Skip to content

feat(auth): add a Claude Platform on AWS credential tier #61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bluedoors wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(auth): add a Claude Platform on AWS credential tier #61

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,19 @@ require (
)

require (
github.com/aws/aws-sdk-go-v2 v1.30.3 // indirect
github.com/aws/aws-sdk-go-v2/config v1.27.27 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.17.27 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 // indirect
github.com/aws/smithy-go v1.20.3 // indirect
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
github.com/bahlo/generic-list-go v0.2.0 // indirect
github.com/buger/jsonparser v1.1.2 // indirect
Expand Down
26 changes: 26 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,31 @@
github.com/anthropics/anthropic-sdk-go v1.50.1 h1:XTd1RkdeHCPusPpzcBY5RIWj/WW6ZktjftxrHvQBJfU=
github.com/anthropics/anthropic-sdk-go v1.50.1/go.mod h1:3EfIfmFqxH6rbiLcIP4tPFyXL/IHakx2wDG4OU+TIEI=
github.com/aws/aws-sdk-go-v2 v1.30.3 h1:jUeBtG0Ih+ZIFH0F4UkmL9w3cSpaMv9tYYDbzILP8dY=
github.com/aws/aws-sdk-go-v2 v1.30.3/go.mod h1:nIQjQVp5sfpQcTc9mPSr1B0PaWK5ByX9MOoDadSN4lc=
github.com/aws/aws-sdk-go-v2/config v1.27.27 h1:HdqgGt1OAP0HkEDDShEl0oSYa9ZZBSOmKpdpsDMdO90=
github.com/aws/aws-sdk-go-v2/config v1.27.27/go.mod h1:MVYamCg76dFNINkZFu4n4RjDixhVr51HLj4ErWzrVwg=
github.com/aws/aws-sdk-go-v2/credentials v1.17.27 h1:2raNba6gr2IfA0eqqiP2XiQ0UVOpGPgDSi0I9iAP+UI=
github.com/aws/aws-sdk-go-v2/credentials v1.17.27/go.mod h1:gniiwbGahQByxan6YjQUMcW4Aov6bLC3m+evgcoN4r4=
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 h1:KreluoV8FZDEtI6Co2xuNk/UqI9iwMrOx/87PBNIKqw=
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11/go.mod h1:SeSUYBLsMYFoRvHE0Tjvn7kbxaUhl75CJi1sbfhMxkU=
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 h1:SoNJ4RlFEQEbtDcCEt+QG56MY4fm4W8rYirAmq+/DdU=
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15/go.mod h1:U9ke74k1n2bf+RIgoX1SXFed1HLs51OgUSs+Ph0KJP8=
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 h1:C6WHdGnTDIYETAm5iErQUiVNsclNx9qbJVPIt03B6bI=
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15/go.mod h1:ZQLZqhcu+JhSrA9/NXRm8SkDvsycE+JkV3WGY41e+IM=
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 h1:dT3MqvGhSoaIhRseqw2I0yH81l7wiR2vjs57O51EAm8=
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3/go.mod h1:GlAeCkHwugxdHaueRr4nhPuY+WW+gR8UjlcqzPr1SPI=
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 h1:HGErhhrxZlQ044RiM+WdoZxp0p+EGM62y3L6pwA4olE=
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17/go.mod h1:RkZEx4l0EHYDJpWppMJ3nD9wZJAa8/0lq9aVC+r2UII=
github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 h1:BXx0ZIxvrJdSgSvKTZ+yRBeSqqgPM89VPlulEcl37tM=
github.com/aws/aws-sdk-go-v2/service/sso v1.22.4/go.mod h1:ooyCOXjvJEsUw7x+ZDHeISPMhtwI3ZCB7ggFMcFfWLU=
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 h1:yiwVzJW2ZxZTurVbYWA7QOrAaCYQR72t0wrSBfoesUE=
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4/go.mod h1:0oxfLkpz3rQ/CHlx5hB7H69YUpFiI1tql6Q6Ne+1bCw=
github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 h1:ZsDKRLXGWHk8WdtyYMoGNO7bTudrvuKpDKgMVRlepGE=
github.com/aws/aws-sdk-go-v2/service/sts v1.30.3/go.mod h1:zwySh8fpFyXp9yOr/KVzxOl8SRqgf/IDw5aUt9UKFcQ=
github.com/aws/smithy-go v1.20.3 h1:ryHwveWzPV5BIof6fyDvor6V3iUL7nTfiTKXHiW05nE=
github.com/aws/smithy-go v1.20.3/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
Expand Down
72 changes: 71 additions & 1 deletion pkg/cmd/cmd_auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -619,10 +619,22 @@ func readCredentials(cfg *config.Config, dir, profile string) (storedCredentials
}

