bedrock-env 0.1.0__tar.gz

bedrock_env-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Spring_MT
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

bedrock_env-0.1.0/PKG-INFO

@@ -0,0 +1,116 @@
+Metadata-Version: 2.4
+Name: bedrock-env
+Version: 0.1.0
+Summary: Generate Amazon Bedrock short-term API keys from AWS SSO and keep running processes supplied with fresh ones
+Keywords: aws,bedrock,sso,api-key,cli
+Author: Spring_MT
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Environment :: Console
+Classifier: Operating System :: POSIX
+Classifier: Operating System :: MacOS
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Utilities
+Requires-Dist: aws-bedrock-token-generator>=1.1.0
+Requires-Dist: botocore>=1.43.116
+Requires-Python: >=3.10
+Project-URL: Homepage, https://github.com/SpringMT/bedrock-short-time-key
+Project-URL: Repository, https://github.com/SpringMT/bedrock-short-time-key
+Project-URL: Issues, https://github.com/SpringMT/bedrock-short-time-key/issues
+Description-Content-Type: text/markdown
+
+# bedrock-env
+
+Generate [Amazon Bedrock short-term API keys](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html) from your AWS SSO profile, and keep long-running processes (dev servers, agents, ...) supplied with a fresh key.
+
+[日本語](https://github.com/SpringMT/bedrock-short-time-key/blob/main/README.ja.md)
+
+```sh
+# One-off: set AWS_BEARER_TOKEN_BEDROCK in the current shell
+eval "$(bedrock-env export --profile my-sso-profile)"
+
+# Long-running: run a command, and restart it with a new key before the old one expires
+bedrock-env run --profile my-sso-profile -- uv run uvicorn app:app --reload
+```
+
+## Why
+
+A short-term Bedrock API key is a SigV4 presigned URL signed with your current AWS credentials. It is generated locally (no API call), and it stops working at whichever comes first:
+
+- the requested lifetime (max 12 hours), or
+- the expiry of the credentials that signed it.
+
+With an SSO profile the second limit usually wins: role credentials last as long as the permission set's session duration (often 1 hour). Exporting a key by hand means your dev server starts failing with 403 an hour later.
+
+A running process's environment cannot be changed from outside, so `bedrock-env run` does the next best thing: it supervises the command and restarts it with a new key shortly before the current one expires.
+
+## Install
+
+```sh
+uv tool install bedrock-env
+# or: pipx install bedrock-env
+```
+
+Requires Python 3.10+, macOS or Linux.
+
+## Usage
+
+### `bedrock-env export`
+
+Prints the key so you can load it into your shell.
+
+```sh
+eval "$(bedrock-env export --profile my-sso-profile)"          # bash / zsh
+bedrock-env export --profile my-sso-profile --format fish | source
+bedrock-env export --format dotenv > .env.bedrock
+bedrock-env export --format json                              # {"token", "region", "expires_at"}
+```
+
+The expiry is printed to stderr.
+
+### `bedrock-env run -- COMMAND...`
+
+Runs `COMMAND` with `AWS_BEARER_TOKEN_BEDROCK` (and `AWS_REGION`, if unset) in its environment. Shortly before the key expires it:
+
+1. generates a new key,
+2. sends `SIGTERM` to the command's process group (`SIGKILL` after `--stop-timeout`),
+3. starts the command again with the new key.
+
+`SIGINT` / `SIGTERM` / `SIGHUP` sent to `bedrock-env` are forwarded to the command. If the command exits on its own, `bedrock-env` exits with the same status and does not restart it.
+
+| Option | Default | |
+| --- | --- | --- |
+| `--profile` | `AWS_PROFILE` / default chain | AWS profile to sign with |
+| `--region` | `AWS_REGION` / profile `region` | Region the key is valid for |
+| `--duration` | `12` | Requested lifetime in hours (capped by the credentials' expiry) |
+| `--margin` | `300` | Refresh this many seconds before expiry |
+| `--retry-interval` | `60` | Wait between failed refresh attempts |
+| `--stop-timeout` | `10` | Seconds between `SIGTERM` and `SIGKILL` on restart |
+| `--auto-login` | off | Run `aws sso login` when the SSO session has expired |
+
+### When the SSO session expires
+
+The SSO session itself (`aws sso login`) also has a lifetime. Once it expires no new role credentials can be obtained:
+
+- `bedrock-env run` keeps the current process running (its key may still be valid for a few minutes), logs `run aws sso login`, and retries every `--retry-interval`. As soon as you log in from another terminal, the next retry picks up the new session.
+- With `--auto-login`, it runs `aws sso login --profile ...` itself, which opens a browser.
+
+## Caveats
+
+- **Restarts are not zero-downtime.** Requests in flight during a restart fail. With SSO this happens about once per permission set session duration.
+- The key is bound to a single region.
+- Only processes started by `bedrock-env run` get the new key. Shells where you ran `export` need to run it again.
+- Windows is not supported (process groups and POSIX signals are used).
+
+If your application uses an AWS SDK directly, you may not need an API key at all: the SDK can sign requests with your SSO profile (SigV4) and refreshes credentials itself. API keys are mainly useful for tools and SDKs that only accept a bearer token.
+
+## Development
+
+```sh
+uv sync
+uv run pytest
+```
+
+## License
+
+MIT

