Merge pull request #17 from aws-solutions-library-samples/fix/region-issue

feat: Add Source Region Selection and Standardize Configuration Display

Author: schuettc

README.md

@@ -169,7 +169,14 @@ The guidance can be deployed in any AWS region that supports:
 - Amazon Bedrock
 - (Optional) Amazon ECS Fargate for monitoring
 
-Users can access Bedrock in any region you configure during setup, regardless of where the authentication infrastructure is deployed.
+### Cross-Region Inference
+
+Claude Code uses Amazon Bedrock's cross-region inference for optimal performance and availability. During setup, you can:
+- Select your preferred Claude model (Opus, Sonnet, Haiku)
+- Choose a cross-region profile (US, Europe, APAC) for optimal regional routing
+- Select a specific source region within your profile for model inference
+
+This automatically routes requests across multiple AWS regions to ensure the best response times and highest availability. Modern Claude models (3.7+) require cross-region inference for access.
 
 ## Implementation
 
@@ -185,7 +192,7 @@ The wizard will guide you through:
 
 - OIDC provider configuration (domain, client ID)
 - AWS region selection for infrastructure
-- Amazon Bedrock region access configuration
+- Amazon Bedrock cross-region inference configuration
 - Credential storage method (keyring or session files)
 - Optional monitoring setup with VPC configuration
 

assets/docs/CLI_REFERENCE.md

@@ -59,6 +59,9 @@ poetry run ccwb init [options]
 - Checks prerequisites (AWS CLI, credentials, Python version)
 - Prompts for OIDC provider configuration
 - Configures AWS settings (region, identity pool name)
+- Prompts for Claude model selection (Opus, Sonnet, Haiku)
+- Configures cross-region inference profiles (US, Europe, APAC)
+- Prompts for source region selection for model inference
 - Sets up monitoring options
 - Saves configuration to `.ccwb-config/config.json` in the project directory
 
@@ -141,9 +144,12 @@ poetry run ccwb package [options]
   - OIDC provider settings
   - Identity Pool ID from deployed stack
   - Credential storage method (keyring or session)
+  - Selected Claude model and cross-region profile
+  - Source region for model inference
 - Generates installer script
 - Creates user documentation
 - Includes Claude Code telemetry settings (if monitoring enabled)
+- Configures environment variables for model selection (ANTHROPIC_MODEL, ANTHROPIC_SMALL_FAST_MODEL)
 
 **Output structure:**
 
@@ -176,10 +182,15 @@ poetry run ccwb status [options]
 
 **What it does:**
 
-- Shows current configuration
+- Shows current configuration including:
+  - Configuration profile and AWS profile names
+  - OIDC provider and client ID
+  - Selected Claude model and cross-region profile
+  - Source region for model inference
+  - Analytics and monitoring status
 - Checks CloudFormation stack status
 - Displays Identity Pool information
-- Shows monitoring configuration
+- Shows monitoring configuration and endpoints
 
 ### `cleanup` - Remove Installed Components
 

assets/docs/DEPLOYMENT.md

@@ -34,7 +34,7 @@ poetry install
 
 The `ccwb` (Claude Code with Bedrock) CLI tool guides you through deployment with an interactive wizard. Run `poetry run ccwb init` to begin. The wizard walks you through each configuration decision, starting with your OIDC provider details - enter the domain and Client ID you noted earlier.
 
-Next, you'll choose AWS regions. Select where to deploy the authentication infrastructure (typically your primary AWS region) and which regions users should access Bedrock from. The wizard also offers optional monitoring setup, which provides usage analytics and cost tracking through OpenTelemetry.
+Next, you'll select your Claude model and configure regional access. Choose from available Claude models (Opus, Sonnet, Haiku) and select a cross-region inference profile (US, Europe, or APAC) for optimal performance. The wizard will then prompt you to select a source region within your chosen profile for model inference. Finally, choose where to deploy the authentication infrastructure (typically your primary AWS region) and configure optional monitoring setup, which provides usage analytics and cost tracking through OpenTelemetry.
 
