feat(provider-bedrock): wire Anthropic-on-Bedrock chat via aws-sdk-bedrockruntime (D7.2.a)

[moonming]

Summary

Replaces the skeleton's BridgeError::Config(\"not yet implemented\") stubs in aisix-provider-bedrock with real Bedrock dispatch for the anthropic.* publisher (Claude on Bedrock). The AWS SDK handles SigV4 signing, retries, and (in the streaming follow-up D7.2.b) the binary event-stream framing.

Scope: deliberately minimal — chat() for anthropic.* only. Other Bedrock publishers (meta.*, mistral.*, amazon.*, cohere.*, ai21.*) surface a clear publisher-named "not yet implemented — D7.3+" error. chat_stream() returns "streaming not yet implemented — D7.2.b" for all publishers. This mirrors the D6 PR #319 pattern: focused, mergeable, follow-ups carry the rest.

Wire shape (Anthropic on Bedrock)

Per https://docs.aws.amazon.com/bedrock/latest/userguide/model-parameters-anthropic-claude-messages.html:

• URL: POST /model/<id>/invoke
• Body: Anthropic Messages JSON with Bedrock-specific shape rules:
  1. anthropic_version: \"bedrock-2023-05-31\" MUST be present
  2. model MUST be absent (Bedrock dispatches via URL path)
  3. stream MUST be absent for InvokeModel
• Auth: SigV4 — Authorization: AWS4-HMAC-SHA256 ... + x-amz-date headers signed by aws-sdk-bedrockruntime

Credentials convention

ProviderKey.secret is a JSON-encoded {access_key_id, secret_access_key, session_token?, region} blob. The bridge parses it per request (cheap — strings only); credential rotation lands as soon as the PK snapshot refreshes. The cp-api side delivers credentials decrypted via the mTLS-only etcd channel (same trust boundary as Guardrail credentials).

ProviderKey.api_base (if set) is forwarded as the SDK's endpoint_url so operators can point at a private deployment / VPC endpoint. Tests use the same path via a #[cfg(test)] endpoint_url_override seam to drive bridge.chat() end-to-end against wiremock.

Anthropic wire reuse

Same playbook as PR #319 for aisix-provider-openai::wire: promotes the needed types/fns in aisix-provider-anthropic::wire from pub(crate) to pub so the Bedrock crate can build Anthropic Messages bodies without re-implementing them. AnthropicBridge itself is unchanged. The Anthropic crate's wire module gets a doc note explaining the visibility (sibling crate reuse, workspace-internal, not external-SDK stability promise).

References

• AWS Bedrock Runtime API — https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_InvokeModel.html
• Anthropic on Bedrock body shape — https://docs.aws.amazon.com/bedrock/latest/userguide/model-parameters-anthropic-claude-messages.html
• AWS Rust SDK — https://docs.rs/aws-sdk-bedrockruntime
• Cross-region inference profiles — https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html

Test plan

35 unit tests, all passing:

Publisher resolution (12 tests — preserved from skeleton)

All publisher tags, cross-region prefixes (us./eu./apac./global./us-gov.), guard against treating a publisher segment as a region, catch-all to BedrockPublisher::Other for not-yet-wired publishers (DeepSeek, Writer, Stability AI, etc.).

BedrockSecret parsing (5 tests)

Full form, with session_token, empty rejected, non-JSON rejected with generic shape error, missing region rejected, error message does NOT echo raw secret bytes (M1-style leak guard pinned by bedrock_secret_error_does_not_leak_secret_content).

Pre-dispatch validation (6 tests)

Unknown publisher, non-Anthropic publisher named in error, invalid secret, empty secret, missing model_name, chat_ignores_req_model_and_uses_ctx_model_name (D6 audit HIGH-1 regression carried over).

chat_stream not-implemented error (1 test)

Returns clear D7.2.b not-implemented error.

Bridge dispatch via bridge.chat() end-to-end against wiremock (8 tests, highest-confidence pins)

• URL path includes deployment id with : URL-encoded (path_regex tolerant)
• Body carries anthropic_version=bedrock-2023-05-31, no model, no stream
• SigV4 Authorization: AWS4-HMAC-SHA256 header reaches the wire along with x-amz-date
• tool_use response blocks translate to OpenAI tool_calls shape (via reused Anthropic crate's converter)
• 4xx upstream error body redacted to canned phrase (does NOT echo operator's account number / IAM role ARN — Audit M1 lesson applied proactively)
• 429 mapped to canned "rate limited" message + status preserved
• Cross-region inference profile (us.anthropic.claude-*) dispatches with the full prefixed model id in the URL
• system role messages translated to top-level Anthropic system field

Test plan TODO

• cargo test -p aisix-provider-bedrock → 35/35 pass
• cargo test -p aisix-provider-anthropic → 63/63 pass (no regression from pub promotions)
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo fmt --check clean
• CI: cargo test --workspace
• CI: cargo clippy
• CI: cargo fmt --check

Summary by CodeRabbit

• New Features

  • AWS Bedrock Runtime integration for Anthropic models: credential parsing, request translation, dispatch, and error handling.

• API Changes

  • Anthropic provider request/response types and helper utilities are now publicly accessible to other crates.

• Documentation

  • Updated Bedrock integration docs and status, clarifying supported/unsupported areas (notably streaming).

• Chores

  • Updated crate dependencies and test tooling for Bedrock provider.

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 111569c0-4407-4bea-85f0-cabcdb582e69

📥 Commits

Reviewing files that changed from the base of the PR and between d330894 and 48b11c8.