bedrock_env-0.1.0/README.md

@@ -0,0 +1,95 @@
+# bedrock-env
+
+Generate [Amazon Bedrock short-term API keys](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html) from your AWS SSO profile, and keep long-running processes (dev servers, agents, ...) supplied with a fresh key.
+
+[日本語](https://github.com/SpringMT/bedrock-short-time-key/blob/main/README.ja.md)
+
+```sh
+# One-off: set AWS_BEARER_TOKEN_BEDROCK in the current shell
+eval "$(bedrock-env export --profile my-sso-profile)"
+
+# Long-running: run a command, and restart it with a new key before the old one expires
+bedrock-env run --profile my-sso-profile -- uv run uvicorn app:app --reload
+```
+
+## Why
+
+A short-term Bedrock API key is a SigV4 presigned URL signed with your current AWS credentials. It is generated locally (no API call), and it stops working at whichever comes first:
+
+- the requested lifetime (max 12 hours), or
+- the expiry of the credentials that signed it.
+
+With an SSO profile the second limit usually wins: role credentials last as long as the permission set's session duration (often 1 hour). Exporting a key by hand means your dev server starts failing with 403 an hour later.
+
+A running process's environment cannot be changed from outside, so `bedrock-env run` does the next best thing: it supervises the command and restarts it with a new key shortly before the current one expires.
+
+## Install
+
+```sh
+uv tool install bedrock-env
+# or: pipx install bedrock-env
+```
+
+Requires Python 3.10+, macOS or Linux.
+
+## Usage
+
+### `bedrock-env export`
+
+Prints the key so you can load it into your shell.
+
+```sh
+eval "$(bedrock-env export --profile my-sso-profile)"          # bash / zsh
+bedrock-env export --profile my-sso-profile --format fish | source
+bedrock-env export --format dotenv > .env.bedrock
+bedrock-env export --format json                              # {"token", "region", "expires_at"}
+```
+
+The expiry is printed to stderr.
+
+### `bedrock-env run -- COMMAND...`
+
+Runs `COMMAND` with `AWS_BEARER_TOKEN_BEDROCK` (and `AWS_REGION`, if unset) in its environment. Shortly before the key expires it:
+
+1. generates a new key,
+2. sends `SIGTERM` to the command's process group (`SIGKILL` after `--stop-timeout`),
+3. starts the command again with the new key.
+
+`SIGINT` / `SIGTERM` / `SIGHUP` sent to `bedrock-env` are forwarded to the command. If the command exits on its own, `bedrock-env` exits with the same status and does not restart it.
+
+| Option | Default | |
+| --- | --- | --- |
+| `--profile` | `AWS_PROFILE` / default chain | AWS profile to sign with |
+| `--region` | `AWS_REGION` / profile `region` | Region the key is valid for |
+| `--duration` | `12` | Requested lifetime in hours (capped by the credentials' expiry) |
+| `--margin` | `300` | Refresh this many seconds before expiry |
+| `--retry-interval` | `60` | Wait between failed refresh attempts |
+| `--stop-timeout` | `10` | Seconds between `SIGTERM` and `SIGKILL` on restart |
+| `--auto-login` | off | Run `aws sso login` when the SSO session has expired |
+
+### When the SSO session expires
+
+The SSO session itself (`aws sso login`) also has a lifetime. Once it expires no new role credentials can be obtained:
+
+- `bedrock-env run` keeps the current process running (its key may still be valid for a few minutes), logs `run aws sso login`, and retries every `--retry-interval`. As soon as you log in from another terminal, the next retry picks up the new session.
+- With `--auto-login`, it runs `aws sso login --profile ...` itself, which opens a browser.
+
+## Caveats
+
+- **Restarts are not zero-downtime.** Requests in flight during a restart fail. With SSO this happens about once per permission set session duration.
+- The key is bound to a single region.
+- Only processes started by `bedrock-env run` get the new key. Shells where you ran `export` need to run it again.
+- Windows is not supported (process groups and POSIX signals are used).
+
+If your application uses an AWS SDK directly, you may not need an API key at all: the SDK can sign requests with your SSO profile (SigV4) and refreshes credentials itself. API keys are mainly useful for tools and SDKs that only accept a bearer token.
+
+## Development
+
+```sh
+uv sync
+uv run pytest
+```
+
+## License
+
+MIT