 Once configuration is complete, deploy the infrastructure with:
 

deployment/infrastructure/cognito-identity-pool.yaml

@@ -60,8 +60,8 @@ Parameters:
 
   AllowedBedrockRegions:
     Type: CommaDelimitedList
-    Default: 'us-east-1,us-west-2,us-east-2'
-    Description: Comma-delimited list of AWS regions where Bedrock access is allowed
+    Default: 'us-east-1,us-east-2,us-west-1,us-west-2,eu-west-1,eu-west-3,eu-central-1,eu-north-1,eu-south-1,eu-south-2,ap-northeast-1,ap-southeast-1,ap-southeast-2,ap-southeast-3,ap-south-1'
+    Description: AWS regions allowed for Bedrock access (configured based on selected model and cross-region profile)
 
   EnableMonitoring:
     Type: String
@@ -94,21 +94,17 @@ Resources:
       AllowUnauthenticatedIdentities: true
       AllowClassicFlow: false
       # For External OIDC providers
-      OpenIdConnectProviderARNs:
-        !If
-          - UseExternalOIDC
-          - 
-            - !GetAtt OIDCProvider.Arn
-          - !Ref 'AWS::NoValue'
+      OpenIdConnectProviderARNs: !If
+        - UseExternalOIDC
+        - - !GetAtt OIDCProvider.Arn
+        - !Ref 'AWS::NoValue'
       # For Cognito User Pool
-      CognitoIdentityProviders:
-        !If
-          - UseCognitoUserPool
-          - 
-            - ClientId: !Ref CognitoUserPoolClientId
-              ProviderName: !Sub 'cognito-idp.${AWS::Region}.amazonaws.com/${CognitoUserPoolId}'
-              ServerSideTokenCheck: true
-          - !Ref 'AWS::NoValue'
+      CognitoIdentityProviders: !If
+        - UseCognitoUserPool
+        - - ClientId: !Ref CognitoUserPoolClientId
+            ProviderName: !Sub 'cognito-idp.${AWS::Region}.amazonaws.com/${CognitoUserPoolId}'
+            ServerSideTokenCheck: true
+        - !Ref 'AWS::NoValue'
 
   # IAM OIDC Provider (only for External OIDC)
   OIDCProvider:
@@ -123,10 +119,12 @@ Resources:
         - '0000000000000000000000000000000000000000'
 
   # Managed Policy for Bedrock Access
+  # Note: Cross-region inference requires access to all regions in the profile (us-east-1, us-east-2, us-west-2)
+  # as requests may be routed to any of these regions automatically
   BedrockAccessPolicy:
     Type: AWS::IAM::ManagedPolicy
     Properties:
-      Description: Policy for Cognito authenticated users to access Bedrock
+      Description: Policy for Cognito authenticated users to access Bedrock via cross-region inference
       PolicyDocument:
         Version: '2012-10-17'
         Statement:
@@ -232,20 +230,18 @@ Resources:
     DeletionPolicy: Delete
     Properties:
       IdentityPoolId: !Ref BedrockIdentityPool
-      IdentityProviderName: 
-        !If
-          - UseExternalOIDC
-          - !Ref OIDCProviderDomain
-          - !Sub 'cognito-idp.${AWS::Region}.amazonaws.com/${CognitoUserPoolId}'
+      IdentityProviderName: !If
+        - UseExternalOIDC
+        - !Ref OIDCProviderDomain
+        - !Sub 'cognito-idp.${AWS::Region}.amazonaws.com/${CognitoUserPoolId}'
       UseDefaults: false
       PrincipalTags:
         UserEmail: email
         UserId: sub
-        UserName: 
-          !If
-            - UseCognitoUserPool
-            - preferred_username
-            - name
+        UserName: !If
+          - UseCognitoUserPool
+          - preferred_username
+          - name
 
