feat: native AWS Bedrock provider via Converse API#7920
Conversation
…loyment Deploy Hermes Agent on AWS using native Bedrock Converse API. - CloudFormation template with VPC, IAM, SSM, optional VPC Endpoints - Supports Claude, Nova, DeepSeek, Llama via cross-region inference profiles - Zero API key management — IAM role authentication - Tested end-to-end: 4 models, streaming, tool calling, gateway Companion to hermes-agent PR #7920: NousResearch/hermes-agent#7920
AWS Deployment Template & Related ResourcesThis PR now has a companion one-click AWS deployment project: sample-hermes-agent-on-aws-with-bedrock — CloudFormation template that deploys Hermes Agent on EC2 with native Bedrock integration. Same approach as OpenClaw on AWS with Bedrock (which was accepted into aws-samples). Resolves #3863 (Native AWS Bedrock provider support) End-to-end CloudFormation test resultsCloudFormation stack deployed in us-east-2 (~5 min). After SSM connect:
The deployment template currently pins to this PR branch. Once merged, it switches to official PyPI. |
88a7020 to
4c260a8
Compare
Add Amazon Bedrock as a first-class provider using the native Converse API (not the OpenAI-compatible endpoint). This gives Hermes users direct access to the full Bedrock ecosystem: IAM authentication, Guardrails, cross-region inference profiles, dynamic model discovery, and all foundation models. Core changes: - agent/bedrock_adapter.py: Converse API adapter with streaming, tool calling, error classification, model discovery, context lengths, and Guardrails - Provider registration across auth.py, models.py, providers.py, config.py - Agent integration in run_agent.py (init, kwargs, streaming, non-streaming) - hermes doctor diagnostics, hermes auth AWS credential display - usage_pricing.py Bedrock model pricing - error_classifier.py Bedrock-specific error patterns - model_metadata.py Bedrock context length resolution - Documentation: guides/aws-bedrock.md, quickstart provider table - pyproject.toml: [bedrock] optional dependency (boto3) Tested on EC2 (Python 3.11.14, boto3 1.42.88, IAM role) with: - 107 automated tests (all passing) - 4 models end-to-end (Claude Sonnet 4.6, Nova Pro, DeepSeek V3.2, Llama 4) - Streaming, tool calling, Guardrails, /model switch, hermes doctor - Feishu gateway integration verified Reference: OpenClaw extensions/amazon-bedrock/ plugin
Users without AWS accounts can now use a Bedrock API Key from their admin. hermes model -> Bedrock -> choose "Bedrock API Key" -> enter key -> chat. Uses the OpenAI-compatible bedrock-mantle endpoint, no boto3 needed. Existing IAM credential chain (Converse API) is unchanged.
4c260a8 to
a4bc97e
Compare
Foundation model IDs (anthropic.claude-opus-4-6-20250514-v1:0) fail with ValidationException on Bedrock — most models now require inference profile IDs (us.anthropic.claude-opus-4-6-v1) for on-demand invocation.