bedrock_env-0.1.0/pyproject.toml

@@ -0,0 +1,38 @@
+[project]
+name = "bedrock-env"
+version = "0.1.0"
+description = "Generate Amazon Bedrock short-term API keys from AWS SSO and keep running processes supplied with fresh ones"
+readme = "README.md"
+authors = [{ name = "Spring_MT" }]
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.10"
+keywords = ["aws", "bedrock", "sso", "api-key", "cli"]
+classifiers = [
+    "Environment :: Console",
+    "Operating System :: POSIX",
+    "Operating System :: MacOS",
+    "Programming Language :: Python :: 3",
+    "Topic :: Utilities",
+]
+dependencies = [
+    "aws-bedrock-token-generator>=1.1.0",
+    "botocore>=1.43.116",
+]
+
+[project.urls]
+Homepage = "https://github.com/SpringMT/bedrock-short-time-key"
+Repository = "https://github.com/SpringMT/bedrock-short-time-key"
+Issues = "https://github.com/SpringMT/bedrock-short-time-key/issues"
+
+[project.scripts]
+bedrock-env = "bedrock_env.cli:main"
+
+[build-system]
+requires = ["uv_build>=0.11.28,<0.12.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.1.1",
+]

bedrock_env-0.1.0/src/bedrock_env/__init__.py

@@ -0,0 +1,3 @@
+"""Generate Amazon Bedrock short-term API keys and keep them fresh."""
+
+__version__ = "0.1.0"

