You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Direct IAM Federation, Inference Profiles, and Claude Sonnet 4.5 Support (#36)
* feat: Add Direct IAM federation support alongside Cognito Identity Pool (#32)
This major update introduces Direct IAM federation as an alternative to Cognito Identity Pool,
providing more flexibility in authentication methods. Both federation types are fully supported
and can be selected during initialization.
Key changes:
- Add Direct IAM federation using STS AssumeRoleWithWebIdentity
- Support for Okta, Azure AD, Auth0, and Cognito User Pools via Direct IAM
- Rename cognito_auth module to credential_provider (more accurate name)
- Add provider-specific CloudFormation templates for better organization
- Improve CloudFormation error handling with custom exceptions
- Add automatic federation type detection in credential provider
- Update all CLI commands to support both federation methods
- Session duration configurable up to 12 hours for Direct IAM
Infrastructure:
- New bedrock-authentication.yaml as unified template
- Provider-specific templates for Okta, Azure, Auth0, Cognito User Pools
- Remove dual mode option - users choose either Direct IAM or Cognito
- Improved IAM role structure with provider-specific roles
Documentation:
- Update README, ARCHITECTURE, DEPLOYMENT, and CLI_REFERENCE docs
- Document both authentication methods without bias
- Clear explanations of configuration options
Breaking changes:
- cognito_auth module renamed to credential_provider
- New configuration field: federation_type (direct/cognito)
- New configuration field: federated_role_arn (for Direct IAM)
Migration:
- Existing Cognito deployments continue to work
- Auto-detection of federation type based on config
- Backward compatibility maintained
* feat: Add Bedrock inference profile permissions for cross-region support (#33) (#34)
- Added bedrock:ListInferenceProfiles permission to list available inference profiles
- Added bedrock:GetInferenceProfile permission to get details about specific profiles
- Updated ARCHITECTURE.md to document all IAM permissions granted to authenticated users
- These permissions enable cross-region inference profile discovery and selection
* feat: Add Bedrock inference profile permissions to Direct IAM templates
- Added bedrock:ListInferenceProfiles and bedrock:GetInferenceProfile permissions
- Updated all provider-specific templates (Okta, Azure, Auth0, Cognito User Pool)
- Updated legacy bedrock-authentication.yaml for consistency
- Enables cross-region inference profile discovery and selection for all federation types
Related: #35 (tracks removal of deprecated fallback template)
* feat: Add Direct IAM federation, inference profiles, and Claude Sonnet 4.5 support
Copy file name to clipboardExpand all lines: assets/docs/ARCHITECTURE.md
+34-4Lines changed: 34 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,13 +12,27 @@ The Claude Code authentication system enables secure, scalable access to Amazon
12
12
13
13
### Authentication Components
14
14
15
-
The core authentication component is the credential process located in `source/cognito_auth/`. This implements a complete OAuth2/OIDC client with PKCE flow for secure authentication without client secrets. When packaged for distribution, PyInstaller compiles this into a standalone executable that end users can run without needing Python installed. The credential process supports multiple identity providers including Okta, Azure AD, Auth0, and Cognito User Pools through a flexible provider registry system. Once authenticated, credentials are cached either in the operating system's secure keyring or in session files, depending on the organization's preference. The implementation follows the AWS CLI credential process protocol, making it transparent to any AWS SDK or tool.
15
+
The core authentication component is the credential process located in `source/credential_provider/`. This implements a complete OAuth2/OIDC client with PKCE flow for secure authentication without client secrets. When packaged for distribution, PyInstaller compiles this into a standalone executable that end users can run without needing Python installed. The credential process supports multiple identity providers including Okta, Azure AD, Auth0, and Cognito User Pools through a flexible provider registry system. Once authenticated, credentials are cached either in the operating system's secure keyring or in session files, depending on the organization's preference. The implementation follows the AWS CLI credential process protocol, making it transparent to any AWS SDK or tool.
16
16
17
17
The management CLI in `source/claude_code_with_bedrock/` provides IT administrators with tools to deploy and manage the infrastructure. Built on the Cleo framework, it offers an intuitive command-line interface for initialization, deployment, and package generation. This component is used only during setup and is not distributed to end users.
18
18
19
19
### AWS Infrastructure Components
20
20
21
-
The authentication infrastructure centers on an Amazon Cognito Identity Pool that federates OIDC tokens into AWS credentials. This creates a trust relationship between the organization's identity provider and AWS through an IAM OIDC Provider. The associated IAM role grants permissions specifically for Amazon Bedrock model invocation in configured regions. Every API call includes session tags containing the user's email and subject claim, ensuring complete attribution in CloudTrail logs.
21
+
The authentication infrastructure supports two federation methods. With Direct IAM Federation, an IAM OIDC Provider creates the trust relationship between the organization's identity provider and AWS, allowing direct token exchange via STS. With Cognito Identity Pool, Amazon Cognito acts as an intermediary that federates OIDC tokens into AWS credentials. Both methods use IAM roles that grant permissions specifically for Amazon Bedrock model invocation in configured regions. Every API call includes session tags containing the user's email and subject claim, ensuring complete attribution in CloudTrail logs.