… provider Replace the anthropic.Anthropic -> AnthropicBedrock monkey-patch with Hermes Agent native Bedrock provider (provider="bedrock"), which uses the Converse API directly via boto3. Benefits: - Supports ALL Bedrock models (Claude, Nova, DeepSeek, Llama, Mistral) not just Claude (Anthropic SDK limitation) - No monkey-patching — clean provider="bedrock" configuration - Native streaming, tool calling, error classification, Guardrails - Dynamic model discovery via ListFoundationModels Changes: - app/hermes/main.py: Delete monkey-patch, use provider="bedrock" - bridge/contract.py: Default provider anthropic -> bedrock - bridge/bedrock_provider.py: Simplified (Converse API handles routing) - bridge/Dockerfile: Add [bedrock] extra for boto3 - cdk.json: Use inference profile ID as default model Depends on: NousResearch/hermes-agent#7920 (native Bedrock provider PR) Ref: https://github.com/JiaDe-Wu/sample-hermes-agent-on-aws-with-bedrock
|
Great work here guys! Quick note from testing: models that don’t support tool/function calling can pass discovery but currently cause a validation error -> retry loop -> failure (e.g. DeepSeek R1 via Bedrock). Since Hermes is fundamentally tool-driven, this ends up being a pretty rough failure mode in practice. In @richin13’s PR (#4346 ) we added a simple workaround where we catch that case, warn the user, strip tools, and continue. Not ideal long-term, but it avoids the hard failure. Given that tool support doesn’t seem reliably exposed via the Bedrock APIs, this probably needs to be handled at runtime rather than during discovery. Happy to port something similar here, or switch to failing fast with a clearer error, if that’s useful. |
|
This is a thorough and well-tested implementation — the 107 tests, EC2 integration testing, documentation, Guardrails support, dynamic model discovery, and diagnostics are impressive. A few observations comparing the Converse API approach to using the Anthropic SDK's Streaming: addressed ✅Unlike PR #8832, this PR implements Prompt caching: still missingThe Converse API doesn't support Anthropic's
Reasoning/thinking: partially addressedThe PR surfaces Code size comparison
The Converse API adapter (message conversion, tool translation, response normalization, streaming event processing) accounts for ~1,000 lines. With Missing Claude Code compatibilityNeither this PR nor #8832 supports the Claude Code env var conventions that many Bedrock users already have configured:
SuggestionA hybrid approach might be ideal: use |
|
As this is something the community is wanting and is sitting and waiting for, could we get something, an MVP, out sooner rather than later, and do all the little improvements separately? Iterative approach, faster feedback from actual users, ensure we're addressing the important issues and not theoretical what-ifs. Beta launch if we're not sure? Just my 2 cents :) |
|
I am running tests now, will get a MVP PR out shortly |
…AnthropicBedrock SDK (prompt caching, thinking budgets)\nNon-Claude models -> Converse API (Nova, DeepSeek, Llama, Mistral)\n\nAlso fixes:\n- Non-tool-calling models (DeepSeek R1) no longer crash (ptlally feedback)\n- Empty text blocks filtered (issue NousResearch#9486)\n- 130 tests (was 107)
|
Updated PR with dual-path architecture + bug fixes:
130 tests, all passing on EC2. |
Salvaged from PR #7920 by JiaDe-Wu — cherry-picked Bedrock-specific additions onto current main, skipping stale-branch reverts (293 commits behind). Dual-path architecture: - Claude models → AnthropicBedrock SDK (prompt caching, thinking budgets) - Non-Claude models → Converse API via boto3 (Nova, DeepSeek, Llama, Mistral) Includes: - Core adapter (agent/bedrock_adapter.py, 1098 lines) - Full provider registration (auth, models, providers, config, runtime, main) - IAM credential chain + Bedrock API Key auth modes - Dynamic model discovery via ListFoundationModels + ListInferenceProfiles - Streaming with delta callbacks, error classification, guardrails - hermes doctor + hermes auth integration - /usage pricing for 7 Bedrock models - 130 automated tests (79 unit + 28 integration + follow-up fixes) - Documentation (website/docs/guides/aws-bedrock.md) - boto3 optional dependency (pip install hermes-agent[bedrock]) Co-authored-by: JiaDe WU <40445668+JiaDe-Wu@users.noreply.github.com>
