Routes Claude Code at Amazon Bedrock with the AWS profile stored under the bedrock credential. La...
50
Routes Claude Code at Amazon Bedrock with the AWS profile stored under the bedrock credential. Layer it onto the claude workload.
claude-bedrock| Type | Required | Description | |
|---|---|---|---|
com.docker.sandbox/network-policy@1 | Required | — | |
com.docker.sandbox/credential@1 | Optional | AWS profile name resolved to short-lived STS credentials on the host | |
com.docker.sandbox/lifecycle@1 | Required | — | |
com.docker.sandbox/agent-context@1 | Required | — | |
claude, deb/jqsbx run <agent> --kit sbx/claude-bedrock-mixin:latestRun the following command to install sbx on your machine.
brew install docker/tap/sbxwinget install Docker.sbxNote
Experimental: Sandbox Kit v3This kit uses the experimental Sandbox Kit specification, specifically v3. The format and runtime behavior may change before v3 is stable.
Points Claude Code at Amazon Bedrock, as a mixin (kind: mixin,
schemaVersion: "3"). Layered on the claude workload, the sandbox
talks to Bedrock with the AWS profile you stored on the host, and to nothing
else in AWS.
It provides claude-bedrock, which aidlc-claude requires.
The settings merge below is the kit's own and runs on any sbx release. The
bedrock credential itself (profile resolution on the host and the refreshed
sidecar file) needs an sbx release that honours that credential service on
any kit that declares it, not only on the built-in agent. Until that release
exists, the mixin composes but no credentials reach the container. The release
will be named here once it ships.
sbx secret set bedrock
sbx run claude --kit docker.io/sbx/claude-bedrock-mixin:latest
sbx run claude --kit "git+https://github.com/docker/sbx-kits-contrib.git#dir=claude-bedrock-mixin"
sbx run claude --kit ./claude-bedrock-mixin/
sbx secret set bedrock takes an AWS profile name, not keys. sbx create does
not read AWS_PROFILE from your shell. The daemon resolves the profile on the
host and writes the STS credentials to ~/.aws/sbx-bedrock-credentials.json in
the container, refreshing the file in place before expiry.
It declares requires: ["claude", "deb/jq"]. The provides entry stays
unversioned because the overlay ships no binary.
| Piece | Value |
|---|---|
| Environment | CLAUDE_CODE_USE_BEDROCK=1, ANTHROPIC_DEFAULT_SONNET_MODEL=us.anthropic.claude-sonnet-4-5-20250929-v1:0 |
| Settings keys | apiKeyHelper (stops the /login prompt) and awsCredentialExport (reads the sidecar file), merged at install, before Claude first starts |
| Egress | bedrock-runtime.*.amazonaws.com:443, bedrock.*.amazonaws.com:443 |
Claude Code runs awsCredentialExport again about five minutes before the
reported expiry, so a running session picks up a refresh without a restart. The
default ~/.aws/credentials would not, because the AWS SDK caches it.
The two keys are merged by an install hook that runs after the claude
workload seeds settings.json, because hooks run in dependency order and this
kit requires claude. Install hooks finish before Claude first starts, so the
first session already has both keys. Startup hooks would not give that: they run
from a detached dispatcher and can land after Claude has read its config.
With no bedrock secret stored, SBX_CRED_BEDROCK_MODE is none and
awsCredentialExport is not set.
The kit sets no AWS region, so it comes from the profile.
| Left out | Why |
|---|---|
FIPS endpoints (bedrock-runtime-fips.*) | Not needed by default. Add them in a fork. |
Bedrock Agents (bedrock-agent.*, bedrock-agent-runtime.*) | Claude Code does not use them. |
sts.*, oidc.*, portal.sso.* | The daemon resolves credentials on the host, so the container never calls them. |
The rest of *.amazonaws.com | A leaked STS credential can then only call Bedrock. |
There is no oauth block: Bedrock auth is IAM or SSO.
| Left out | Why |
|---|---|
ENTRYPOINT, sbx@1 | The workload owns the launch command and image config. |
agent-context filename: | CLAUDE.md names the profile, which belongs to the workload. |
~/.claude.json and the base settings.json | The claude workload seeds them. This kit only merges two keys in. |
| Session volumes, MCP gateway registration | Owned by the workload. |