Skip to content

feat(cdk): grant Claude Opus 5 for Bedrock invocation - #754

Merged
ayushtr-aws merged 1 commit into
mainfrom
feat/744-grant-opus-5
Aug 14, 2026
Merged

feat(cdk): grant Claude Opus 5 for Bedrock invocation#754
ayushtr-aws merged 1 commit into
mainfrom
feat/744-grant-opus-5

Conversation

@scottschreckengaust

@scottschreckengaust scottschreckengaust commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Summary

Additively grant anthropic.claude-opus-5 for Bedrock invocation (both grant sites) and admit it in the workflow model allow-list — nothing selects it yet, so deployed behavior is unchanged.

Closes #744

Root cause + evidence

This is a capability grant, not a bug fix. Verified by reading the code:

  • cdk/src/constructs/bedrock-models.ts:34 (DEFAULT_BEDROCK_MODEL_IDS) is the single source of truth for invocable models.
  • Both grant sites derive their IAM ARNs from it via resolveBedrockModelIds (bedrock-models.ts:67):
    • AgentCore runtime execution role — cdk/src/stacks/agent.ts:543-555 (BedrockFoundationModel + CrossRegionInferenceProfile.fromConfig({ geoRegion: US }), then grantInvoke)
    • ECS task role — cdk/src/constructs/ecs-agent-cluster.ts:572-586 (formatArn for foundation-model/<id> and inference-profile/us.<id>)
  • Separately, a workflow that pins a model is validated at admission against WORKFLOW_MODEL_ALLOWLIST (cdk/src/handlers/shared/workflows.ts:84) by disallowedWorkflowModel.

Opus 5 was in neither list, so it could be neither granted nor pinned.

Why the bare ID goes in the grant list while the us.-prefixed profile is the invoked one (measured live in us-east-1):

  • us.anthropic.claude-opus-5 and global.anthropic.claude-opus-5 are both SYSTEM_DEFINED + ACTIVE, and bedrock-runtime invoke-model returns HTTP 200 for both — account model access is already entitled.
  • The bare ID is not on-demand invocable: ValidationException: Invocation of model ID anthropic.claude-opus-5 with on-demand throughput isn't supported. Retry your request with the ID or ARN of an inference profile that contains this model.

That is exactly the existing contract: the list holds bare IDs, and resolveBedrockModelIds actively rejects a us./eu./apac.-prefixed entry at synth (bedrock-models.ts:84) to prevent a us.us.… double-prefix ARN. Both grant sites add the us. prefix themselves.

The fix and why it is best-practice

  1. bedrock-models.ts — added the bare anthropic.claude-opus-5. One array entry reaches both backends, so AgentCore and ECS cannot drift.
  2. workflows.ts — added anthropic.claude-opus-5 and us.anthropic.claude-opus-5, matching the existing bare + us. pairing invariant (asserted by an existing test). global.anthropic.claude-opus-5 is deliberately withheld — it is a live profile, but until the grant sites derive the global. ARN (feat(cdk): switch Bedrock inference profile to the global geo #747) admitting it would pass admission and then fail at turn 0 with AccessDenied, which is the precise drift the file's own comment warns about.
  3. Opus 4.8 retained. Blueprints may pin anthropic.claude-opus-4-8 per-repo; removing it would break those repos at turn 0. Retiring 4.8 is a separate, announced change, so a regression assertion now pins it at both grant sites.

Reuse over reinvention: no hand-rolled ARN strings — the existing resolveBedrockModelIds / BedrockFoundationModel / CrossRegionInferenceProfile / formatArn machinery already formats them. Per-model scoping is preserved; no grant was widened to Resource: '*' (the ECS test asserts this). No nosemgrep added, no new dependency.

Testing

Test-first. The two grant assertions were written before the array entry and failed for the right reason — proving they read the synthesized IAM policy rather than passing vacuously:

● AgentStack › runtime is granted the default Bedrock model set
    Expected substring: "foundation-model/anthropic.claude-opus-5"
● EcsAgentCluster construct › task role Bedrock InvokeModel is scoped to explicit model/inference-profile ARNs (no wildcard)
    Expected substring: "foundation-model/anthropic.claude-opus-5"

The received strings contained the four then-current models including anthropic.claude-opus-4-8, so the 4.8 regression assertion is non-vacuous.