bedrock_env-0.1.0/src/bedrock_env/cli.py

@@ -0,0 +1,152 @@
+"""Command line interface for bedrock-env."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import shlex
+import subprocess
+import sys
+from datetime import timedelta
+from functools import partial
+
+from . import __version__
+from .runner import ENV_TOKEN, Runner, log
+from .token import LoginRequiredError, TokenError, generate_token
+
+
+def _add_aws_options(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument("--profile", help="AWS profile to sign with (default: AWS_PROFILE / default chain)")
+    parser.add_argument("--region", help="Region the key is valid for (default: AWS_REGION / profile)")
+    parser.add_argument(
+        "--duration",
+        type=float,
+        default=12,
+        metavar="HOURS",
+        help="Requested lifetime in hours, max 12 (capped by the credentials' own expiry)",
+    )
+
+
+def _generator(args: argparse.Namespace):
+    return partial(
+        generate_token,
+        profile=args.profile,
+        region=args.region,
+        duration=timedelta(hours=args.duration),
+    )
+
+
+def _sso_login(profile: str | None) -> None:
+    command = ["aws", "sso", "login"] + (["--profile", profile] if profile else [])
+    log(f"running `{shlex.join(command)}`")
+    subprocess.run(command, check=False)
+
+
+def cmd_export(args: argparse.Namespace) -> int:
+    token = _generator(args)()
+    expires = token.expires_at.isoformat(timespec="seconds")
+    if args.format == "json":
+        print(json.dumps({"token": token.value, "region": token.region, "expires_at": expires}))
+    elif args.format == "dotenv":
+        print(f"{ENV_TOKEN}={token.value}")
+    elif args.format == "fish":
+        print(f"set -gx {ENV_TOKEN} {shlex.quote(token.value)};")
+    else:
+        print(f"export {ENV_TOKEN}={shlex.quote(token.value)}")
+    if args.format != "json":
+        print(f"# key for {token.region}, valid until {expires}", file=sys.stderr)
+    return 0
+
+
+def cmd_run(args: argparse.Namespace) -> int:
+    command = args.command
+    if command and command[0] == "--":
+        command = command[1:]
+    if not command:
+        print("bedrock-env run: missing command (usage: bedrock-env run -- <command> ...)", file=sys.stderr)
+        return 2
+    runner = Runner(
+        command,
+        _generator(args),
+        margin=args.margin,
+        retry_interval=args.retry_interval,
+        stop_timeout=args.stop_timeout,
+        on_login_required=partial(_sso_login, args.profile) if args.auto_login else None,
+    )
+    code = runner.run()
+    # Popen reports death-by-signal as -N; shells use 128 + N.
+    return 128 - code if code < 0 else code
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="bedrock-env",
+        description="Generate Amazon Bedrock short-term API keys and keep them fresh.",
+    )
+    parser.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
+    sub = parser.add_subparsers(dest="subcommand", required=True)
+
+    export = sub.add_parser(
+        "export",
+        help="print a key as shell exports",
+        description=f'Print {ENV_TOKEN}. Use as: eval "$(bedrock-env export)"',
+    )
+    _add_aws_options(export)
+    export.add_argument("--format", choices=["sh", "fish", "dotenv", "json"], default="sh")
+    export.set_defaults(func=cmd_export)
+
+    run = sub.add_parser(
+        "run",
+        help="run a command with a key and restart it before the key expires",
+        description=f"Run COMMAND with {ENV_TOKEN} set, regenerating the key and restarting "
+        "COMMAND shortly before it expires.",
+    )
+    _add_aws_options(run)
+    run.add_argument(
+        "--margin",
+        type=float,
+        default=300,
+        metavar="SECONDS",
+        help="refresh this many seconds before expiry (default: 300)",
+    )
+    run.add_argument(
+        "--retry-interval",
+        type=float,
+        default=60,
+        metavar="SECONDS",
+        help="wait between failed refresh attempts (default: 60)",
+    )
+    run.add_argument(
+        "--stop-timeout",
+        type=float,
+        default=10,
+        metavar="SECONDS",
+        help="wait this long after SIGTERM before SIGKILL on restart (default: 10)",
+    )
+    run.add_argument(
+        "--auto-login",
+        action="store_true",
+        help="run `aws sso login` automatically when the SSO session has expired",
+    )
+    run.add_argument("command", nargs=argparse.REMAINDER, help="command to run (after --)")
+    run.set_defaults(func=cmd_run)
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        return args.func(args)
+    except LoginRequiredError as e:
+        profile = f" --profile {args.profile}" if args.profile else ""
+        print(f"bedrock-env: SSO session expired. Run `aws sso login{profile}`.\n  ({e})", file=sys.stderr)
+        return 1
+    except TokenError as e:
+        print(f"bedrock-env: {e}", file=sys.stderr)
+        return 1
+    except KeyboardInterrupt:
+        return 130
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bedrock_env-0.1.0/src/bedrock_env/runner.py