   # CloudWatch Log Group for Bedrock Access Tracking
   BedrockAccessLogGroup:
@@ -389,26 +385,25 @@ Outputs:
 
   ConfigurationJson:
     Description: Configuration JSON for CLI tool
-    Value: 
-      !If
-        - UseExternalOIDC
-        - !Sub |
-            {
-              "provider_domain": "${OIDCProviderDomain}",
-              "client_id": "${OIDCClientId}",
-              "identity_pool_id": "${BedrockIdentityPool}",
-              "aws_region": "${AWS::Region}",
-              "provider_type": "${OIDCProviderType}"
-            }
-        - !Sub |
-            {
-              "provider_domain": "TBD - Use your Cognito User Pool domain",
-              "client_id": "${CognitoUserPoolClientId}",
-              "identity_pool_id": "${BedrockIdentityPool}",
-              "aws_region": "${AWS::Region}",
-              "provider_type": "cognito",
-              "cognito_user_pool_id": "${CognitoUserPoolId}"
-            }
+    Value: !If
+      - UseExternalOIDC
+      - !Sub |
+        {
+          "provider_domain": "${OIDCProviderDomain}",
+          "client_id": "${OIDCClientId}",
+          "identity_pool_id": "${BedrockIdentityPool}",
+          "aws_region": "${AWS::Region}",
+          "provider_type": "${OIDCProviderType}"
+        }
+      - !Sub |
+        {
+          "provider_domain": "TBD - Use your Cognito User Pool domain",
+          "client_id": "${CognitoUserPoolClientId}",
+          "identity_pool_id": "${BedrockIdentityPool}",
+          "aws_region": "${AWS::Region}",
+          "provider_type": "cognito",
+          "cognito_user_pool_id": "${CognitoUserPoolId}"
+        }
 
   BedrockLogGroupName:
     Description: CloudWatch Log Group for Bedrock access tracking
@@ -429,4 +424,4 @@ Outputs:
     Condition: BedrockTrackingEnabled
     Value: !Ref CloudTrailBucket
     Export:
-      Name: !Sub '${AWS::StackName}-CloudTrailBucket'
+      Name: !Sub '${AWS::StackName}-CloudTrailBucket'

source/claude_code_with_bedrock/__init__.py

@@ -4,4 +4,4 @@
 """Claude Code with Bedrock - Enterprise deployment tool."""
 
 __version__ = "1.0.0"
-__all__ = ["cli", "auth", "bedrock", "monitoring"]
+__all__ = ["cli", "auth", "bedrock", "monitoring"]

source/claude_code_with_bedrock/cli/__init__.py

@@ -4,16 +4,15 @@
 """Command-line interface for Claude Code with Bedrock."""
 
 from cleo.application import Application
-from cleo.commands.command import Command
-from cleo.helpers import argument, option
 
-from .commands.init import InitCommand
+from .commands.cleanup import CleanupCommand
 from .commands.deploy import DeployCommand
+from .commands.destroy import DestroyCommand
+from .commands.init import InitCommand
+from .commands.package import PackageCommand
 from .commands.status import StatusCommand
 from .commands.test import TestCommand
-from .commands.package import PackageCommand
-from .commands.destroy import DestroyCommand
-from .commands.cleanup import CleanupCommand
+
 # TokenCommand temporarily disabled - not implemented
 
 
@@ -23,7 +22,7 @@ def create_application() -> Application:
         "claude-code-with-bedrock",
         "1.0.0"
     )
-    
+
     # Add commands
     application.add(InitCommand())
     application.add(DeployCommand())
@@ -33,7 +32,7 @@ def create_application() -> Application:
     application.add(DestroyCommand())
     application.add(CleanupCommand())
     # application.add(TokenCommand())  # Temporarily disabled
-    
+
     return application
 
 
@@ -44,4 +43,4 @@ def main():
 
 
 if __name__ == "__main__":
-    main()
+    main()

source/claude_code_with_bedrock/cli/commands/__init__.py

@@ -3,12 +3,12 @@
 
 """CLI commands for Claude Code with Bedrock."""
 
-from .init import InitCommand
 from .deploy import DeployCommand
+from .destroy import DestroyCommand
+from .init import InitCommand
+from .package import PackageCommand
 from .status import StatusCommand
 from .test import TestCommand
-from .package import PackageCommand
-from .destroy import DestroyCommand
 
 __all__ = [
     "InitCommand",
@@ -17,4 +17,4 @@
     "TestCommand",
     "PackageCommand",
     "DestroyCommand"
-]
+]