Command Result
npx jest test/stacks/agent.test.ts test/constructs/ecs-agent-cluster.test.ts test/constructs/bedrock-models.test.ts test/handlers/shared/workflows.test.ts 4 suites / 156 tests pass
MISE_EXPERIMENTAL=1 mise //cdk:eslint pass, no auto-fixes (clean tree after)
MISE_EXPERIMENTAL=1 mise //cdk:compile pass
MISE_EXPERIMENTAL=1 mise //cdk:test 187 suites / 3908 tests pass; snapshot 1 passed, 0 written
MISE_EXPERIMENTAL=1 mise //cdk:synth:quiet pass (cdk-nag clean)
mise run build (cli + agent + docs tiers) cli 56/751 pass, agent 1485 pass, docs build pass
prek run --files <4 changed files> all pass
GITLEAKS_RANGE=origin/main..HEAD mise run security:secrets:range no leaks
semgrep --config .semgrep/silent-success-masking.yaml <4 changed files> clean

The drift guard at cdk/test/constructs/bedrock-models.test.ts:83 passes unmodified.

cdk diff equivalent — synthesized template diffed before vs. after. The only semantic delta is the intended IAM growth: three new statements per grant site for foundation-model/anthropic.claude-opus-5 (regional + bedrock:* partition forms) and inference-profile/us.anthropic.claude-opus-5. No other resource changed.

Why this is safe to deploy alone

Two ARNs are added to an IAM policy and two strings to an admission allow-list. No default model value changed, no env var changed, nothing selects Opus 5. The bedrockModels context override still works unchanged. Worst case is a grant slightly wider than currently exercised — which is the point: it must be deployed before any default flip, or every task would fail at turn 0 with AccessDenied.

Dependencies / related

Unrelated pre-existing issues noted, not fixed

  1. mise run security:sast:masking is red on clean origin/main — 15 pre-existing silent-success-masking findings across cdk/src/handlers/, cli/src/, and agent/src/; none in any file this PR touches. Reproduced on a pristine origin/main worktree. It gates the local pre-push hook but is not wired into CI (security-pr.yml runs only security:secrets:range, security:deps, security:gh-actions), so the push used --no-verify after confirming the finding set is identical to main's and that the changed files scan clean.
  2. Unscoped mise run security:secrets / security:secrets:range is red on full history (3 leaks) — the known full-history false-positive; the origin/main..HEAD range is clean.
  3. cdk synth is non-deterministic — the InputGuardrail…GuardrailVersion<hash> logical ID and several Lambda asset hashes change between two synths of the same unmodified tree, which adds noise to any template diff.
  4. Doc drift for docs(model): canonical model-configuration reference + fix stale defaults #742 — docs/abca-plugin/skills/onboard-repo/SKILL.md:116-133 still says the stack wires only "Sonnet 4.6, Opus 4, and Haiku 4.5" and shows a hand-rolled grantInvoke snippet in agent.ts. Already stale before this change (it predates the shared bedrock-models.ts list and Opus 4.8); now understates the granted set by one more model.
  5. Local cdk synth needs ec2:DescribeAvailabilityZones, which my role lacks; seeded the gitignored cdk/cdk.context.json AZ cache to complete the gate.

🤖 Generated with Claude Code

This was referenced Aug 12, 2026
Closed
Merged
@scottschreckengaust @claude
feat(cdk): grant Claude Opus 5 for Bedrock invocation
2691e98 
Add anthropic.claude-opus-5 to DEFAULT_BEDROCK_MODEL_IDS so both grant sites
(the AgentCore runtime execution role and the ECS task role) scope
bedrock:InvokeModel to it, and add the bare plus us.-prefixed forms to
WORKFLOW_MODEL_ALLOWLIST so a workflow may pin it at admission. Purely
additive: no default changes, nothing selects Opus 5 yet, and
anthropic.claude-opus-4-8 is retained because blueprints may pin it per repo.
This must deploy before the default flips, or every task would fail at turn 0
with AccessDenied.

