ai llm configuration

AI LLM Configuration

Optional AI assistant integration for BRMS. Configures LLM providers, model parameters, and API key management.

Supported Providers

Provider	Value	API Key Required	IAM Required
OpenAI	openai	Yes	No
Anthropic	anthropic	Yes	No
Google	google	Yes	No
Amazon Bedrock	amazon-bedrock	No	Yes
Azure OpenAI	azure-openai	Yes	No

Configuration

brms = {
  ai = {
    provider            = "anthropic"
    model               = "claude-sonnet-4-6"
    api_key_secret_arn  = "arn:aws:secretsmanager:us-east-1:123456789012:secret:anthropic-key-abc123"
    temperature         = 0.4      # 0.0 - 2.0 (default 0.4)
    context_window      = null     # Provider default
    max_output_tokens   = 32000    # Default 32000
    thinking_level      = "medium" # high, medium
  }
}

Environment Variables Generated

When AI is enabled, these env vars are set on the BRMS container:

Variable	Value	Conditional
LLM_PROVIDER	Provider name	Always
LLM_MODEL	Model identifier	Always
LLM_TEMPERATURE	Temperature value	Always
LLM_MAX_OUTPUT_TOKENS	Token limit	Always
LLM_THINKING_LEVEL	Thinking depth	Always
LLM_CONTEXT_WINDOW	Window size	Only if explicitly set
LLM_AZURE_RESOURCE_NAME	Azure resource	Only for azure-openai

Secrets

Secret	Env Var	Condition
AI API key	LLM_API_KEY	When ai.api_key_secret_arn is set (required for all providers except amazon-bedrock)

The API key is stored in Secrets Manager (user-provided ARN) and injected via the ECS task execution role. See Secrets Management.

Amazon Bedrock (IAM-Based)

Bedrock is unique, no API key needed. Instead, the BRMS task role gets an IAM policy. The policy is created only when provider == "amazon-bedrock" (count-gated) and is scoped to the configured model, not a wildcard over all models:

locals {
  bedrock_model_id             = var.brms != null && var.brms.ai != null ? var.brms.ai.model : ""
  bedrock_is_inference_profile = can(regex("^(us|eu|apac|global|au|ca|jp|us-gov)\\.", local.bedrock_model_id))
  bedrock_base_model_id        = local.bedrock_is_inference_profile ? regex("^[^.]+\\.(.*)", local.bedrock_model_id)[0] : local.bedrock_model_id
}

data "aws_iam_policy_document" "brms_bedrock_access" {
  count = local.create_brms && var.brms.ai != null && var.brms.ai.provider == "amazon-bedrock" ? 1 : 0

  # Foundation model: scoped to the configured base model. Region is wildcarded
  # so cross-region inference profiles can route to any region in the geography.
  statement {
    sid    = "AllowBedrockFoundationModel"
    effect = "Allow"
    actions = [
      "bedrock:InvokeModel",
      "bedrock:InvokeModelWithResponseStream"
    ]
    resources = [
      "arn:aws:bedrock:*::foundation-model/${local.bedrock_base_model_id}"
    ]
  }

  # Inference profile: added only when the model ID has a geographic prefix.
  dynamic "statement" {
    for_each = local.bedrock_is_inference_profile ? [1] : []
    content {
      sid    = "AllowBedrockInferenceProfile"
      effect = "Allow"
      actions = [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ]
      resources = [
        "arn:aws:bedrock:*:${local.account_id}:inference-profile/${local.bedrock_model_id}"
      ]
    }
  }
}

Access is granted only to the single configured base model (the region segment is wildcarded so cross-region inference profiles can route across the geography). When the model ID uses a geographic prefix (us., eu., apac., global., au., ca., jp., us-gov.), a second statement also grants invocation on the account-scoped inference profile ARN. Changing the configured model changes the granted resource, so switching models requires re-applying. The policy is attached to the BRMS task role only when the provider is amazon-bedrock. See IAM Architecture for how all policies compose together.

For amazon-bedrock, the model value must be an inference profile ID prefixed with a geographic scope (us., eu., apac., global., au., ca., jp., us-gov.). A plain foundation-model id (for example anthropic.claude-sonnet-4-20250514) fails variable validation. Example:

brms = {
  ai = {
    provider = "amazon-bedrock"
    model    = "us.anthropic.claude-sonnet-4-6-v1:0"  # note the required geographic prefix
  }
}

Bedrock invocations leave the BRMS task over the network. When the module creates the VPC, it automatically adds a bedrock-runtime interface VPC endpoint whenever brms.ai.provider = "amazon-bedrock" and endpoints are created (that is, when vpc.nat_gateway_mode = "none", where endpoints are provisioned automatically, or when vpc.enable_vpc_endpoints = true), so Bedrock works without a NAT gateway. With an existing VPC (vpc.create = false) your network team must provide this endpoint. Otherwise the BRMS tasks need outbound internet (a NAT gateway) to reach the Bedrock API.

Azure OpenAI

Requires additional azure_resource_name parameter:

brms = {
  ai = {
    provider            = "azure-openai"
    model               = "gpt-4o"
    api_key_secret_arn  = "arn:aws:secretsmanager:..."
    azure_resource_name = "my-azure-openai-resource"
  }
}

Validation enforces this at the variable level.

Validation Rules

Rule	Error message (variables.tf)
Provider must be one of: openai, anthropic, google, amazon-bedrock, azure-openai	"brms.ai.provider must be one of: openai, anthropic, google, amazon-bedrock, azure-openai."
api_key_secret_arn required when provider is not amazon-bedrock	"brms.ai.api_key_secret_arn is required when ai.provider is not amazon-bedrock."
api_key_secret_arn must be a Secrets Manager ARN (matches ^arn:aws:secretsmanager:)	"brms.ai.api_key_secret_arn must be a valid Secrets Manager ARN."
azure_resource_name required when provider is azure-openai	"brms.ai.azure_resource_name is required when ai.provider is azure-openai."
Temperature: 0.0 to 2.0	"brms.ai.temperature must be between 0 and 2."
Thinking level: high, medium	"brms.ai.thinking_level must be one of: high, medium."
max_output_tokens greater than 0	"brms.ai.max_output_tokens must be greater than 0."
context_window greater than 0 when set	"brms.ai.context_window must be greater than 0 when set."
For amazon-bedrock, model must be an inference profile ID with a geographic prefix (matches ^(us|eu|apac|global|au|ca|jp|us-gov)\.)	"For amazon-bedrock provider, model must use an inference profile ID with a geographic prefix (e.g., us.amazon.nova-2-lite-v1:0, eu.anthropic.claude-sonnet-4-6-v1:0). See https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-support.html"