feat(claude-code): first-class anthropic_base_url, use_bedrock, use_vertex inputs

Rebased onto post-#861 main.

- New use_bedrock and use_vertex bool inputs that set
  CLAUDE_CODE_USE_BEDROCK=1 / CLAUDE_CODE_USE_VERTEX=1 via coder_env.
  Mutually exclusive with each other and with enable_ai_gateway.
- New anthropic_base_url string input. The existing
  coder_env.anthropic_base_url resource (previously AI Gateway only)
  is widened to also fire when this is set; AI Gateway keeps
  precedence for the value. Mutually exclusive with enable_ai_gateway.
- configure_standalone_mode now recognizes use_bedrock / use_vertex /
  anthropic_base_url as valid auth paths: prints a clear backend
  message and proceeds to write the onboarding-bypass keys instead of
  printing the misleading 'No authentication configured' note and
  returning early.
- README: Bedrock and Vertex sections rewritten around the new inputs,
  leading with attached IAM role / Workload Identity over static
  credentials. New custom-API-gateway section. Prerequisites and
  mutual-exclusion caution updated.
- Tests: 7 new terraform-test runs (env assertions + 4 expect_failures
  for mutual exclusion); 3 new bun tests.

Closes coder/coder#17402
Closes coder/coder#21835

Author: morganl-ant

registry/coder/modules/claude-code/README.md

@@ -13,7 +13,7 @@ Install and configure the [Claude Code](https://docs.anthropic.com/en/docs/agent
 ```tf
 module "claude-code" {
   source            = "registry.coder.com/coder/claude-code/coder"
-  version           = "5.2.0"
+  version           = "5.3.0"
   agent_id          = coder_agent.main.id
   anthropic_api_key = "xxxx-xxxxx-xxxx"
 }
@@ -29,6 +29,9 @@ Provide exactly one authentication method:
 - **Anthropic API key**: get one from the [Anthropic Console](https://console.anthropic.com/dashboard) and pass it as `anthropic_api_key`.
 - **Claude.ai OAuth token** (Pro, Max, or Enterprise accounts): generate one by running `claude setup-token` locally and pass it as `claude_code_oauth_token`.
 - **Coder AI Gateway** (Coder Premium, Coder >= 2.30.0): set `enable_ai_gateway = true`. The module authenticates against the gateway using the workspace owner's session token. Do not combine with `anthropic_api_key` or `claude_code_oauth_token`.
+- **Amazon Bedrock**: set `use_bedrock = true`. Authentication uses the workspace's AWS credential chain. See [Usage with AWS Bedrock](#usage-with-aws-bedrock).
+- **Google Vertex AI**: set `use_vertex = true`. Authentication uses Google Application Default Credentials inside the workspace. See [Usage with Google Vertex AI](#usage-with-google-vertex-ai).
+- **Custom API gateway**: set `anthropic_base_url` to a self-hosted gateway that speaks the Anthropic Messages API. See [Usage with a custom API gateway](#usage-with-a-custom-api-gateway).
 
 ## workdir
 
@@ -47,7 +50,7 @@ locals {
 
 module "claude-code" {
   source            = "registry.coder.com/coder/claude-code/coder"
-  version           = "5.2.0"
+  version           = "5.3.0"
   agent_id          = coder_agent.main.id
   workdir           = local.claude_workdir
   anthropic_api_key = "xxxx-xxxxx-xxxx"
@@ -78,7 +81,7 @@ resource "coder_app" "claude" {
 ```tf
 module "claude-code" {
   source            = "registry.coder.com/coder/claude-code/coder"
-  version           = "5.2.0"
+  version           = "5.3.0"
   agent_id          = coder_agent.main.id
   workdir           = "/home/coder/project"
   enable_ai_gateway = true
@@ -102,7 +105,7 @@ The `managed_settings` input writes a policy file to `/etc/claude-code/managed-s
 ```tf
 module "claude-code" {
   source            = "registry.coder.com/coder/claude-code/coder"
-  version           = "5.2.0"
+  version           = "5.3.0"
   agent_id          = coder_agent.main.id
   workdir           = "/home/coder/project"
   anthropic_api_key = "xxxx-xxxxx-xxxx"
@@ -129,7 +132,7 @@ This example shows version pinning, a pre-installed binary path, a custom model,
 ```tf
 module "claude-code" {
   source   = "registry.coder.com/coder/claude-code/coder"
-  version  = "5.2.0"
+  version  = "5.3.0"
   agent_id = coder_agent.main.id
   workdir  = "/home/coder/project"
 
