cloud-agent

A LangGraph ReAct agent backed by Amazon Bedrock Converse via boto3 (langchain-aws ChatBedrockConverse). Reference implementation for routing Bedrock agent traffic through the Akto proxy with minimal client changes.

Client integration

→ docs/CLIENT-INTEGRATION.md — client guide (URL + env config only):

• Paste the BEDROCK_ENDPOINT_URL Akto gives you
• Copy bedrock_config.py, use create_bedrock_llm()
• Optional: BEDROCK_STREAM=true for streaming

Quick start:

BEDROCK_ENDPOINT_URL=https://akto-proxy?openai_url=https://bedrock-runtime.<region>.amazonaws.com

from bedrock_config import create_bedrock_llm
llm = create_bedrock_llm()

Stack

• LangGraph — ReAct agent loop (create_react_agent)
• langchain-aws — ChatBedrockConverse (boto3 bedrock-runtime client)
• boto3 / botocore — SigV4 via IAM profile; optional Bearer via AWS_BEARER_TOKEN_BEDROCK
• FastAPI — optional HTTP API

Proxy (sign-then-relay)

See docs/CLIENT-INTEGRATION.md for the full client guide. Summary:

1. Set BEDROCK_ENDPOINT_URL (boto3 endpoint_url)
2. Use create_bedrock_llm() so SigV4 is computed for upstream Bedrock, then routed through Akto

./scripts/start-server.sh proxy
./scripts/run.sh proxy

Unset BEDROCK_ENDPOINT_URL for direct Bedrock.

Prerequisites

• Python 3.10+
• IAM profile with Bedrock access (AWS_PROFILE, e.g. cloud-agent-bedrock)

Setup (standard boto3 SigV4)

Fresh account bootstrap

See docs/AWS-BOOTSTRAP.md for full steps.

aws configure                    # admin keys for your AWS account
python3 -m venv .venv && source .venv/bin/activate
pip3 install -r requirements.txt
./scripts/bootstrap-account.sh   # creates IAM user/role/policy + tests Bedrock

Existing credentials

./scripts/setup-aws.sh

The setup script walks through aws configure, optional assume-role profile, Bedrock smoke test, and writes .env.

Setup script commands

Command	What it does
./scripts/setup-aws.sh	Full interactive setup
./scripts/setup-aws.sh configure	aws configure only
./scripts/setup-aws.sh sso	aws configure sso (IAM Identity Center)
./scripts/setup-aws.sh role	Add assume-role profile to ~/.aws/config
./scripts/setup-aws.sh verify	sts get-caller-identity + Bedrock Converse test
./scripts/setup-aws.sh test	Bedrock Converse smoke test (direct)
./scripts/setup-aws.sh test-proxy	Bedrock Converse smoke test via Akto proxy
./scripts/setup-aws.sh policy	Print IAM policy reference

Admin: create IAM role (one-time)

If you have admin creds and need to create the Bedrock role:

./scripts/create-bedrock-role.sh

Manual setup

cp .env.example .env
aws configure   # stores keys in ~/.aws/credentials

Agent server

POST /model/{model_id}/invoke

uvicorn server:app --port 8000
./scripts/test-client-invoke.sh "What is the weather in Mumbai?"

Simple curl body — SDK handles Bedrock auth headers:

{"message": "What is the weather in Mumbai?"}

Run

python3 agent.py              # CLI
./scripts/start-server.sh     # HTTP server (see docs/CLIENT-INTEGRATION.md)
./scripts/test-curl.sh chat   # smoke test against running server

Default model

amazon.nova-micro-v1:0 (override with BEDROCK_MODEL_ID for your region / inference profile).

Verified

Mode	Result
Direct bedrock-runtime.<region>.amazonaws.com	Works (SigV4)
Akto proxy sign-then-relay	SigV4 signed for upstream; requires Akto pass-through forward

Header encoding note

If headers look "encoded" in Akto dashboard but calls return 200, that's ingestion JSON serialization — not boto3 mutating headers on the wire.