch-inference service role (trusted by bedrock.amazonaws.com, SourceAccount/SourceArn conditions) — CreateModelInvocationJob requires a roleArn for S3 I/O
  • mitw-bedrock-batch S3 bucket (fully private, prevent_destroy) for batch input JSONL and output
  • User policy statements: on-demand invoke, inference profile discovery, batch job management (Create/Get/Stop/List), batch S3 data access, and iam:PassRole constrained with iam:PassedToService: bedrock.amazonaws.com
• outputs.tf: bedrock_opencode_access_key (sensitive), user ARN, batch service role ARN, batch bucket name
• README.md: regenerated via terraform-docs

Notes

• Batch inference is asynchronous (up to 24h) — interactive OpenCode sessions use on-demand invoke at full price; the discount applies only to submitted batch jobs
• Bedrock model access entitlement remains a manual AWS Console step
• Verify Anthropic model availability in the configured provider region before apply

Validation

• make test — all canonical pre-commit hooks pass (tofu validate with -backend=false, tflint, checkov, fmt, terraform-docs, gitleaks)
• No live plan/apply run locally; CI plan on this PR is authoritative

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:
# aws_iam_access_key.bedrock_opencode will be created
+ resource "aws_iam_access_key" "bedrock_opencode" {
+ create_date = (known after apply)
+ encrypted_secret = (known after apply)
+ encrypted_ses_smtp_password_v4 = (known after apply)
+ id = (known after apply)
+ key_fingerprint = (known after apply)
+ secret = (sensitive value)
+ ses_smtp_password_v4 = (sensitive value)
+ status = "Active"
+ user = "opencode-bedrock"
}
# aws_iam_role.bedrock_batch will be created
+ resource "aws_iam_role" "bedrock_batch" {
+ arn = (known after apply)
+ assume_role_policy = jsonencode(
{
+ Statement = [
+ {
+ Action = "sts:AssumeRole"
+ Condition = {
+ ArnEquals = {
+ "aws:SourceArn" = "arn:aws:bedrock:*:332355796717:model-invocation-job/*"
}
+ StringEquals = {
+ "aws:SourceAccount" = "332355796717"
}
}
+ Effect = "Allow"
+ Principal = {
+ Service = "bedrock.amazonaws.com"
}
},
]
+ Version = "2012-10-17"
}
)
+ create_date = (known after apply)
+ force_detach_policies = false
+ id = (known after apply)
+ managed_policy_arns = (known after apply)
+ max_session_duration = 3600
+ name = "bedrock-batch-inference"
+ name_prefix = (known after apply)
+ path = "/"
+ tags = {
+ "ManagedBy" = "Terraform"
+ "Purpose" = "bedrock-batch-inference"
}
+ tags_all = {
+ "ManagedBy" = "Terraform"
+ "Purpose" = "bedrock-batch-inference"
}
+ unique_id = (known after apply)
+ inline_policy (known after apply)
}
# aws_iam_role_policy.bedrock_batch_invoke will be created
+ resource "aws_iam_role_policy" "bedrock_batch_invoke" {
+ id = (known after apply)
+ name = "bedrock-batch-invoke"
+ name_prefix = (known after apply)
+ policy = jsonencode(
{
+ Statement = [
+ {
+ Action = [
+ "bedrock:InvokeModel",
]
+ Effect = "Allow"
+ Resource = [
+ "arn:aws:bedrock:*::foundation-model/anthropic.*",
+ "arn:aws:bedrock:*:332355796717:inference-profile/*.anthropic.*",
]
+ Sid = "InvokeAnthropicModels"
},
]
+ Version = "2012-10-17"
}
)
+ role = "bedrock-batch-inference"
}
# aws_iam_role_policy.bedrock_batch_s3 will be created
+ resource "aws_iam_role_policy" "bedrock_batch_s3" {
+ id = (known after apply)
+ name = "bedrock-batch-s3"
+ name_prefix = (known after apply)
+ policy = (known after apply)
+ role = "bedrock-batch-inference"
}
# aws_iam_user.bedrock_opencode will be created
+ resource "aws_iam_user" "bedrock_opencode" {
+ arn = (known after apply)
+ force_destroy = false
+ id = (known after apply)
+ name = "opencode-bedrock"
+ path = "/"
+ tags = {
+ "ManagedBy" = "Terraform"
+ "Purpose" = "opencode-bedrock"
}
+ tags_all = {
+ "ManagedBy" = "Terraform"
+ "Purpose" = "opencode-bedrock"
}
+ unique_id = (known after apply)
}
# aws_iam_user_policy.bedrock_opencode will be created
+ resource "aws_iam_user_policy" "bedrock_opencode" {
+ id = (known after apply)
+ name = "bedrock-invoke"
+ name_prefix = (known after apply)
+ policy = (known after apply)
+ user = "opencode-bedrock"
}
# aws_s3_bucket.bedrock_batch will be created
+ resource "aws_s3_bucket" "bedrock_batch" {
+ acceleration_status = (known after apply)
+ acl = (known after apply)
+ arn = (known after apply)
+ bucket = "mitw-bedrock-batch"
+ bucket_domain_name = (known after apply)
+ bucket_namespace = (known after apply)
+ bucket_prefix = (known after apply)
+ bucket_region = (known after apply)
+ bucket_regional_domain_name = (known after apply)
+ force_destroy = false
+ hosted_zone_id = (known after apply)
+ id = (known after apply)
+ object_lock_enabled = (known after apply)
+ policy = (known after apply)
+ region = "us-west-2"
+ request_payer = (known after apply)
+ tags = {
+ "ManagedBy" = "Terraform"
+ "Purpose" = "bedrock-batch-inference"
}
+ tags_all = {
+ "ManagedBy" = "Terraform"
+ "Purpose" = "bedrock-batch-inference"
}
+ website_domain = (known after apply)
+ website_endpoint = (known after apply)
+ cors_rule (known after apply)
+ grant (known after apply)
+ lifecycle_rule (known after apply)
+ logging (known after apply)
+ object_lock_configuration (known after apply)
+ replication_configuration (known after apply)
+ server_side_encryption_configuration (known after apply)
+ versioning (known after apply)
+ website (known after apply)
}
# aws_s3_bucket_public_access_block.bedrock_batch will be created
+ resource "aws_s3_bucket_public_access_block" "bedrock_batch" {
+ block_public_acls = true
+ block_public_policy = true
+ bucket = "mitw-bedrock-batch"
+ id = (known after apply)
+ ignore_public_acls = true
+ region = "us-west-2"
+ restrict_public_buckets = true
}
Plan: 8 to add, 0 to change, 0 to destroy.
Changes to Outputs:
+ bedrock_batch_bucket_name = "mitw-bedrock-batch"
+ bedrock_batch_service_role_arn = (known after apply)
+ bedrock_opencode_access_key = (sensitive value)
+ bedrock_opencode_iam_user_arn = (known after apply)