sbx/claude-bedrock-mixin:latest

schemaVersion: "3"
displayName: Claude Code on Amazon Bedrock (mixin)
description: Routes Claude Code at Amazon Bedrock with the AWS profile stored under the bedrock credential. Layer it onto the claude workload.
version: 1.0.0
kind: mixin
provides:
    - claude-bedrock
requires:
    - claude
    - deb/jq
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - bedrock-runtime.*.amazonaws.com
                - bedrock.*.amazonaws.com
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: bedrock-runtime.*.amazonaws.com
                  format: '%s'
                  header: ""
                - domain: bedrock.*.amazonaws.com
                  format: '%s'
                  header: ""
            name: AWS_PROFILE
        phase: runtime
        service: bedrock
      description: AWS profile name resolved to short-lived STS credentials on the host
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: |
                set -e
                cfg=/home/agent/.claude/settings.json
                mkdir -p "$(dirname "$cfg")"
                [ -s "$cfg" ] || echo '{}' > "$cfg"
                if [ "${SBX_CRED_BEDROCK_MODE:-none}" != none ]; then
                  jq '.apiKeyHelper = "echo proxy-managed"
                      | .awsCredentialExport = "cat /home/agent/.aws/sbx-bedrock-credentials.json"' \
                    "$cfg" > "$cfg.tmp"
                else
                  jq 'del(.awsCredentialExport)' "$cfg" > "$cfg.tmp"
                fi
                mv "$cfg.tmp" "$cfg"
              description: Merge the Bedrock settings keys into the settings.json the claude workload seeded
              env:
                - SBX_CRED_BEDROCK_MODE
              user: agent
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/claude-bedrock-mixin/claude-bedrock-mixin-context.md