@@ -193,7 +196,7 @@ Downstream `coder_script` resources can wait for this module's install pipeline
 ```tf
 module "claude-code" {
   source            = "registry.coder.com/coder/claude-code/coder"
-  version           = "5.2.0"
+  version           = "5.3.0"
   agent_id          = coder_agent.main.id
   workdir           = "/home/coder/project"
   anthropic_api_key = "xxxx-xxxxx-xxxx"
@@ -218,39 +221,31 @@ resource "coder_script" "post_claude" {
 
 ### Usage with AWS Bedrock
 
-#### Prerequisites
-
-AWS account with Bedrock access, Claude models enabled in Bedrock console, and appropriate IAM permissions.
-
-Configure Claude Code to use AWS Bedrock for accessing Claude models through your AWS infrastructure.
+Set `use_bedrock = true` to route Claude Code through Amazon Bedrock. The module sets `CLAUDE_CODE_USE_BEDROCK=1` and skips Anthropic API key setup; authentication is handled by the AWS SDK [credential chain](https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html) inside the workspace.
 
 ```tf
-resource "coder_env" "bedrock_use" {
-  agent_id = coder_agent.main.id
-  name     = "CLAUDE_CODE_USE_BEDROCK"
-  value    = "1"
+module "claude-code" {
+  source      = "registry.coder.com/coder/claude-code/coder"
+  version     = "5.3.0"
+  agent_id    = coder_agent.main.id
+  workdir     = "/home/coder/project"
+  use_bedrock = true
+  model       = "global.anthropic.claude-sonnet-4-5-20250929-v1:0"
 }
 
 resource "coder_env" "aws_region" {
   agent_id = coder_agent.main.id
   name     = "AWS_REGION"
-  value    = "us-east-1" # Choose your preferred region
+  value    = "us-east-1"
 }
+```
 
-# Option 1: Using AWS credentials
-
-variable "aws_access_key_id" {
-  type        = string
-  description = "Your AWS access key ID. Create this in the AWS IAM console under 'Security credentials'."
-  sensitive   = true
-}
+> [!TIP]
+> Prefer attaching an IAM role to the workspace (EKS [IRSA](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html), EC2 instance profile, or ECS task role) over passing static `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` through Terraform variables. Claude Code picks up the role via the standard AWS credential chain with no additional configuration.
 
-variable "aws_secret_access_key" {
-  type        = string
-  description = "Your AWS secret access key. This is shown once when you create an access key in the AWS IAM console."
-  sensitive   = true
-}
+If you cannot use an attached role, set static credentials via `coder_env` resources:
 
+```tf
 resource "coder_env" "aws_access_key_id" {
   agent_id = coder_agent.main.id
   name     = "AWS_ACCESS_KEY_ID"
@@ -262,52 +257,33 @@ resource "coder_env" "aws_secret_access_key" {
   name     = "AWS_SECRET_ACCESS_KEY"
   value    = var.aws_secret_access_key
 }
+```
 
-# Option 2: Using Bedrock API key (simpler)
-
-variable "aws_bearer_token_bedrock" {
-  type        = string
-  description = "Your AWS Bedrock bearer token. This provides access to Bedrock without needing separate access key and secret key."
-  sensitive   = true
-}
+Or use a [Bedrock API key](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html) instead of access-key/secret-key:
 
+```tf
 resource "coder_env" "bedrock_api_key" {
   agent_id = coder_agent.main.id
   name     = "AWS_BEARER_TOKEN_BEDROCK"
   value    = var.aws_bearer_token_bedrock
 }
-
-module "claude-code" {
-  source   = "registry.coder.com/coder/claude-code/coder"
-  version  = "5.2.0"
-  agent_id = coder_agent.main.id
-  workdir  = "/home/coder/project"
-  model    = "global.anthropic.claude-sonnet-4-5-20250929-v1:0"
-}
 ```
 
 > [!NOTE]
-> For additional Bedrock configuration options (model selection, token limits, region overrides, etc.), see the [Claude Code Bedrock documentation](https://docs.claude.com/en/docs/claude-code/amazon-bedrock).
+> Prerequisites: AWS account with Bedrock access, Claude models enabled in the Bedrock console, and IAM permission `bedrock:InvokeModelWithResponseStream`. For additional configuration (token limits, region overrides), see the [Claude Code Bedrock documentation](https://docs.claude.com/en/docs/claude-code/amazon-bedrock).
 
 ### Usage with Google Vertex AI
 
-#### Prerequisites
-
-GCP project with Vertex AI API enabled, Claude models enabled through Model Garden, service account with Vertex AI permissions, and appropriate IAM permissions (Vertex AI User role).
-
-Configure Claude Code to use Google Vertex AI for accessing Claude models through Google Cloud Platform.
+Set `use_vertex = true` to route Claude Code through Google Vertex AI. The module sets `CLAUDE_CODE_USE_VERTEX=1` and skips Anthropic API key setup; authentication uses [Google Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials) inside the workspace.
 
