feat: allow short-term bearer tokens for opencode bedrock user

[xnoto]

Summary

Flex/Priority service tiers for Claude models are only selectable via service_tier in the Anthropic Messages API surface on bedrock-runtime (/anthropic/v1/messages). That surface authenticates with Bedrock API keys (bearer tokens), not SigV4 — InvokeModel/Converse reject non-Standard tiers for Anthropic models (verified empirically in us-west-2/us-east-1/us-east-2).

This adds bedrock:CallWithBearerToken so the opencode-bedrock user can use short-term (12h, client-side presigned, permission-inheriting) bearer tokens, hardened with bedrock:bearerTokenType = SHORT_TERM so long-term API keys remain forbidden.

Validation

• make test — all canonical pre-commit hooks pass
• Additive IAM statement only; CI plan authoritative

Post-merge test plan: presign a short-term token from the user's credentials and call /anthropic/v1/messages with \"service_tier\": \"flex\" on Opus 4.6; the response echoes the served tier.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:
# aws_iam_user_policy.bedrock_opencode will be updated in-place
~ resource "aws_iam_user_policy" "bedrock_opencode" {
id = "opencode-bedrock:bedrock-invoke"
name = "bedrock-invoke"
~ policy = jsonencode(
~ {
~ Statement = [
# (3 unchanged elements hidden)
{
Action = [
"bedrock:ListModelInvocationJobs",
]
Effect = "Allow"
Resource = "*"
Sid = "ListBatchJobs"
},
~ {
~ Action = [
- "aws-marketplace:ViewSubscriptions",
- "aws-marketplace:Subscribe",
+ "bedrock:CallWithBearerToken",
]
~ Condition = {
~ StringEquals = {
- "aws:CalledViaLast" = "bedrock.amazonaws.com"
+ "bedrock:bearerTokenType" = "SHORT_TERM"
}
}
~ Sid = "MarketplaceModelSubscription" -> "AllowShortTermBearerToken"
# (2 unchanged attributes hidden)
},
~ {
~ Action = [
- "s3:GetObject",
- "s3:PutObject",
- "s3:ListBucket",
+ "aws-marketplace:ViewSubscriptions",
+ "aws-marketplace:Subscribe",
]
+ Condition = {
+ StringEquals = {
+ "aws:CalledViaLast" = "bedrock.amazonaws.com"
}
}
~ Resource = [
- "arn:aws:s3:::mitw-bedrock-batch",
- "arn:aws:s3:::mitw-bedrock-batch/*",
] -> "*"
~ Sid = "BatchDataS3Access" -> "MarketplaceModelSubscription"
# (1 unchanged attribute hidden)
},
- {
- Action = [
- "iam:PassRole",
]
- Condition = {
- StringEquals = {
- "iam:PassedToService" = "bedrock.amazonaws.com"
}
}
- Effect = "Allow"
- Resource = "arn:aws:iam::332355796717:role/bedrock-batch-inference"
- Sid = "PassBatchServiceRole"
},
+ {
+ Action = [
+ "s3:GetObject",
+ "s3:PutObject",
+ "s3:ListBucket",
]
+ Effect = "Allow"
+ Resource = [
+ "arn:aws:s3:::mitw-bedrock-batch",
+ "arn:aws:s3:::mitw-bedrock-batch/*",
]
+ Sid = "BatchDataS3Access"
},
+ {
+ Action = [
+ "iam:PassRole",
]
+ Condition = {
+ StringEquals = {
+ "iam:PassedToService" = "bedrock.amazonaws.com"
}
}
+ Effect = "Allow"
+ Resource = "arn:aws:iam::332355796717:role/bedrock-batch-inference"
+ Sid = "PassBatchServiceRole"
},
]
# (1 unchanged attribute hidden)
}
)
# (1 unchanged attribute hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.