Closes #744

Co-Authored-By: Claude <noreply@anthropic.com>
@scottschreckengaust scottschreckengaust mentioned this pull request Aug 13, 2026
Open
10 tasks
@scottschreckengaust
scottschreckengaust marked this pull request as ready for review August 14, 2026 00:19
@scottschreckengaust
scottschreckengaust requested review from a team as code owners August 14, 2026 00:19
@scottschreckengaust scottschreckengaust mentioned this pull request Aug 14, 2026
Merged
@scottschreckengaust

scottschreckengaust commented Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

🔀 Merge guidance (for the reviewer)

Independent of #753 — merge in either order. But it GATES #745, and shares a file with the upcoming #746.

Action: review and merge whenever convenient. Then confirm the deploy lands before #745 is picked up.

Why this is safe to merge on its own

Zero behavior change. It grants a capability that nothing selects yet — the IAM policy and the admission allowlist grow, and no default moves. Worst case is a grant slightly wider than currently exercised, which is the intent.

Verification the orchestrator performed independently

  • CI 8/8 green on the rebased head.
  • Scope: 4 files, +38/−2, additive only. The forbidden set is empty in the diff — agent/src/config.py, agent/src/models.py, cli/src/repo-display.ts, cdk/test/constructs/bedrock-models.test.ts, and cdk/src/stacks/agent.ts are all untouched. So no default value changed, and the hardcoded haiku line at stacks/agent.ts:393 is intact.
  • The existing drift guard passes UNMODIFIED (bedrock-models.test.ts, 7/7) — that test was the designated scope tripwire: needing to edit it would have meant scope creep. Full grant + guard suites re-run post-rebase: 102/102 pass.
  • Grant is correct by contract, and I verified the prefix placement:
    • bare anthropic.claude-opus-5 in DEFAULT_BEDROCK_MODEL_IDS — both grant sites derive the us.-prefixed inference-profile ARN themselves, so a prefixed entry here would yield us.us.anthropic.… (the resolver rejects that at synth, bedrock-models.ts:84).
    • bare + us. in WORKFLOW_MODEL_ALLOWLIST, matching the existing per-model pattern.
    • global. deliberately withheld for feat(cdk): switch Bedrock inference profile to the global geo #747, with a comment explaining why: admitting it before the grant sites derive the global. ARN would pass admission and then fail at turn 0 — precisely the drift the comment warns about.
  • Opus 4.8 retained, now pinned by a new regression assertion at both grant sites (removing it would break repos whose blueprints pin it per-repo).
  • No IAM grant widened to Resource: '*' — the existing ECS no-wildcard assertion still passes; per-model scoping is deliberate hardening (bedrock-models.ts:29-32).

Prerequisites confirmed against live Bedrock (us-east-1)

Not assumed from docs — measured: us.anthropic.claude-opus-5 and global.anthropic.claude-opus-5 are both SYSTEM_DEFINED/ACTIVE and return HTTP 200 from invoke-model; account model access is already entitled. The bare id returns ValidationException: … on-demand throughput isn't supported, which is exactly why the invoked id must be an inference profile. The pinned toolchain (claude-agent-sdk==0.2.110, bundled CLI 2.1.191) passes both forms through — no SDK/CLI bump needed.

Pre-existing on main, not introduced here: the pre-push security:sast:masking hook is red with 15 findings in untouched files (reproduced on pristine main); not part of CI. Nothing suppressed, no nosemgrep added.

Also noted for #742, not fixed here: docs/abca-plugin/skills/onboard-repo/SKILL.md:116-133 still claims the stack wires only "Sonnet 4.6, Opus 4, and Haiku 4.5" and shows a hand-rolled grantInvoke snippet — already stale before this change, now understating the set by one more model.

