Amazon Bedrock

Crush currently supports running Anthropic models through Bedrock, with caching disabled.

A Bedrock provider appears once Crush can find AWS credentials. You can authenticate in one of two ways:

API key. Set AWS_BEARER_TOKEN_BEDROCK to a Bedrock API key. This is the simplest option and never expires mid-session.

AWS credential chain (SSO, profiles, access keys). Configure AWS the usual way with aws configure or aws configure sso. Crush picks up whatever the AWS SDK credential chain resolves, including AWS_PROFILE, AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY, or an SSO session. To select a specific profile, set AWS_PROFILE in your shell (AWS_PROFILE=myprofile crush) or in the top-level env config.

Refreshing SSO sessions

If you authenticate via AWS SSO, your session expires periodically. Set aws_auth_refresh to a command that refreshes it. When Bedrock returns a credential error, Crush runs the command, then retries the request in place (no duplicate messages, no manual restart):

{    "$schema": "https://charm.land/crush.json",    "env": {        "AWS_PROFILE": "my-sso-profile"    },    "providers": {        "bedrock": {            "aws_auth_refresh": "aws sso login --profile my-sso-profile"        },        "bedrock-europe": {            "aws_auth_refresh": "aws sso login --profile my-eu-sso-profile"        }    }}

• aws_auth_refresh — shell command run when AWS credentials expire (e.g. aws sso login)