Salvaged from PR #7920 by JiaDe-Wu — cherry-picked Bedrock-specific additions onto current main, skipping stale-branch reverts (293 commits behind). Dual-path architecture: - Claude models → AnthropicBedrock SDK (prompt caching, thinking budgets) - Non-Claude models → Converse API via boto3 (Nova, DeepSeek, Llama, Mistral) Includes: - Core adapter (agent/bedrock_adapter.py, 1098 lines) - Full provider registration (auth, models, providers, config, runtime, main) - IAM credential chain + Bedrock API Key auth modes - Dynamic model discovery via ListFoundationModels + ListInferenceProfiles - Streaming with delta callbacks, error classification, guardrails - hermes doctor + hermes auth integration - /usage pricing for 7 Bedrock models - 130 automated tests (79 unit + 28 integration + follow-up fixes) - Documentation (website/docs/guides/aws-bedrock.md) - boto3 optional dependency (pip install hermes-agent[bedrock]) Co-authored-by: JiaDe WU <40445668+JiaDe-Wu@users.noreply.github.com>
|
Merged via PR #10549. Your Bedrock implementation was cherry-picked onto current main (your branch was 293 commits behind) with your authorship preserved in git log. The dual-path architecture, Converse API adapter, model discovery, guardrails, streaming, tests, and documentation all made it in. Two test assertions were adjusted to match our canonical provider naming convention ( Also thanks to @hheydaroff for the earlier PR #6845 which helped inform the direction. |
Salvaged from PR NousResearch#7920 by JiaDe-Wu — cherry-picked Bedrock-specific additions onto current main, skipping stale-branch reverts (293 commits behind). Dual-path architecture: - Claude models → AnthropicBedrock SDK (prompt caching, thinking budgets) - Non-Claude models → Converse API via boto3 (Nova, DeepSeek, Llama, Mistral) Includes: - Core adapter (agent/bedrock_adapter.py, 1098 lines) - Full provider registration (auth, models, providers, config, runtime, main) - IAM credential chain + Bedrock API Key auth modes - Dynamic model discovery via ListFoundationModels + ListInferenceProfiles - Streaming with delta callbacks, error classification, guardrails - hermes doctor + hermes auth integration - /usage pricing for 7 Bedrock models - 130 automated tests (79 unit + 28 integration + follow-up fixes) - Documentation (website/docs/guides/aws-bedrock.md) - boto3 optional dependency (pip install hermes-agent[bedrock]) Co-authored-by: JiaDe WU <40445668+JiaDe-Wu@users.noreply.github.com>
|
@teknium1 Thank you for cherry-picking this and preserving the authorship — really appreciate it. This was a fun one to build. Hermes is the first open-source agent I have seen that genuinely learns and improves across sessions, and getting it to work natively on AWS infrastructure felt like the right thing to do for the community. The Converse API adapter, the model discovery, the streaming callbacks — every piece was built because real AWS users need it. Already submitted a small follow-up PR (#11093) fixing a few docs issues from the cherry-pick. Happy to keep contributing — there is more to do on the Bedrock side (dual-path AnthropicBedrock for Claude-specific features, cross-region failover, etc.). Thanks to @ptlally, @renlon, @kabo, @hheydaroff, and everyone who tested and gave feedback. Open source at its best. |
|
Indeed, @JiaDe-Wu , this was great work by you and all others involved, I'm stoked to see it moving across the finish line. I also submitted a small follow-up PR (#10772) that fixed a minor issue where anthropic models on bedrock were having their IDs modified by normalization (dots to dashes) when they should have been passed through unchanged. Another small one that hopefully can be merged as-is. Separately, I'm looking into an issue where using inference profiles appear to have input/output modalities defaulted to text only. Working on a fix where we try to detect it from the foundation model information that's already retrieved in discovery, but still a work in progress. |
|
Ah I actually might be mistaken @JiaDe-Wu , maybe you could confirm. Are the input/output modalities in |
… profiles\n\nInference profiles (us.*, global.*) were hardcoded to TEXT-only input/output\nmodalities. Claude profiles support IMAGE input but this was not reflected\nin discovery results, potentially causing vision features to be excluded.\n\nNow inherits modalities from the underlying foundation model via ARN\nlookup, matching OpenClaw resolveInferenceProfiles() pattern.\n\nRef: PR NousResearch#7920 feedback from @ptlally\n132 tests passing.