📒 Files selected for processing (2)

• crates/aisix-provider-bedrock/Cargo.toml
• crates/aisix-provider-bedrock/src/bridge.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• crates/aisix-provider-bedrock/Cargo.toml

---

📝 Walkthrough

Walkthrough

This PR adds AWS Bedrock as a deployment target for Anthropic models: it exposes Anthropic wire types/functions, adds Bedrock SDK dependencies, implements model-id publisher resolution, builds per-request SigV4 credential handling and SDK clients, implements Anthropic-on-Bedrock chat dispatch, and adds comprehensive tests.

Changes

Bedrock Anthropic Integration

Layer / File(s)	Summary
Expose Anthropic wire types and functions crates/aisix-provider-anthropic/src/lib.rs, crates/aisix-provider-anthropic/src/wire.rs	Module and type visibility changed from crate-private to public. Exposes AnthropicRequest, AnthropicMessage, AnthropicResponse, AnthropicResponseBlock, AnthropicUsage, streaming event/shape types, DEFAULT_MAX_TOKENS, and translation helpers (split_system, build_request, tool translation, response_into_chat_response).
Bedrock dependencies, docs, and test seam crates/aisix-provider-bedrock/Cargo.toml, crates/aisix-provider-bedrock/src/lib.rs, crates/aisix-provider-bedrock/src/bridge.rs	Adds aisix-provider-anthropic and workspace-managed AWS Bedrock/runtime dependencies, updates crate-level documentation/status, and adds a test-only endpoint override seam for wiremock.
Publisher resolution from model ID crates/aisix-provider-bedrock/src/bridge.rs	Implements BedrockPublisher::from_model_id() with known publisher tags and conditional cross-region prefix stripping (us., eu., apac., global., us-gov.).
Credential handling and SDK client setup crates/aisix-provider-bedrock/src/bridge.rs	Introduces BedrockSecret JSON parsing and validation, per-request AWS SDK Bedrock client construction with SigV4 credentials and optional endpoint override, model-id character validation, and mapping of SDK/service errors into canonical BridgeError with sensitive-info redaction.
Chat control flow and Anthropic dispatch crates/aisix-provider-bedrock/src/bridge.rs	Implements Bridge::chat() to resolve upstream model id and dispatch Anthropic to chat_anthropic(); chat_anthropic() reshapes gateway chat into Anthropic-on-Bedrock request (strip model/stream, inject anthropic_version), calls invoke_model, decodes AnthropicResponse, and converts to gateway ChatResponse. chat_stream() returns not-implemented errors with Anthropic/non-Anthropic distinctions.
Bridge implementation and wiremock tests crates/aisix-provider-bedrock/src/bridge.rs	Adds extensive tests for publisher resolution, BedrockSecret parsing and redaction, pre-dispatch validation, dispatch selection, end-to-end wiremock invoke-model assertions (URL/path shape, body pinning rules, SigV4 headers), tool-use translation, upstream error mapping without leaking account/role details, cross-region dispatch behavior, model-id validation, and system-message translation.

🎯 3 (Moderate) | ⏱️ ~20 minutes

---

Note

🎁 Summarized by CodeRabbit Free

Your organization has reached its limit of developer seats under the Pro Plan. For new users, CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please add seats to your subscription by visiting https://app.coderabbit.ai/login.If you believe this is a mistake and have available seats, please assign one to the pull request author through the subscription management page using the link above.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[moonming]

Audit follow-up pushed (48b11c8): Independent audit surfaced 4 HIGH + 6 MEDIUM + 3 LOW findings. This commit addresses all HIGH + the MEDIUM items with concrete test/code-level fixes.

HIGH (all fixed)

• H1 — Retry-After header on 429 now propagated. map_service_error converts the smithy HeaderMap → http::HeaderMap and reuses aisix_gateway::parse_retry_after. Pinned by chat_maps_upstream_429_with_retry_after_and_canned_rate_limited (mock returns Retry-After: 42, asserts retry_after: Some(42s)).
• H2 — BedrockPublisher::Debug taxonomy (Other / <unspecified>) replaced with operator's actual model id + publisher.name() catalog identifier in not-implemented errors. Pinned by chat_publisher_not_implemented_error_includes_model_id_and_publisher_name.
• H3 — SdkError::TimeoutError no longer reports elapsed_ms: 0. map_sdk_error now takes (started, deadline) and reports the actual elapsed budget.
• H4 — Tool-call test now asserts arguments is a JSON-encoded STRING per OpenAI spec (not a parsed object) and round-trip-parses to verify {"city": "SF"}.

MEDIUM (addressed)

• M2 — validate_model_id_chars defense-in-depth check ([A-Za-z0-9._:/-] allowed). Pinned by chat_rejects_model_id_with_path_injection_chars.
• M4 — chat_stream distinguishes D7.2.b (anthropic streaming) from D7.3+ (publisher not wired). Two new tests pin the split.
• M5 — 4xx redaction test strengthened with exact-match positive assertion (assert_eq!(message, "upstream returned 400")), not just absence-of-leak.
• M6 — Added chat_with_us_gov_cross_region_prefix_dispatches_with_full_model_id and chat_with_global_cross_region_prefix_dispatches_with_full_model_id for dispatch-path parity with us..

Deferred (justified)

• M1 — AnthropicRequest field visibility asymmetry. Workspace-internal surface decision; doesn't gate merge. Will revisit when the anthropic crate gets a public-API stabilization pass.
• M3 — Explicit SdkError variant arms. SdkError is non_exhaustive; the _ => catch-all is intentional. Tracking a future CI lint to catch silent absorption on SDK bumps separately.
• L1/L3 — Other Debug variant + metrics-label cosmetic. The variant goes away as D7.3+ wires real publisher dispatch; addressing now would be churn.

Verification

cargo test -p aisix-provider-bedrock → 41 passed (was 35; +6 audit regression tests)
cargo clippy --workspace --all-targets -- -D warnings → clean
cargo fmt --check → clean