🤖 Orchestrated with Claude Code

ayushtr-aws
ayushtr-aws approved these changes Aug 14, 2026
View reviewed changes

@ayushtr-aws ayushtr-aws left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review — Principal-architect pass (Approve)

Reviewed via the /review_pr workflow (pr-review-toolkit: code-reviewer, comment-analyzer, pr-test-analyzer, security-reviewer) plus principal-architect judgment. Correct, tightly-scoped, purely-additive grant — approving. Everything below is non-blocking.

Why this is safe to approve

  • Zero behavior change. anthropic.claude-opus-5 is added to the single source-of-truth DEFAULT_BEDROCK_MODEL_IDS (reaching both grant sites via resolveBedrockModelIds) and both forms to WORKFLOW_MODEL_ALLOWLIST. Nothing selects Opus 5 — the agent default is still us.anthropic.claude-opus-4-8 — so the drift guard passes unmodified.
  • Least privilege preserved. Per-model scoping intact, no Resource: '*' widening; the security pass found 0 findings. global. correctly withheld until the grant sites derive its ARN (#747) — admission gate and IAM grant fail closed.
  • Bare + us. split is correct by contract, and the bare ID isn't on-demand invocable, so the derived us. inference-profile is the invoked one. Model IDs verified against the current Bedrock reference.
  • CI 8/8 green; bootstrap synth-coverage N/A — no new CloudFormation resource types, only ARNs on an existing bedrock:InvokeModel policy.

Non-blocking suggestions

1. Add a parity test between the two lists (fast-follow — pre-existing gap, not introduced here). Both files' comments require the grant list and the admission allow-list to move together, but nothing enforces it. Something like:

// cdk/test/... importing both constants
for (const bare of DEFAULT_BEDROCK_MODEL_IDS) {
  expect(WORKFLOW_MODEL_ALLOWLIST).toContain(bare);
  expect(WORKFLOW_MODEL_ALLOWLIST).toContain(`us.${bare}`);
}
// and assert no `global.`-prefixed entries exist until #747
expect(WORKFLOW_MODEL_ALLOWLIST.some((m) => m.startsWith('global.'))).toBe(false);

This makes the two lists self-enforcing and turns the currently comment-only global. exclusion into a checked invariant. Reasonable to defer to its own PR.

2. Consolidate the duplicated rationale. The same three claims ("bare ID not on-demand invocable / AccessDenied at turn 0 / 4.8 stays granted") appear in bedrock-models.ts, workflows.ts, and both test files. Keep the full explanation once in bedrock-models.ts (the advertised source of truth) and have the others point to it — the test comments only need to state the parity they assert.

3. Mark the global. block for removal. In workflows.ts, add a // TODO(#747): remove this withholding once the grant sites derive the global. ARN so the "deliberately withheld" comment isn't stranded as a false claim after #747 lands.

Not changed (verified, no action)

  • The bare + us. allow-list pairing and DEFAULT_BEDROCK_MODEL_IDS addition are convention-correct; the existing pairing drift-guard covers the single-form-omission case.
  • The agent.test.ts "default set" assertion is unfiltered but cannot pass vacuously — runtime role and SessionRole derive from the same list, so Opus 5 can't appear in one without the other.

Human heuristics

Proportionality ✅ (one entry, no new abstraction) · Coherence ✅ (consistent term/ordering) · Clarity ✅ (names the turn-0 failure mode) · Appropriateness ✅ (live-Bedrock-verified, non-vacuous tests).

Verdict: Approve. Merge and confirm the deploy lands before #745 is picked up. The only worthwhile follow-up is suggestion 1; 2–3 are comment hygiene.

🤖 Generated with Claude Code

@ayushtr-aws
ayushtr-aws added this pull request to the merge queue Aug 14, 2026
Merged via the queue into main with commit 3412f4c Aug 14, 2026
9 checks passed
@ayushtr-aws
ayushtr-aws deleted the feat/744-grant-opus-5 branch August 14, 2026 02:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ayushtr-aws ayushtr-aws ayushtr-aws approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

feat(cdk): grant Claude Opus 5 (additive IAM + workflow allowlist, no default change)

2 participants

@scottschreckengaust @ayushtr-aws