|
@ptlally Good catch, and you're right to question it. The modalities from I just opened #11132 to fix this — it builds a foundation model lookup map and inherits modalities via ARN resolution when processing inference profiles. Small change, 2 new tests. Also saw your #10772 for the ID normalization fix — nice find, that's a subtle one. |
list_authenticated_providers() only checked API keys and auth stores, missing Bedrock's aws_sdk auth type entirely. The /model command (no args) would show 'No authenticated providers found' even with valid IAM credentials (instance role, SSO, env vars). Add has_aws_credentials() check in the CANONICAL_PROVIDERS loop so Bedrock appears in the provider picker when AWS credentials are available. 2 new tests for detection/non-detection. Ref: PR NousResearch#7920 colleague feedback
Bedrock's aws_sdk auth type was not handled by resolve_provider_client(), causing 'No auxiliary LLM provider configured' warning on startup. Context compression would fall back to dropping middle turns without summaries. Changes: - auxiliary_client.py: Add aws_sdk auth branch using AnthropicBedrock SDK - auxiliary_client.py: Add preserve_dots param to _AnthropicCompletionsAdapter and AnthropicAuxiliaryClient (Bedrock model IDs use dots as separators) - auxiliary_client.py: Register bedrock default aux model (Claude Haiku 4.5) - 3 new tests for resolution, preserve_dots, and graceful failure Ref: PR NousResearch#7920 colleague feedback
…edrock model names The bedrock provider was added in NousResearch#7920 but two edge cases were missed: 1. auxiliary_client.py resolve_provider_client() had no bedrock branch, so configuring auxiliary LLM with provider: bedrock produced a warning and no LLM-based compression/summarization. 2. _anthropic_preserve_dots() whitelist did not include 'bedrock'. Bedrock model IDs contain dots (e.g. us.anthropic.claude-opus-4-6-v1) which normalize_model_name() was converting to hyphens, producing invalid model identifiers and HTTP 400 errors. Fixes both by adding a bedrock branch to resolve_provider_client() that reuses build_anthropic_bedrock_client() with IAM auth, and adding 'bedrock' to the preserve_dots provider set.
Salvaged from PR NousResearch#7920 by JiaDe-Wu — cherry-picked Bedrock-specific additions onto current main, skipping stale-branch reverts (293 commits behind). Dual-path architecture: - Claude models → AnthropicBedrock SDK (prompt caching, thinking budgets) - Non-Claude models → Converse API via boto3 (Nova, DeepSeek, Llama, Mistral) Includes: - Core adapter (agent/bedrock_adapter.py, 1098 lines) - Full provider registration (auth, models, providers, config, runtime, main) - IAM credential chain + Bedrock API Key auth modes - Dynamic model discovery via ListFoundationModels + ListInferenceProfiles - Streaming with delta callbacks, error classification, guardrails - hermes doctor + hermes auth integration - /usage pricing for 7 Bedrock models - 130 automated tests (79 unit + 28 integration + follow-up fixes) - Documentation (website/docs/guides/aws-bedrock.md) - boto3 optional dependency (pip install hermes-agent[bedrock]) Co-authored-by: JiaDe WU <40445668+JiaDe-Wu@users.noreply.github.com>
Salvaged from PR NousResearch#7920 by JiaDe-Wu — cherry-picked Bedrock-specific additions onto current main, skipping stale-branch reverts (293 commits behind). Dual-path architecture: - Claude models → AnthropicBedrock SDK (prompt caching, thinking budgets) - Non-Claude models → Converse API via boto3 (Nova, DeepSeek, Llama, Mistral) Includes: - Core adapter (agent/bedrock_adapter.py, 1098 lines) - Full provider registration (auth, models, providers, config, runtime, main) - IAM credential chain + Bedrock API Key auth modes - Dynamic model discovery via ListFoundationModels + ListInferenceProfiles - Streaming with delta callbacks, error classification, guardrails - hermes doctor + hermes auth integration - /usage pricing for 7 Bedrock models - 130 automated tests (79 unit + 28 integration + follow-up fixes) - Documentation (website/docs/guides/aws-bedrock.md) - boto3 optional dependency (pip install hermes-agent[bedrock]) Co-authored-by: JiaDe WU <40445668+JiaDe-Wu@users.noreply.github.com>