 ```tf
-variable "vertex_sa_json" {
-  type        = string
-  description = "The complete JSON content of your Google Cloud service account key file. Create a service account in the GCP Console under 'IAM & Admin > Service Accounts', then create and download a JSON key. Copy the entire JSON content into this variable."
-  sensitive   = true
-}
-
-resource "coder_env" "vertex_use" {
-  agent_id = coder_agent.main.id
-  name     = "CLAUDE_CODE_USE_VERTEX"
-  value    = "1"
+module "claude-code" {
+  source     = "registry.coder.com/coder/claude-code/coder"
+  version    = "5.3.0"
+  agent_id   = coder_agent.main.id
+  workdir    = "/home/coder/project"
+  use_vertex = true
+  model      = "claude-sonnet-4@20250514"
 }
 
 resource "coder_env" "vertex_project_id" {
@@ -321,52 +297,30 @@ resource "coder_env" "cloud_ml_region" {
   name     = "CLOUD_ML_REGION"
   value    = "global"
 }
+```
 
-resource "coder_env" "vertex_sa_json" {
-  agent_id = coder_agent.main.id
-  name     = "VERTEX_SA_JSON"
-  value    = var.vertex_sa_json
-}
-
-resource "coder_env" "google_application_credentials" {
-  agent_id = coder_agent.main.id
-  name     = "GOOGLE_APPLICATION_CREDENTIALS"
-  value    = "/tmp/gcp-sa.json"
-}
-
-module "claude-code" {
-  source   = "registry.coder.com/coder/claude-code/coder"
-  version  = "5.2.0"
-  agent_id = coder_agent.main.id
-  workdir  = "/home/coder/project"
-  model    = "claude-sonnet-4@20250514"
-
-  pre_install_script = <<-EOT
-    #!/bin/bash
-    # Write the service account JSON to a file
-    echo "$VERTEX_SA_JSON" > /tmp/gcp-sa.json
-
-    # Install prerequisite packages
-    sudo apt-get update
-    sudo apt-get install -y apt-transport-https ca-certificates gnupg curl
+> [!TIP]
+> Prefer GKE [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) or an attached service account over shipping a service-account JSON key through Terraform. Claude Code picks up Application Default Credentials automatically. If you must use a key file, mount it and set `GOOGLE_APPLICATION_CREDENTIALS` via a `coder_env` resource.
 
-    # Add Google Cloud public key
-    curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
+> [!NOTE]
+> Prerequisites: GCP project with Vertex AI API enabled, Claude models enabled through Model Garden, and the `Vertex AI User` role on the workspace identity. For additional configuration, see the [Claude Code Vertex AI documentation](https://docs.claude.com/en/docs/claude-code/google-vertex-ai).
 
-    # Add Google Cloud SDK repo to apt sources
-    echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee /etc/apt/sources.list.d/google-cloud-sdk.list
+### Usage with a custom API gateway
 
-    # Update and install the Google Cloud SDK
-    sudo apt-get update && sudo apt-get install -y google-cloud-cli
+Set `anthropic_base_url` to point Claude Code at a self-hosted gateway or proxy that speaks the Anthropic Messages API. The module sets `ANTHROPIC_BASE_URL` and skips its built-in Anthropic authentication setup; provide whatever credentials your gateway requires via separate `coder_env` resources.
 