@@ -0,0 +1,152 @@
+"""Run a command with a Bedrock API key and restart it before the key expires."""
+
+from __future__ import annotations
+
+import os
+import signal
+import subprocess
+import sys
+import time
+from collections.abc import Callable, Sequence
+from datetime import datetime
+
+from .token import LoginRequiredError, Token, TokenError
+
+ENV_TOKEN = "AWS_BEARER_TOKEN_BEDROCK"
+_FORWARDED_SIGNALS = (signal.SIGINT, signal.SIGTERM, signal.SIGHUP)
+
+
+def log(message: str) -> None:
+    stamp = datetime.now().strftime("%H:%M:%S")
+    print(f"[bedrock-env {stamp}] {message}", file=sys.stderr, flush=True)
+
+
+def build_env(token: Token, base: dict[str, str] | None = None) -> dict[str, str]:
+    env = dict(os.environ if base is None else base)
+    env[ENV_TOKEN] = token.value
+    # The key is bound to the region it was signed for.
+    env.setdefault("AWS_REGION", token.region)
+    return env
+
+
+class Runner:
+    def __init__(
+        self,
+        command: Sequence[str],
+        generate: Callable[[], Token],
+        *,
+        margin: float = 300,
+        retry_interval: float = 60,
+        stop_timeout: float = 10,
+        on_login_required: Callable[[], None] | None = None,
+    ):
+        self.command = list(command)
+        self.generate = generate
+        self.margin = margin
+        self.retry_interval = retry_interval
+        self.stop_timeout = stop_timeout
+        self.on_login_required = on_login_required
+        self.child: subprocess.Popen | None = None
+        self._stopping = False
+
+    # -- child process -------------------------------------------------------
+
+    def _start(self, token: Token) -> None:
+        # Own process group so restarts reach every descendant (e.g. `uv run` -> uvicorn).
+        self.child = subprocess.Popen(self.command, env=build_env(token), start_new_session=True)
+        log(f"started pid {self.child.pid}; key valid until {_local(token.expires_at)}")
+
+    def _signal_child(self, sig: int) -> None:
+        if self.child is None or self.child.poll() is not None:
+            return
+        try:
+            os.killpg(self.child.pid, sig)
+        except ProcessLookupError:
+            pass
+
+    def _stop(self) -> int:
+        assert self.child is not None
+        self._signal_child(signal.SIGTERM)
+        try:
+            return self.child.wait(timeout=self.stop_timeout)
+        except subprocess.TimeoutExpired:
+            log(f"pid {self.child.pid} did not exit in {self.stop_timeout:g}s; sending SIGKILL")
+            self._signal_child(signal.SIGKILL)
+            return self.child.wait()
+
+    def _handle_signal(self, signum, _frame) -> None:
+        self._stopping = True
+        self._signal_child(signum)
+
+    # -- main loop -----------------------------------------------------------
+
+    def _wait_child(self, seconds: float) -> int | None:
+        """Wait up to `seconds` for the child to exit. Returns its exit code if it did."""
+        assert self.child is not None
+        deadline = time.monotonic() + max(seconds, 0)
+        while True:
+            remaining = deadline - time.monotonic()
+            try:
+                return self.child.wait(timeout=max(min(remaining, 1.0), 0))
+            except subprocess.TimeoutExpired:
+                if remaining <= 0:
+                    return None
+
+    def _try_generate(self) -> Token | None:
+        try:
+            return self.generate()
+        except LoginRequiredError:
+            log("SSO session expired; run `aws sso login` (the current process keeps running)")
+            if self.on_login_required:
+                self.on_login_required()
+                try:
+                    return self.generate()
+                except Exception as e:
+                    log(f"failed to refresh key after login: {e}")
+        except TokenError as e:
+            log(f"failed to refresh key: {e}")
+        except Exception as e:
+            # Never let a refresh failure take the running process down with us.
+            log(f"unexpected error refreshing key: {e!r}")
+        return None
+
+    def run(self) -> int:
+        token = self.generate()  # Fail fast on startup.
+        previous = {s: signal.signal(s, self._handle_signal) for s in _FORWARDED_SIGNALS}
+        try:
+            self._start(token)
+            while True:
+                # If the credentials live shorter than the margin, refresh halfway instead of
+                # restarting in a tight loop.
+                left = token.seconds_left()
+                wait = max(left - self.margin, left / 2)
+                code = self._wait_child(wait)
+                if code is not None:
+                    return code
+                if self._stopping:
+                    return self.child.wait()
+
+                new = self._try_generate()
+                if new is None or new.expires_at <= token.expires_at:
+                    if new is not None:
+                        log("credentials were not renewed yet; retrying")
+                    code = self._wait_child(self.retry_interval)
+                    if code is not None:
+                        return code
+                    continue
+
+                log("refreshing key; restarting process")
+                self._stop()
+                if self._stopping:
+                    return 0
+                token = new
+                self._start(token)
+        finally:
+            if self.child is not None and self.child.poll() is None:
+                self._stop()
+            for s, handler in previous.items():
+                signal.signal(s, handler)
+
+
+def _local(dt: datetime) -> str:
+    return dt.astimezone().strftime("%Y-%m-%d %H:%M:%S %Z")

