The aws_access_key + access_key_secret Bedrock settings works, but when using the "role_arn" setting it breaks.
Terraform Setup:
resource "aws_iam_role" "agent" {
name_prefix = "coder-gateway-${var.ai_provider_name}-"
path = "/"
assume_role_policy = data.aws_iam_policy_document.assume-role.json
}
resource "aws_iam_policy" "bedrock" {
name_prefix = "coder-gateway-${var.ai_provider_name}"
policy = data.aws_iam_policy_document.bedrock.minified_json
}
resource "aws_iam_role_policy_attachment" "bedrock" {
policy_arn = aws_iam_policy.bedrock.arn
role = aws_iam_role.agent.name
}
resource "coderd_ai_provider" "bedrock-provider" {
count = var.ai_provider_type == "bedrock" ? 1 : 0
type = var.ai_provider_type
name = var.ai_provider_name
display_name = var.ai_provider_display_name
enabled = var.ai_provider_enabled
base_url = var.ai_provider_base_url
settings = {
bedrock = merge({
role_arn = aws_iam_role.agent.arn
# access_key_wo = aws_iam_access_key.agent.id
# access_key_secret_wo = aws_iam_access_key.agent.secret
# credentials_wo_version = time_rotating.bedrock.unix
}, var.ai_provider_settings)
}
}The above Terraform is grouped as a module. The parent-module is defined as:
module "anthropic" {
source = "./modules/coderd/ai-provider"
for_each = local.anthropic
region = var.region
ai_provider_type = "bedrock"
ai_provider_name = each.value.name
ai_provider_display_name = "AWS Bedrock - ${each.value.display_name}"
ai_provider_enabled = try(each.value.enabled, true)
ai_provider_base_url = "https://bedrock-runtime.${var.region}.amazonaws.com"
ai_provider_settings = {
region = "us-east-2"
model = each.key
small_fast_model = "global.anthropic.claude-haiku-4-5-20251001-v1:0"
}
aws_bedrock_allowed_models = concat([
"arn:aws:bedrock:us-east-2:${data.aws_caller_identity.this.account_id}:inference-profile/global.anthropic.claude-haiku-4-5-20251001-v1:0",
"arn:aws:bedrock:*::foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0"
], try(each.value.allowed_models, []))
}And the settings gets merged into:
settings = {
bedrock = {
role_arn = "arn:aws:iam::***:role/***"
region = "us-east-2"
model = "global.anthropic.claude-sonnet-4-5-20250929-v1:0"
small_fast_model = "global.anthropic.claude-haiku-4-5-20251001-v1:0"
}
}Error Output
│ Warning: Experimental Resource
│
│ with module.anthropic["global.anthropic.claude-sonnet-4-5-20250929-v1:0"].coderd_ai_provider.bedrock-provider[0],
│ on modules/coderd/ai-provider/main.tf line 94, in resource "coderd_ai_provider" "bedrock-provider":
│ 94: resource "coderd_ai_provider" "bedrock-provider" {
│
│ coderd_ai_provider is experimental. Changes are expected, and it is not recommended for production use.
╵
╷
│ Error: Provider produced inconsistent result after apply
│
│ When applying changes to
│ module.anthropic["global.anthropic.claude-sonnet-4-5-20250929-v1:0"].coderd_ai_provider.bedrock-provider[0],
│ provider "provider[\"registry.terraform.io/coder/coderd\"]" produced an unexpected new value: .settings:
│ inconsistent values for sensitive attribute.
│
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
The aws_access_key + access_key_secret Bedrock settings works, but when using the "role_arn" setting it breaks.
Terraform Setup:
The above Terraform is grouped as a module. The parent-module is defined as:
And the settings gets merged into:
Error Output