Salvaged from PR NousResearch#7920 by JiaDe-Wu — cherry-picked Bedrock-specific additions onto current main, skipping stale-branch reverts (293 commits behind). Dual-path architecture: - Claude models → AnthropicBedrock SDK (prompt caching, thinking budgets) - Non-Claude models → Converse API via boto3 (Nova, DeepSeek, Llama, Mistral) Includes: - Core adapter (agent/bedrock_adapter.py, 1098 lines) - Full provider registration (auth, models, providers, config, runtime, main) - IAM credential chain + Bedrock API Key auth modes - Dynamic model discovery via ListFoundationModels + ListInferenceProfiles - Streaming with delta callbacks, error classification, guardrails - hermes doctor + hermes auth integration - /usage pricing for 7 Bedrock models - 130 automated tests (79 unit + 28 integration + follow-up fixes) - Documentation (website/docs/guides/aws-bedrock.md) - boto3 optional dependency (pip install hermes-agent[bedrock]) Co-authored-by: JiaDe WU <40445668+JiaDe-Wu@users.noreply.github.com>
|
The inference-profile modality fix is now in a fresh PR rebased on main: #34359 |
Salvaged from PR NousResearch#7920 by JiaDe-Wu — cherry-picked Bedrock-specific additions onto current main, skipping stale-branch reverts (293 commits behind). Dual-path architecture: - Claude models → AnthropicBedrock SDK (prompt caching, thinking budgets) - Non-Claude models → Converse API via boto3 (Nova, DeepSeek, Llama, Mistral) Includes: - Core adapter (agent/bedrock_adapter.py, 1098 lines) - Full provider registration (auth, models, providers, config, runtime, main) - IAM credential chain + Bedrock API Key auth modes - Dynamic model discovery via ListFoundationModels + ListInferenceProfiles - Streaming with delta callbacks, error classification, guardrails - hermes doctor + hermes auth integration - /usage pricing for 7 Bedrock models - 130 automated tests (79 unit + 28 integration + follow-up fixes) - Documentation (website/docs/guides/aws-bedrock.md) - boto3 optional dependency (pip install hermes-agent[bedrock]) Co-authored-by: JiaDe WU <40445668+JiaDe-Wu@users.noreply.github.com>
Salvaged from PR NousResearch#7920 by JiaDe-Wu — cherry-picked Bedrock-specific additions onto current main, skipping stale-branch reverts (293 commits behind). Dual-path architecture: - Claude models → AnthropicBedrock SDK (prompt caching, thinking budgets) - Non-Claude models → Converse API via boto3 (Nova, DeepSeek, Llama, Mistral) Includes: - Core adapter (agent/bedrock_adapter.py, 1098 lines) - Full provider registration (auth, models, providers, config, runtime, main) - IAM credential chain + Bedrock API Key auth modes - Dynamic model discovery via ListFoundationModels + ListInferenceProfiles - Streaming with delta callbacks, error classification, guardrails - hermes doctor + hermes auth integration - /usage pricing for 7 Bedrock models - 130 automated tests (79 unit + 28 integration + follow-up fixes) - Documentation (website/docs/guides/aws-bedrock.md) - boto3 optional dependency (pip install hermes-agent[bedrock]) Co-authored-by: JiaDe WU <40445668+JiaDe-Wu@users.noreply.github.com>
feat: native AWS Bedrock provider via Converse API
Summary
Adds Amazon Bedrock as a first-class provider using the native Converse API (not the OpenAI-compatible endpoint). This gives Hermes users direct access to the full Bedrock ecosystem: IAM authentication, Guardrails, cross-region inference profiles, dynamic model discovery, and all foundation models — with zero API key management on AWS compute.
Reference implementation: OpenClaw's
extensions/amazon-bedrock/plugin, which implements the same Converse API integration in TypeScript via@aws-sdk/client-bedrock.Motivation
Bedrock is the primary inference platform for AWS-native teams. The existing workaround (OpenAI-compatible endpoint via
bedrock-mantle) requires managing Bedrock API keys and misses ecosystem features like Guardrails, inference profiles, and IAM role authentication. A native integration removes these friction points and serves the large AWS user base properly.This PR was developed with reference to OpenClaw PR #62673, which addressed the same class of cloud credential passthrough issues for Bedrock on EC2/ECS/Lambda.
