# Inference-only access to Claude models on Bedrock.
# Cross-Region inference profiles route across US regions for availability.
data "aws_iam_policy_document" "bedrock_invoke" {
  statement {
    sid    = "AllowBedrockModelInvoke"
    effect = "Allow"

    actions = [
      "bedrock:InvokeModel",
      "bedrock:InvokeModelWithResponseStream",
    ]

    resources = [
      "arn:aws:bedrock:us-*::foundation-model/anthropic.claude-*",
      "arn:aws:bedrock:us-*:${data.aws_caller_identity.current.account_id}:inference-profile/us.anthropic.claude-*",
    ]
  }
}

resource "aws_iam_policy" "bedrock_invoke" {
  name        = "Bedrock-${var.role_name}-InvokeModel"
  description = "Allow ${var.role_name} to invoke Anthropic Claude models via Bedrock."
  policy      = data.aws_iam_policy_document.bedrock_invoke.json
}

resource "aws_iam_role_policy_attachment" "bedrock_invoke" {
  role       = module.role.iam_role_name
  policy_arn = aws_iam_policy.bedrock_invoke.arn
}