22
+
23
+
#### IAM Permissions
24
+
25
+
The IAM role assigned to authenticated users grants the following Amazon Bedrock permissions:
26
+
27
+
-`bedrock:InvokeModel` - Invoke foundation models for text generation
28
+
-`bedrock:InvokeModelWithResponseStream` - Invoke models with streaming responses
29
+
-`bedrock:ListFoundationModels` - List available foundation models
30
+
-`bedrock:GetFoundationModel` - Get details about specific models
31
+
-`bedrock:GetFoundationModelAvailability` - Check model availability in regions
32
+
-`bedrock:ListInferenceProfiles` - List available cross-region inference profiles
33
+
-`bedrock:GetInferenceProfile` - Get details about specific inference profiles
34
+
35
+
These permissions are scoped to the configured regions and enable users to discover and invoke models through cross-region inference profiles, ensuring optimal performance and availability.
22
36
23
37
#### IAM Permissions
24
38
@@ -42,9 +56,25 @@ For organizations requiring detailed analytics, the optional analytics stack pro
42
56
43
57
The authentication flow begins when Claude Code requests AWS credentials through the AWS CLI. The CLI invokes our credential process executable, which initiates an OAuth2 flow with PKCE (Proof Key for Code Exchange) to ensure security without requiring client secrets. A browser window opens automatically, directing the user to their organization's identity provider for authentication.
44
58
45
-
After successful authentication, the identity provider redirects back to the local callback server with an authorization code. The credential process exchanges this code for OIDC tokens, then presents the ID token to Amazon Cognito Identity Pool. Cognito validates the token and calls STS AssumeRoleWithWebIdentity to obtain temporary AWS credentials. These credentials include session tags containing the user's email and subject claim, ensuring every subsequent API call to Amazon Bedrock can be attributed to the specific user.
59
+
After successful authentication, the identity provider redirects back to the local callback server with an authorization code. The credential process exchanges this code for OIDC tokens. The system then uses one of two authentication methods to obtain AWS credentials:
60
+
61
+
### Authentication Methods
62
+
63
+
The system supports two authentication methods:
64
+
65
+
**Direct IAM Federation**
66
+
- Uses IAM OIDC Provider with STS AssumeRoleWithWebIdentity
67
+
- Direct federation from OIDC tokens to AWS credentials
68
+
- Configurable session duration up to 12 hours
69
+
70
+
**Cognito Identity Pool**
71
+
- Uses Amazon Cognito Identity Pool as federation broker
72
+
- Cognito manages the OIDC to AWS credential exchange
73
+
- Configurable session duration up to 8 hours
74
+
75
+
The authentication method is selected during initial configuration and both methods provide full CloudTrail attribution through session tags. These credentials include session tags containing the user's email and subject claim, ensuring every subsequent API call to Amazon Bedrock can be attributed to the specific user.
46
76
47
-
The temporary credentials are returned to Claude Code through the standard AWS CLI credential process protocol. By default, credentials last for one hour but can be configured up to eight hours. The entire flow operates without any client secrets or long-lived credentials, following zero-trust security principles. Credentials are cached securely using either the operating system's keyring service or encrypted session files, preventing repeated authentication requests during the session lifetime.
77
+
The temporary credentials are returned to Claude Code through the standard AWS CLI credential process protocol. The entire flow operates without any client secrets or long-lived credentials, following zero-trust security principles. Credentials are cached securely using either the operating system's keyring service or encrypted session files, preventing repeated authentication requests during the session lifetime.
Copy file name to clipboardExpand all lines: assets/docs/DEPLOYMENT.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,6 +34,8 @@ poetry install
34
34
35
35
The `ccwb` (Claude Code with Bedrock) CLI tool guides you through deployment with an interactive wizard. Run `poetry run ccwb init` to begin. The wizard walks you through each configuration decision, starting with your OIDC provider details - enter the domain and Client ID you noted earlier.
36
36
37
+
The wizard asks you to choose an authentication method. You can select either Direct IAM federation or Cognito Identity Pool based on your organization's requirements. Both methods provide secure OIDC federation to AWS credentials.
38
+
37
39
Next, you'll select your Claude model and configure regional access. Choose from available Claude models (Opus, Sonnet, Haiku) and select a cross-region inference profile (US, Europe, or APAC) for optimal performance. The wizard will then prompt you to select a source region within your chosen profile for model inference. Finally, choose where to deploy the authentication infrastructure (typically your primary AWS region) and configure optional monitoring setup, which provides usage analytics and cost tracking through OpenTelemetry.
38
40
39
41
Once configuration is complete, deploy the infrastructure with:
@@ -42,7 +44,7 @@ Once configuration is complete, deploy the infrastructure with:
42
44
poetry run ccwb deploy
43
45
```
44
46
45
-
This single command orchestrates the creation of multiple AWS resources. A Cognito Identity Pool establishes the trust relationship with your identity provider. IAM roles and policies grant precisely scoped Bedrock access. If you enabled monitoring, it also deploys an ECS Fargate cluster running OpenTelemetry collector, complete with CloudWatch dashboards.
47
+
This single command orchestrates the creation of multiple AWS resources. Depending on your chosen authentication method, it creates either an IAM OIDC Provider or a Cognito Identity Pool to establish the trust relationship with your identity provider. IAM roles and policies grant precisely scoped Bedrock access. If you enabled monitoring, it also deploys an ECS Fargate cluster running OpenTelemetry collector, complete with CloudWatch dashboards.
46
48
47
49
> **Deployment Options**: For more control, see the [CLI Reference](CLI_REFERENCE.md) for deploying specific stacks or using dry-run mode.
0 commit comments