# @pleach/transport-bedrock (/docs/transport-bedrock)



<Callout type="warn">
  **Not yet published.** `@pleach/transport-bedrock` is marked `private`
  in this monorepo and is not on npm — `npm install @pleach/transport-bedrock`
  will not resolve today. This page documents the planned surface; the
  package publishes in a later cut.
</Callout>

`@pleach/transport-bedrock` is the AWS Bedrock route for a
Pleach session whose contract clause forbids direct provider
API keys. It implements the `AgentProvider` interface from
`@pleach/core` against the Bedrock Runtime API, so the family is
still `anthropic`, `openai`, or whichever model the buyer
cleared — only the transport changes. The canonical use case is
a regulated buyer reaching Claude (or any Bedrock-hosted family)
through their own VPC endpoint, with the call recorded on the
runtime ledger and reconcilable to the AWS bill.

## What it provides [#what-it-provides]

* An `AgentProvider` implementation against the Bedrock Runtime
  API per the `cloud-routed-agent.mdx` transport-vs-family split.
* Static AWS keys or an STS session token today
  (`accessKeyId` + `secretAccessKey`, optional `sessionToken`);
  container/role-assumption resolution (`fromContainerMetadata` /
  `credentialProvider` callback) is planned for a follow-on minor,
  per the IAM-federated credentials section of
  `cloud-routed-agent.mdx`.
* Region pinning at the endpoint URL, with the cloud as the
  enforcement authority (`cloud-routed-agent.mdx`: region as a
  hard constraint).
* Bedrock-specific cost-event emission so the
  `harness_auditable_calls` row carries the cloud, region, and
  model dimensions the AWS billing detail rolls up by — see the
  reconciliation SQL in `cloud-routed-agent.mdx`.

## Where it fits [#where-it-fits]

`@pleach/transport-bedrock` plugs into the same `provider` slot
on `SessionRuntime` that `AiSdkProvider` and `AnthropicSdkProvider`
fill — it satisfies the `AgentProvider` contract documented in
[Providers](/docs/providers). For the architectural shape of a
Bedrock-routed deployment — transport-vs-family, IAM federation,
region as a hard constraint, cost reconciliation — see
[Cloud-routed agent](/docs/cloud-routed-agent).

## Install [#install]

```bash
npm install @pleach/transport-bedrock
```

## API surface [#api-surface]

The `createBedrockProvider` factory signature, the credential
and region option shape, the defaultable model id field, and
the emitted cost-event payload all live on the package's npm
page:
[`@pleach/transport-bedrock`](https://www.npmjs.com/package/@pleach/transport-bedrock).
This page is placement orientation — what the SKU is for and
where it slots into the substrate. The npm README is the source
of truth for the constructor and option shapes; if a claim here
disagrees with the published README, the README wins.

## Where to go next [#where-to-go-next]

<Cards>
  <Card title="Cloud-routed agent" href="/docs/cloud-routed-agent" description="Transport-vs-family, IAM federation, region pinning, and cost reconciliation to the cloud invoice." />

  <Card title="Providers" href="/docs/providers" description="The AgentProvider contract this transport implements and the cascade rules it threads through." />

  <Card title="Region-pinned agent" href="/docs/region-pinned-agent" description="The sibling shape when family + region pinning is procurement-driven rather than cloud-driven." />
</Cards>