bedrock_env-0.1.0/src/bedrock_env/token.py

@@ -0,0 +1,121 @@
+"""Generate Amazon Bedrock short-term API keys from the AWS credential chain."""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+
+import botocore.session
+from aws_bedrock_token_generator import provide_token
+from botocore import exceptions as botocore_exceptions
+
+MAX_DURATION = timedelta(hours=12)
+
+
+class TokenError(Exception):
+    """Token could not be generated."""
+
+
+class LoginRequiredError(TokenError):
+    """The SSO session has expired and `aws sso login` is required."""
+
+
+# Exceptions botocore raises when the SSO access token is missing or expired.
+_SSO_LOGIN_ERRORS = tuple(
+    getattr(botocore_exceptions, name)
+    for name in (
+        "UnauthorizedSSOTokenError",
+        "SSOTokenLoadError",
+        "TokenRetrievalError",
+        "LoginTokenLoadError",
+    )
+    if hasattr(botocore_exceptions, name)
+)
+
+
+@dataclass(frozen=True)
+class Token:
+    value: str
+    region: str
+    expires_at: datetime
+
+    def seconds_left(self, now: datetime | None = None) -> float:
+        now = now or datetime.now(timezone.utc)
+        return (self.expires_at - now).total_seconds()
+
+
+class _StaticProvider:
+    """Credential provider that returns already-resolved credentials."""
+
+    def __init__(self, credentials):
+        self._credentials = credentials
+
+    def load(self):
+        return self._credentials
+
+
+def resolve_region(session: botocore.session.Session, region: str | None) -> str:
+    region = (
+        region
+        or os.environ.get("AWS_REGION")
+        or os.environ.get("AWS_DEFAULT_REGION")
+        or session.get_config_variable("region")
+    )
+    if not region:
+        raise TokenError(
+            "No region configured. Pass --region, set AWS_REGION, or set `region` in the profile."
+        )
+    return region
+
+
+def generate_token(
+    profile: str | None = None,
+    region: str | None = None,
+    duration: timedelta = MAX_DURATION,
+) -> Token:
+    """Generate a short-term Bedrock API key.
+
+    The key stops working when either `duration` passes or the credentials that signed it
+    expire, whichever comes first. For SSO profiles the latter is usually the binding limit
+    (the permission set's session duration).
+    """
+    if not timedelta(0) < duration <= MAX_DURATION:
+        raise TokenError("Duration must be greater than 0 and at most 12 hours.")
+
+    # A fresh session on every call so botocore does not hand back cached role credentials
+    # that are about to expire.
+    try:
+        session = botocore.session.Session(profile=profile)
+        region = resolve_region(session, region)
+        credentials = session.get_credentials()
+        if credentials is None:
+            raise TokenError("No AWS credentials found.")
+        frozen = credentials.get_frozen_credentials()
+    except _SSO_LOGIN_ERRORS as e:
+        raise LoginRequiredError(str(e)) from e
+    except botocore_exceptions.ProfileNotFound as e:
+        raise TokenError(str(e)) from e
+    except (botocore_exceptions.BotoCoreError, botocore_exceptions.ClientError) as e:
+        raise TokenError(str(e)) from e
+
+    now = datetime.now(timezone.utc)
+    expires_at = now + duration
+    # RefreshableCredentials (SSO, AssumeRole, ...) know their own expiry. There is no public
+    # accessor, so read the private attribute defensively.
+    credential_expiry = getattr(credentials, "_expiry_time", None)
+    if isinstance(credential_expiry, datetime):
+        if credential_expiry.tzinfo is None:
+            credential_expiry = credential_expiry.replace(tzinfo=timezone.utc)
+        expires_at = min(expires_at, credential_expiry)
+
+    signed_for = expires_at - now
+    if signed_for.total_seconds() < 1:
+        raise TokenError("The underlying AWS credentials have already expired.")
+
+    value = provide_token(
+        region=region,
+        aws_credentials_provider=_StaticProvider(frozen),
+        expiry=timedelta(seconds=int(signed_for.total_seconds())),
+    )
+    return Token(value=value, region=region, expires_at=expires_at)