controlplane

Documentation

Overview

Package controlplane queries the Amazon Bedrock control plane to discover which model identifiers a set of credentials can actually invoke.

Two independent things have to hold, and the control plane reports them through different APIs:

• The model must be serverless — billed per request with no resource to deploy: a base model offering ON_DEMAND throughput, or a global cross-region inference profile fronting one. Everything else InvokeModel accepts in its modelId (Bedrock Marketplace endpoints, Provisioned Throughput, custom and imported models) needs the ARN of a resource the customer created, so it cannot come from a shared catalog. ListFoundationModels and ListInferenceProfiles answer this.
• The account must have been granted access to it. ListFoundationModels returns every model in the region regardless of access, so entitlement is a separate GetFoundationModelAvailability call per model — without it the catalog would keep offering models that fail with AccessDeniedException.

All calls are plain SigV4-signed GETs rather than the service/bedrock SDK module, matching how pkg/infra/cache signs its ElastiCache requests.

Index

• Variables
• func IsGeographyScopedProfile(id string) bool
• type Availability
• type Client
  • func NewClient() Client
• type Credentials
  • func (c Credentials) CacheKey() string

Variables

var ErrRegionRequired = errors.New("bedrock controlplane: aws region is required")

ErrRegionRequired is returned when credentials carry no region: the control plane endpoint is regional, so there is nothing to query without one.

Functions

func IsGeographyScopedProfile

func IsGeographyScopedProfile(id string) bool

IsGeographyScopedProfile reports whether id names an inference profile bound to a single geography ("us.", "eu.", "jp.", "au."…), which is invocable only from source regions inside that geography. Plain model IDs and the geography- agnostic "global." profile are not scoped and return false.

Types

type Availability

type Availability struct {
	// ModelIDs are the candidates these credentials can invoke.
	ModelIDs map[string]struct{}
	// EntitlementChecked reports whether model access was actually verified. It
	// is false when the credentials cannot call GetFoundationModelAvailability
	// (it needs bedrock:GetFoundationModelAvailability), in which case ModelIDs
	// is only known to be serverless and may still contain models that fail with
	// AccessDeniedException. Callers use it to tell a trustworthy empty result
	// from an unverifiable one.
	EntitlementChecked bool
}

Availability is the verdict on a set of candidate model IDs.

type Client

type Client interface {
	// ListInvocableModelIDs narrows candidates to the model IDs these credentials
	// can pass to InvokeModel and get a completion back: serverless, in this
	// region, and with model access granted to the account.
	//
	// Candidates are filtered rather than the region's full model list enumerated
	// so the per-model entitlement calls stay proportional to what the caller
	// would actually offer.
	ListInvocableModelIDs(ctx context.Context, creds Credentials, candidates []string) (Availability, error)
}

func NewClient

func NewClient() Client

type Credentials

type Credentials struct {
	Region       string
	AccessKey    string
	SecretKey    string
	SessionToken string
	UseRole      bool
	RoleARN      string
}

Credentials carries a registry's AWS auth material. It is duplicated here rather than imported from pkg/infra/providers so app services can depend on this package without pulling in the provider invocation layer.

func (Credentials) CacheKey

func (c Credentials) CacheKey() string

CacheKey identifies the credential set a result belongs to. It deliberately omits the secret key: the access key (or assumed role) plus region already identify the account whose catalog was read.