「それ、AI にやらせてみよう」Claude Code Action 活用テクニック with Amazon Bedrock

export ACCOUNT_ID=(AWSアカウントID)
aws iam create-open-id-connect-provider --url https://token.actions.githubusercontent.com
aws iam add-client-id-to-open-id-connect-provider \
--open-id-connect-provider-arn arn:aws:iam::${ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com \
--client-id sts.amazonaws.com

export ACCOUNT_ID=(AWS アカウント ID)
export REPOSITORY=repo:(GITHUB ユーザー名)/(リポジトリ名):ref:refs/heads/(ブランチ名)
export ROLE_NAME=claude-code-action-role

cat > trust-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RoleForGitHubActions",
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "${REPOSITORY}"
        }
      }
    }
  ]
}
EOF

cat > inline-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:us-west-2:420466380198:inference-profile/us.anthropic.claude-sonnet-4-20250514-v1:0",
        "arn:aws:bedrock:us-west-2::foundation-model/anthropic.claude-3-7-sonnet-20250219-v1:0",
        "arn:aws:bedrock:*::foundation-model/anthropic.claude-sonnet-4-20250514-v1:0"
      ]
    }
  ]
}
EOF

aws iam create-role --role-name $ROLE_NAME --assume-role-policy-document file://./trust-policy.json
aws iam put-role-policy --role-name $ROLE_NAME --policy-name allow-bedrock-invoke-model --policy-document file://./inline-policy.json

name: Claude PR Assistant

on:
  issue_comment:
types: [created]
  pull_request_review_comment:
types: [created]
  issues:
types: [opened, assigned]
  pull_request_review:
types: [submitted]

jobs:
  claude-code-action:
if: |
  (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
  (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
  (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
  (github.event_name == 'issues' && contains(github.event.issue.body, '@claude'))
runs-on: ubuntu-latest
env:
  ANTHROPIC_BEDROCK_BASE_URL: "https://bedrock-runtime.us-west-2.amazonaws.com“
permissions:
  contents: read
  pull-requests: read
  issues: read
  id-token: write
steps:
name: Checkout repository
    uses: actions/checkout@v4
    with:
      fetch-depth: 1

name: Configure AWS Credentials (OIDC)
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: $ secrets.CLAUDE_CODE_ACTION_ROLE 
      aws-region: us-west-2

uses: anthropics/claude-code-action@beta
    with:
      model: "us.anthropic.claude-sonnet-4-20250514-v1:0"
      use_bedrock: "true"

- name: Run Claude PR Action
uses: anthropics/claude-code-action@beta
with:
  timeout_minutes: "60"
  use_bedrock: "true"
  model: "us.anthropic.claude-sonnet-4-20250514-v1:0"
  allowed_tools: "Bash"

@claude
drawio の xml 形式で AWS の構成図を作ってください
アカウントは2つあり、それぞれの定義は path/to/def/` 配下にあります