aws-bedrock

client<llm> MyClient {
  provider aws-bedrock
  options {
    model "anthropic.claude-3-sonnet-20240229-v1:0"
    inference_configuration {
      max_tokens 100
      temperature 0.7
    }
    // Pass any other parameters that are model specific, 
    // like with claude thinking models.
    additional_model_request_fields {
      thinking {
        type "enabled"
        budget_tokens 1030
      }
    }
  }
}

[default]
sso_start_url = https://your-sso-start-url.awsapps.com/start
sso_region = us-west-2
sso_account_id = 123456789012
sso_role_name = YourSSORole
region = us-west-2
output = json

export AWS_PROFILE=staging-profile

# First, login with SSO
aws sso login --profile staging-profile

# Then use the profile in your BAML config
client<llm> MyClient {
  provider aws-bedrock
  options {
    profile "staging-profile"
    model "anthropic.claude-3-sonnet-20240229-v1:0"
  }
}

client<llm> MyClient {
  provider aws-bedrock
  options {
    region "us-east-1"  // Only region is required
    model "anthropic.claude-3-sonnet-20240229-v1:0"
  }
}

export AWS_ACCESS_KEY_ID="your_key"
export AWS_SECRET_ACCESS_KEY="your_secret"
export AWS_REGION="us-east-1"

client<llm> MyClient {
  provider aws-bedrock
  options {
    // No need to specify credentials - they'll be picked up from environment
    model "anthropic.claude-3-sonnet-20240229-v1:0"
  }
}

client<llm> MyClient {
  provider aws-bedrock
  options {
    access_key_id env.AWS_ACCESS_KEY_ID
    secret_access_key env.AWS_SECRET_ACCESS_KEY
    region "us-east-1"
    model "anthropic.claude-3-sonnet-20240229-v1:0"
  }
}

client<llm> MyClient {
  provider aws-bedrock
  options {
    access_key_id env.MY_CUSTOM_AWS_KEY_ID
    secret_access_key env.MY_CUSTOM_AWS_SECRET
    session_token env.MY_CUSTOM_AWS_SESSION  // Optional
    region env.MY_CUSTOM_AWS_REGION
    model "anthropic.claude-3-sonnet-20240229-v1:0"
  }
}

# Your custom environment variables
export MY_CUSTOM_AWS_KEY_ID="your_key"
export MY_CUSTOM_AWS_SECRET="your_secret"
export MY_CUSTOM_AWS_REGION="us-east-1"
export MY_CUSTOM_AWS_SESSION="optional_session_token"

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::SOURCE_ACCOUNT_ID:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

# ~/.aws/config
[profile target-role]
role_arn = arn:aws:iam::TARGET_ACCOUNT_ID:role/ROLE_NAME
source_profile = default
region = us-east-1

client<llm> MyClient {
  provider aws-bedrock
  options {
    profile "target-role"
    model "anthropic.claude-3-sonnet-20240229-v1:0"
  }
}

# Assume role and export credentials
aws sts assume-role \
  --role-arn arn:aws:iam::TARGET_ACCOUNT_ID:role/ROLE_NAME \
  --role-session-name "BamlSession" \
  --external-id "YOUR_EXTERNAL_ID"

export AWS_ACCESS_KEY_ID="from-sts-output"
export AWS_SECRET_ACCESS_KEY="from-sts-output"
export AWS_SESSION_TOKEN="from-sts-output"

import { ClientRegistry } from '@baml/core';
import { STSClient, AssumeRoleCommand } from '@aws-sdk/client-sts';

const sts = new STSClient({ region: 'us-east-1' });
const response = await sts.send(new AssumeRoleCommand({
    RoleArn: 'arn:aws:iam::TARGET_ACCOUNT_ID:role/ROLE_NAME',
    RoleSessionName: 'BamlSession',
    ExternalId: 'YOUR_EXTERNAL_ID'
}));

const registry = new ClientRegistry();
registry.addLlmClient('MyClient', 'aws-bedrock', {
    accessKeyId: response.Credentials!.AccessKeyId,
    secretAccessKey: response.Credentials!.SecretAccessKey,
    sessionToken: response.Credentials!.SessionToken,
    region: 'us-east-1'
});

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:*:*:model/*"
    }
  ]
}

import { SignatureV4 } from "@aws-sdk/signature-v4"
import { defaultProvider } from "@aws-sdk/credential-provider-node"
import { HttpRequest } from "@aws-sdk/protocol-http"
import { b } from 'baml_client'

async function callBedrock() {
  const req = await b.request.ExtractResume("John Doe | Software Engineer | BSc in CS")

  const body = req.body.json() as any
  const bodyString = JSON.stringify(body)
  const url = new URL(req.url)
  const region = (req.client_details.options?.region as string) ?? process.env.AWS_REGION ?? "us-east-1"

  const signer = new SignatureV4({
    service: "bedrock",
    region,
    credentials: defaultProvider(),
  })

  const unsigned = new HttpRequest({
    protocol: url.protocol,
    hostname: url.hostname,
    path: url.pathname,
    method: req.method,
    headers: {
      ...req.headers,
      host: url.host,
      "content-type": "application/json",
    },
    body: bodyString,
  })

  const signed = await signer.sign(unsigned)

  const res = await fetch(req.url, {
    method: req.method,
    headers: signed.headers as Record<string, string>,
    body: bodyString,
  })

  if (!res.ok) {
    throw new Error(`Bedrock request failed: ${res.status}`)
  }

  const payload = await res.json()
  const message = payload.output.message.content.find((block: any) => block.text)?.text ?? ''

  return b.parse.ExtractResume(message)
}

import json
import requests
from botocore.auth import SigV4Auth
from botocore.awsrequest import AWSRequest
import boto3
from baml_client import b

def call_bedrock():
  req = b.request.ExtractResume("John Doe | Software Engineer | BSc in CS")

  body = req.body.json()
  body_bytes = json.dumps(body).encode("utf-8")

  session = boto3.Session()
  credentials = session.get_credentials().get_frozen_credentials()
  region = req.client_details.options.get("region") or session.region_name or "us-east-1"

  aws_request = AWSRequest(
    method=req.method,
    url=req.url,
    data=body_bytes,
    headers=dict(req.headers),
  )
  SigV4Auth(credentials, "bedrock", region).add_auth(aws_request)

  response = requests.post(
    req.url,
    headers=dict(aws_request.headers.items()),
    data=body_bytes,
  )
  response.raise_for_status()

  payload = response.json()
  message = payload["output"]["message"]["content"][0]["text"]
  return b.parse.ExtractResume(message)

client<llm> MyClient {
  provider aws-bedrock
  options {
    inference_configuration {
      max_tokens 1000
      temperature 1.0
      top_p 0.8
    }
  }
}