func authStatus(ctx context.Context, c *cli.Command) error {
out := os.Stdout

// Tier 0 — Claude Platform on AWS. When --aws / ANTHROPIC_USE_AWS is active
// the request short-circuits to the AWS gateway in getDefaultRequestOptions,
// so the profile/key/federation rows below would mislabel a non-winner as
// the winner. Render a focused AWS status and return. This matters in the
// default CI case: with ANTHROPIC_USE_AWS persistent in the env, Bool("aws")
// is true even without typing --aws, and without this the report would claim
// "(no credential configured…)" while requests in the same env succeed.
if c.Root().Bool("aws") {
return awsAuthStatus(out, c.Root())
}

dir := config.DefaultDir()
profile, profileSource := activeProfileWithSource(c, dir)

out := os.Stdout
fmt.Fprintf(out, "Active profile: %s (%s)\n", profile, profileSource)
fmt.Fprintf(out, "Config dir: %s\n", dir)
fmt.Fprintf(out, "Profile config: %s\n", config.ProfilePath(dir, profile))
Expand Down Expand Up @@ -895,6 +907,64 @@ func authStatus(ctx context.Context, c *cli.Command) error {
return nil
}

// awsAuthStatus renders `auth status` when the Claude Platform on AWS tier is
// active (--aws / ANTHROPIC_USE_AWS). It shows AWS as the tier-0 winner and the
// values the backend will use, mirroring buildAWSConfig / the SDK's resolution
// (region: --aws-region > AWS_REGION > AWS_DEFAULT_REGION via the flag's
// Sources; base URL: backend-resolved from region when not overridden). No
// profile/key/federation rows are printed — they don't apply on this transport.
func awsAuthStatus(out io.Writer, root *cli.Command) error {
fmt.Fprintln(out, "Backend: Claude Platform on AWS (--aws / ANTHROPIC_USE_AWS)")

fmt.Fprintln(out)
fmt.Fprintln(out, "Credentials")
apiKey := root.String("aws-api-key")
if apiKey != "" {
writeRow(out, true, "AWS gateway (API key, x-api-key)", formatSecret(apiKey, true))
writeDetail(out, "source", "--aws-api-key / ANTHROPIC_AWS_API_KEY")
} else {
writeRow(out, true, "AWS gateway (SigV4)", "via AWS credential chain")
writeDetail(out, "source", "default AWS credential chain (IAM role / AWS_PROFILE / env)")
}

region := root.String("aws-region")
workspaceID := root.String("aws-workspace-id")

fmt.Fprintln(out)
fmt.Fprintln(out, "Region")
if region != "" {
writeRow(out, true, "--aws-region / AWS_REGION / AWS_DEFAULT_REGION", region)
} else {
writeRow(out, true, "(unset)", "set --aws-region or AWS_REGION (required)")
}

fmt.Fprintln(out)
fmt.Fprintln(out, "Workspace")
if workspaceID != "" {
writeRow(out, true, "--aws-workspace-id / ANTHROPIC_AWS_WORKSPACE_ID", workspaceID)
} else {
writeRow(out, true, "(unset)", "set --aws-workspace-id or ANTHROPIC_AWS_WORKSPACE_ID (required)")
}

// Base URL: --base-url > ANTHROPIC_AWS_BASE_URL > regional derivation. The
// AWS backend resolves this itself, so the first-party SDK-default/profile
// base-URL rows would mislead — show the AWS-resolved value instead.
fmt.Fprintln(out)
fmt.Fprintln(out, "Base URL")
switch {
case root.String("base-url") != "":
writeRow(out, true, "--base-url flag", root.String("base-url"))
case os.Getenv("ANTHROPIC_AWS_BASE_URL") != "":
writeRow(out, true, "ANTHROPIC_AWS_BASE_URL env", os.Getenv("ANTHROPIC_AWS_BASE_URL"))
case region != "":
writeRow(out, true, "Regional (derived from region)", fmt.Sprintf("https://aws-external-anthropic.%s.api.aws", region))
default:
writeRow(out, true, "Regional (derived from region)", "(determined once region is set)")
}

return nil
}

// activeProfileWithSource mirrors activeProfile but returns a human-readable
// description of which tier resolved the active profile, for use in status
// output. The global --profile flag's Sources include ANTHROPIC_PROFILE, so
Expand Down
Loading