What's included
Core adapter (
agent/bedrock_adapter.py— 1,020 lines)build_converse_kwargs(),call_converse(),call_converse_stream()with full message/tool format conversion between OpenAI and Converse formatsstream_converse_with_callbacks()withon_text_delta,on_tool_start,on_reasoning_delta, andon_interrupt_checkcallbacks, matching the Anthropic/chat_completions streaming UXdiscover_bedrock_models()viaListFoundationModels+ListInferenceProfileswith 1-hour cache, provider filtering, and deduplicationclassify_bedrock_error()for context overflow, throttling, and overload patternsBEDROCK_CONTEXT_LENGTHSwith substring matching for versioned model IDs and inference profilesguardrail_configparameter threaded through the entire call chainProvider registration (6 files)
hermes_cli/auth.py—ProviderConfigwithauth_type="aws_sdk", aliases (aws,aws-bedrock,amazon-bedrock,amazon), auto-detection viahas_aws_credentials()in theresolve_provider("auto")pathhermes_cli/models.py—_PROVIDER_MODELS["bedrock"]static fallback list,_PROVIDER_LABELS,_PROVIDER_ALIASES, Bedrock-aware model validation invalidate_requested_model()hermes_cli/providers.py—ALIASES,TRANSPORT_TO_API_MODE["bedrock_converse"],_LABEL_OVERRIDES, URL heuristic indetermine_api_mode()hermes_cli/runtime_provider.py— Bedrock runtime resolution with region fromconfig.yaml, guardrail config passthrough, explicit-vs-auto credential check distinctionhermes_cli/config.py—DEFAULT_CONFIG["bedrock"]section (region, discovery, guardrail),OPTIONAL_ENV_VARSforAWS_REGION/AWS_PROFILE, bedrock in fallback_model provider commentshermes_cli/main.py—_model_flow_bedrock()with smart model filtering (excludes embedding/image/voice models), deduplication (prefers inference profiles over bare foundation IDs), recommended model sorting, region persistence toconfig.yamlAgent integration (
run_agent.py)api_modewhitelist updated to include"bedrock_converse"provider="bedrock"orbedrock-runtimein base URL_build_api_kwargs()— Bedrock branch builds Converse-format kwargs directly_interruptible_api_call()— Bedrock branch callsclient.converse()via boto3_interruptible_streaming_api_call()— Full streaming withconverse_stream()+ delta callbacks in a background thread with interrupt supportrun_conversation()— Length truncation handling extended tobedrock_converseapi_modeconfig.yamlat init timeEcosystem integration (5 files)
agent/error_classifier.py— Bedrock-specific patterns forThrottlingException,ServiceQuotaExceededException,ModelNotReadyException,ModelTimeoutException, context overflowValidationExceptionagent/model_metadata.py— Bedrock context length resolution step (after Anthropic, before models.dev)agent/usage_pricing.py— Bedrock model pricing (Claude Opus/Sonnet/Haiku, Nova Pro/Lite/Micro) with substring matching for inference profile IDshermes_cli/doctor.py— Bedrock diagnostics: AWS credential detection, boto3 installation check,ListFoundationModelsAPI health check with model counthermes_cli/auth_commands.py—hermes authdisplays AWS credential source, region, and IAM identity viasts:GetCallerIdentityDocumentation
website/docs/guides/aws-bedrock.md— Full guide: prerequisites, quick start, config.yaml reference, Guardrails, model discovery, available models,/modelswitching, diagnostics, gateway, troubleshootingwebsite/docs/getting-started/quickstart.md— Bedrock added to provider tableBEDROCK_TESTING_GUIDE.md— Manual testing guide for reviewersPackaging
pyproject.toml—bedrock = ["boto3>=1.35.0,<2"]optional dependency, added to[all]extraTesting
Automated tests — 107 tests, all passing