-    # Authenticate gcloud with the service account
-    gcloud auth activate-service-account --key-file=/tmp/gcp-sa.json
-  EOT
+```tf
+module "claude-code" {
+  source             = "registry.coder.com/coder/claude-code/coder"
+  version            = "5.3.0"
+  agent_id           = coder_agent.main.id
+  workdir            = "/home/coder/project"
+  anthropic_base_url = "https://llm-gateway.example.com/anthropic"
 }
 ```
 
-> [!NOTE]
-> For additional Vertex AI configuration options (model selection, token limits, region overrides, etc.), see the [Claude Code Vertex AI documentation](https://docs.claude.com/en/docs/claude-code/google-vertex-ai).
+> [!CAUTION]
+> `anthropic_base_url` is mutually exclusive with `enable_ai_gateway`, which sets `ANTHROPIC_BASE_URL` to the Coder AI Gateway endpoint. `use_bedrock` and `use_vertex` are likewise mutually exclusive with `enable_ai_gateway` and with each other.
 
 ### Telemetry export (OpenTelemetry)
 
@@ -377,7 +331,7 @@ The module automatically tags every span and metric with `coder.workspace_id`, `
 ```tf
 module "claude-code" {
   source            = "registry.coder.com/coder/claude-code/coder"
-  version           = "5.2.0"
+  version           = "5.3.0"
   agent_id          = coder_agent.main.id
   workdir           = "/home/coder/project"
   anthropic_api_key = "xxxx-xxxxx-xxxx"

registry/coder/modules/claude-code/main.test.ts

@@ -518,4 +518,70 @@ describe("claude-code", async () => {
     expect(coderEnvVars["OTEL_EXPORTER_OTLP_HEADERS"]).toBeUndefined();
     expect(coderEnvVars["OTEL_RESOURCE_ATTRIBUTES"]).toBeUndefined();
   });
+
+  test("use-bedrock-no-api-key", async () => {
+    const { id, coderEnvVars, scripts } = await setup({
+      moduleVariables: {
+        use_bedrock: "true",
+      },
+    });
+    expect(coderEnvVars["CLAUDE_CODE_USE_BEDROCK"]).toBe("1");
+    expect(coderEnvVars["ANTHROPIC_API_KEY"]).toBeUndefined();
+
+    await runScripts(id, scripts, coderEnvVars);
+    const installLog = await readFileContainer(
+      id,
+      "/home/coder/.coder-modules/coder/claude-code/logs/install.log",
+    );
+    expect(installLog).toContain(
+      "Using Amazon Bedrock (CLAUDE_CODE_USE_BEDROCK=1)",
+    );
+    expect(installLog).not.toContain("No authentication configured");
+    expect(installLog).toContain("Standalone mode configured successfully");
+
+    // Onboarding bypass should still be written so the CLI starts headlessly.
+    const claudeConfig = await readFileContainer(
+      id,
+      "/home/coder/.claude.json",
+    );
+    expect(JSON.parse(claudeConfig).hasCompletedOnboarding).toBe(true);
+  });
+
+  test("use-vertex-no-api-key", async () => {
+    const { id, coderEnvVars, scripts } = await setup({
+      moduleVariables: {
+        use_vertex: "true",
+      },
+    });
+    expect(coderEnvVars["CLAUDE_CODE_USE_VERTEX"]).toBe("1");
+
+    await runScripts(id, scripts, coderEnvVars);
+    const installLog = await readFileContainer(
+      id,
+      "/home/coder/.coder-modules/coder/claude-code/logs/install.log",
+    );
+    expect(installLog).toContain(
+      "Using Google Vertex AI (CLAUDE_CODE_USE_VERTEX=1)",
+    );
+    expect(installLog).not.toContain("No authentication configured");
+  });
+
+  test("anthropic-base-url-custom", async () => {
+    const baseUrl = "https://llm-gateway.example.com/anthropic";
+    const { id, coderEnvVars, scripts } = await setup({
+      moduleVariables: {
+        anthropic_base_url: baseUrl,
+      },
+    });
+    expect(coderEnvVars["ANTHROPIC_BASE_URL"]).toBe(baseUrl);
+
+    await runScripts(id, scripts, coderEnvVars);
+    const installLog = await readFileContainer(
+      id,
+      "/home/coder/.coder-modules/coder/claude-code/logs/install.log",
+    );
+    expect(installLog).toContain("Using custom ANTHROPIC_BASE_URL");
+    expect(installLog).toContain(baseUrl);
+    expect(installLog).not.toContain("No authentication configured");
+  });
 });