@pleach/transport-bedrock
First-party AWS Bedrock transport for cloud-routed Pleach runtimes — STS-federated credentials, region pinning, and Bedrock-specific cost-event emission.
Not yet published. @pleach/transport-bedrock is marked private
in this monorepo and is not on npm — npm install @pleach/transport-bedrock
will not resolve today. This page documents the planned surface; the
package publishes in a later cut.
@pleach/transport-bedrock is the AWS Bedrock route for a
Pleach session whose contract clause forbids direct provider
API keys. It implements the AgentProvider interface from
@pleach/core against the Bedrock Runtime API, so the family is
still anthropic, openai, or whichever model the buyer
cleared — only the transport changes. The canonical use case is
a regulated buyer reaching Claude (or any Bedrock-hosted family)
through their own VPC endpoint, with the call recorded on the
runtime ledger and reconcilable to the AWS bill.
What it provides
- An
AgentProviderimplementation against the Bedrock Runtime API per thecloud-routed-agent.mdxtransport-vs-family split. - Static AWS keys or an STS session token today
(
accessKeyId+secretAccessKey, optionalsessionToken); container/role-assumption resolution (fromContainerMetadata/credentialProvidercallback) is planned for a follow-on minor, per the IAM-federated credentials section ofcloud-routed-agent.mdx. - Region pinning at the endpoint URL, with the cloud as the
enforcement authority (
cloud-routed-agent.mdx: region as a hard constraint). - Bedrock-specific cost-event emission so the
harness_auditable_callsrow carries the cloud, region, and model dimensions the AWS billing detail rolls up by — see the reconciliation SQL incloud-routed-agent.mdx.
Where it fits
@pleach/transport-bedrock plugs into the same provider slot
on SessionRuntime that AiSdkProvider and AnthropicSdkProvider
fill — it satisfies the AgentProvider contract documented in
Providers. For the architectural shape of a
Bedrock-routed deployment — transport-vs-family, IAM federation,
region as a hard constraint, cost reconciliation — see
Cloud-routed agent.
Install
npm install @pleach/transport-bedrockAPI surface
The createBedrockProvider factory signature, the credential
and region option shape, the defaultable model id field, and
the emitted cost-event payload all live on the package's npm
page:
@pleach/transport-bedrock.
This page is placement orientation — what the SKU is for and
where it slots into the substrate. The npm README is the source
of truth for the constructor and option shapes; if a claim here
disagrees with the published README, the README wins.
Where to go next
Cloud-routed agent
Transport-vs-family, IAM federation, region pinning, and cost reconciliation to the cloud invoice.
Providers
The AgentProvider contract this transport implements and the cascade rules it threads through.
Region-pinned agent
The sibling shape when family + region pinning is procurement-driven rather than cloud-driven.
@pleach/transport-azure-openai
First-party Azure OpenAI Service transport for cloud-routed Pleach runtimes — managed-identity credentials, deployment-name routing, and Azure-specific cost-event emission.
@pleach/transport-vertex
First-party Google Vertex AI transport for cloud-routed Pleach runtimes — workload-identity credentials, region pinning, and Vertex-specific cost-event emission.