README

Registers AWS Bedrock as a provider for the WordPress AI Client, so the AI features in WordPress 7.0 and the AI plugin can run on the models hosted in your own AWS account.

Works as a WordPress plugin and as a Composer package.

Requirements

PHP 8.3 or newer
WordPress 7.0 or newer, which bundles the AI Client
An AWS account with Bedrock model access in the region you configure

Installation

composer require achttienvijftien/ai-provider-for-bedrock

The package is a wordpress-plugin, so with composer/installers it lands in your plugins directory. Activate it and the provider registers itself.

Configuration

Constant or environment variable	Required	Description
`AWS_BEDROCK_API_KEY`	yes	A long lived Bedrock API key, used as a bearer token.
`AWS_BEDROCK_REGION`	no	The region to use, falling back to `AWS_DEFAULT_REGION`, then `AWS_REGION`, then `us-east-1`.

The AI Client derives credentials from a constant named after the provider ID, so defining AWS_BEDROCK_API_KEY is all that is needed. No registration code is required.

Choosing a model

Pin the model you want. Bedrock exposes dozens of models, and when nothing expresses a preference the AI Client selects the first one that satisfies the request, which follows the order the Bedrock API happens to return and is usually a very small model.

With the AI plugin:

add_filter( 'wpai_preferred_text_models', function ( array $models ): array {
	array_unshift( $models, array( 'aws-bedrock', 'eu.anthropic.claude-sonnet-5' ) );

	return $models;
} );

Note that the AI plugin ships preferences for other providers only, so without a filter like this none of them match Bedrock.

Directly through the AI Client:

wp_ai_client_prompt( 'Summarize this' )
	->using_model_preference( array( 'aws-bedrock', 'eu.anthropic.claude-sonnet-5' ) )
	->generate_text();

Model IDs come from this package's own discovery, so models that need an inference profile carry their profile ID, such as eu.anthropic.claude-sonnet-5 rather than anthropic.claude-sonnet-5.

Using an IAM role instead of an API key

A long lived key can be replaced with SigV4 signing, which lets an ECS task role or EC2 instance role provide short lived credentials:

use AchttienVijftien\AiProvider\Bedrock\Auth\SigV4Authentication;
use AchttienVijftien\AiProvider\Bedrock\BedrockProvider;
use WordPress\AiClient\AiClient;

add_action( 'plugins_loaded', function () {
	AiClient::defaultRegistry()->setProviderRequestAuthentication(
		BedrockProvider::ID,
		SigV4Authentication::fromDefaultChain()
	);
}, 20 );

This requires aws/aws-sdk-php.

IAM permissions

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"], "Resource": "*" },
    { "Effect": "Allow", "Action": "bedrock:CallWithBearerToken", "Resource": "*" },
    { "Effect": "Allow", "Action": ["bedrock:ListFoundationModels", "bedrock:GetFoundationModel", "bedrock:ListInferenceProfiles"], "Resource": "*" },
    { "Effect": "Allow", "Action": "aws-marketplace:ViewSubscriptions", "Resource": "*" }
  ]
}

bedrock:CallWithBearerToken is required for API key authentication and requests are denied without it. bedrock:ListInferenceProfiles is optional but recommended, because without it the model IDs of profile based models are derived from the region geography instead of read from AWS.

Invoking a model your account has never used also needs aws-marketplace:Subscribe. Granting that to a long lived key lets it subscribe your account to paid products, so it is usually better to invoke a new model once from the console as an administrator and leave this package with view access only.

Anthropic models additionally require a one time use case form, which is submitted from the Bedrock console.

What it handles

Inference profiles. Most current models, including every Claude and Nova model, cannot be invoked by their bare model ID. Profile IDs are read from ListInferenceProfiles and fall back to the region geography prefix.
Structured output. An output schema uses the native structured output field, falling back to a forced tool call and then to an untargeted tool call, so JSON schemas work across model families that support different mechanisms.
Sampling parameters. Anthropic removed temperature and topP from Claude Opus 4.7 and newer. Those values are dropped for models that reject them, and a rejection discovered at runtime is remembered so the rejected call is only made once.
Vision and documents. Image and document parts are sent as Converse content blocks.
Tool calling. Function declarations map onto toolConfig, and tool calls come back as function call message parts.
Image generation. Amazon Nova Canvas, Amazon Titan and Stability models through InvokeModel.
Honest capability reporting. Models that cannot be invoked are not listed, so discovery does not advertise something that fails later.

Development

nvm use
composer install
pnpm install

Unit tests

composer lint
composer test

The unit suite runs against the Composer copy of the AI Client and needs neither WordPress nor credentials.

Integration tests

The integration suite runs inside a real WordPress through wp-env, with this plugin and the AI plugin both active. Every Bedrock call is stubbed through the pre_http_request filter, so no AWS credentials and no network access are required.

pnpm run env:start
pnpm run test:integration
pnpm run env:stop

pnpm test runs both suites in order.

These tests cover the parts that unit tests cannot: that the plugin registers itself, that credentials resolve from the constant, that model discovery maps inference profiles correctly, and that an ability such as ai/summarization reaches this provider and back.

License

GPL-3.0-or-later

achttienvijftien / ai-provider-for-bedrock

Maintainers

Package info

Statistics

Security