tests/agent/test_bedrock_adapter.py(79 tests):TestResolveAwsAuthEnvVar(8) — credential detection priority, IMDS fallback, whitespace handlingTestHasAwsCredentials(2) — positive/negative detectionTestResolveBedrocRegion(3) — region resolution priorityTestConvertToolsToConverse(4) — OpenAI → Converse tool formatTestConvertMessagesToConverse(10) — system prompt extraction, tool calls, tool results, role alternation merging, image content, empty content placeholdersTestNormalizeConverseResponse(6) — text, tool_use, multiple tools, stop reason mapping, empty content, tool_calls finish_reason overrideTestNormalizeConverseStreamEvents(4) — text stream, tool stream, mixed, emptyTestStreamConverseWithCallbacks(5) — text delta callbacks, tool_use suppression, tool_start callback, interrupt, reasoning deltaTestBuildConverseKwargs(6) — basic, tools, temperature/top_p, guardrail, no-system, no-toolsTestDiscoverBedrockModels(8) — foundation models, inactive filter, non-streaming filter, provider filter, caching, inference profiles, global sort, API error handlingTestGuardrailConfig(3) — included, none, empty dictTestBedrockErrorClassification(8) — context overflow (3 patterns), rate limit (2), overloaded (2), unknownTestBedrockContextLength(7) — Claude, Nova, unknown default, inference profile, longest prefixTestExtractProviderFromArn(3) +TestClientCache(1)tests/agent/test_bedrock_integration.py(28 tests):TestProviderRegistry(4) — registration, auth_type, env vars, base_url_env_varTestProviderAliases(4) — aws, aws-bedrock, amazon-bedrock, amazonTestProviderLabels(1) +TestModelCatalog(3)TestResolveProvider(4) — explicit, aliases, auto-detect with AWS credentialsTestRuntimeProvider(4) — resolution, default region, no-credentials-on-auto-detect raises, explicit-skips-checkTestProvidersModule(4) — aliases, transport mapping, URL heuristic, label overrideTestErrorClassifierBedrock(2) — throttling, context overflow patternsTestPackaging(2) — bedrock extra exists, in [all] extraEC2 integration testing
All tests run on EC2 t3.medium (Amazon Linux 2023, Python 3.11.14, boto3 1.42.88) with IAM role
hermes-bedrock-manual-test(AmazonBedrockFullAccess) in us-east-2.Multi-model end-to-end via
AIAgent.chat():us.anthropic.claude-sonnet-4-6us.amazon.nova-pro-v1:0deepseek.v3.2us.meta.llama4-scout-17b-instruct-v1:0Streaming verification:
Tool calling verification:
get_weather({"city": "Tokyo"})— tool_call ID, name, arguments all correct,finish_reason=tool_callsGuardrails verification:
zi4q4hqa4n4k(SEXUAL+HATE content filter) — requests withguardrailConfigsucceed, guardrail parameters correctly injected into Converse API callsCLI verification:
hermes model→ Bedrock selection → region picker → smart model list (filtered, deduplicated, recommended first)hermes chat→ interactive conversation with streaming output/model us.amazon.nova-pro-v1:0→ mid-session model switch, validated via Bedrock discovery/usage→ token count and cost displayhermes doctor→✓ AWS Bedrock (iam-role, us-east-2, 89 models)hermes auth→ displays IAM role ARN, region, identityGateway verification:
config.yamlconfigurationIMDS credential detection:
botocore.session.get_session().get_credentials()fallback — no environment variables needed. This addresses the same class of issue as OpenClaw PR #62673.Files changed
New files (3)
agent/bedrock_adapter.pytests/agent/test_bedrock_adapter.pytests/agent/test_bedrock_integration.pyModified files (13)
run_agent.pyhermes_cli/auth.pyhermes_cli/models.pyhermes_cli/providers.pyhermes_cli/config.pyhermes_cli/main.pyhermes_cli/runtime_provider.pyhermes_cli/doctor.pyhermes_cli/auth_commands.pyagent/error_classifier.pyagent/model_metadata.pyagent/usage_pricing.pypyproject.toml[bedrock]optional dependencyDocumentation (2)
website/docs/guides/aws-bedrock.mdwebsite/docs/getting-started/quickstart.md