Bedrock GPT-5.5 を OpenAI SDK の Lambda レイヤーで動かしてみた

{
  "Statement": [
    {
      "Sid": "BedrockMantleInference",
      "Effect": "Allow",
      "Action": ["bedrock-mantle:Get*", "bedrock-mantle:List*", "bedrock-mantle:CreateInference"],
      "Resource": "arn:aws:bedrock-mantle:*:*:project/*"
    },
    {
      "Sid": "BedrockMantleCallWithBearerToken",
      "Effect": "Allow",
      "Action": ["bedrock-mantle:CallWithBearerToken"],
      "Resource": "*"
    },
    {
      "Sid": "MarketplaceOperationsFromBedrockMantleFor3pModels",
      "Effect": "Allow",
      "Action": ["aws-marketplace:Subscribe", "aws-marketplace:ViewSubscriptions"],
      "Resource": "*",
      "Condition": {"StringEquals": {"aws:CalledViaLast": "bedrock-mantle.amazonaws.com"}}
    }
  ]
}

#!/bin/bash
set -euo pipefail

LAYER_NAME="bedrock-openai-sdk"
RUNTIME="python3.14"
REGION="us-east-2"

WORK_DIR=$(mktemp -d)
echo "Working in: $WORK_DIR"

mkdir -p "$WORK_DIR/python"

pip install \
  "openai>=2.40.0" \
  "aws-bedrock-token-generator>=1.1.0" \
  -t "$WORK_DIR/python" \
  --platform manylinux2014_aarch64 \
  --implementation cp \
  --python-version 3.14 \
  --only-binary=:all: \
  --upgrade

cd "$WORK_DIR"
zip -r9 layer.zip python/

LAYER_ARN=$(aws lambda publish-layer-version \
  --layer-name "$LAYER_NAME" \
  --compatible-runtimes "$RUNTIME" \
  --compatible-architectures arm64 \
  --zip-file "fileb://layer.zip" \
  --region "$REGION" \
  --query 'LayerVersionArn' \
  --output text)

echo ""
echo "=== Layer published ==="
echo "ARN: $LAYER_ARN"

rm -rf "$WORK_DIR"

AWSTemplateFormatVersion: "2010-09-09"
Description: "Bedrock GPT-5.5 Lambda (OpenAI SDK + Layer) - ZipFile inline"

Parameters:
  BedrockRegion:
    Type: String
    Default: us-east-2
  BedrockModel:
    Type: String
    Default: openai.gpt-5.5
  LayerArn:
    Type: String
    Description: "ARN of Lambda Layer containing openai + aws-bedrock-token-generator"

Resources:
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/AmazonBedrockMantleInferenceAccess

  Function:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-fn"
      Runtime: python3.14
      Handler: index.handler
      Architectures: [arm64]
      Role: !GetAtt LambdaRole.Arn
      Timeout: 120
      MemorySize: 256
      Layers:
        - !Ref LayerArn
      Environment:
        Variables:
          BEDROCK_REGION: !Ref BedrockRegion
          BEDROCK_MODEL: !Ref BedrockModel
      Code:
        ZipFile: |
          """Bedrock GPT-5.5 via OpenAI SDK + aws-bedrock-token-generator (Layer)."""
          import json
          import os

          from aws_bedrock_token_generator import provide_token
          from openai import OpenAI

          REGION = os.environ["BEDROCK_REGION"]
          MODEL = os.environ["BEDROCK_MODEL"]

          def handler(event, context):
              body = event if isinstance(event, dict) else json.loads(event.get("body", "{}"))
              prompt = body.get("prompt", "Hello, respond in one sentence.")

              token = provide_token(region=REGION)
              client = OpenAI(
                  base_url=f"https://bedrock-mantle.{REGION}.api.aws/openai/v1",
                  api_key=token,
              )

              response = client.responses.create(
                  model=MODEL,
                  input=[{"role": "user", "content": prompt}],
              )

              return {
                  "statusCode": 200,
                  "body": json.dumps({
                      "response": response.output_text,
                      "model": response.model,
                      "usage": {
                          "input_tokens": response.usage.input_tokens,
                          "output_tokens": response.usage.output_tokens,
                      },
                  }, ensure_ascii=False),
              }

Outputs:
  FunctionArn:
    Value: !GetAtt Function.Arn
  FunctionName:
    Value: !Ref Function

AWSTemplateFormatVersion: "2010-09-09"
Description: "Bedrock GPT-5.5 Lambda (botocore only, no external deps) - ZipFile inline"

Parameters:
  BedrockRegion:
    Type: String
    Default: us-east-2
  BedrockModel:
    Type: String
    Default: openai.gpt-5.5

Resources:
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/AmazonBedrockMantleInferenceAccess

  Function:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-fn"
      Runtime: python3.14
      Handler: index.handler
      Architectures: [arm64]
      Role: !GetAtt LambdaRole.Arn
      Timeout: 120
      MemorySize: 256
      Environment:
        Variables:
          BEDROCK_REGION: !Ref BedrockRegion
          BEDROCK_MODEL: !Ref BedrockModel
      Code:
        ZipFile: |
          """Bedrock GPT-5.5 via bedrock-mantle — botocore only, zero external deps."""
          import base64
          import json
          import os
          import urllib.request

          from botocore.auth import SigV4QueryAuth
          from botocore.awsrequest import AWSRequest
          from botocore.session import Session

          REGION = os.environ["BEDROCK_REGION"]
          MODEL = os.environ["BEDROCK_MODEL"]
          ENDPOINT = f"https://bedrock-mantle.{REGION}.api.aws/openai/v1/responses"

          def _get_token():
              session = Session()
              creds = session.get_credentials()
              if creds is None:
                  raise RuntimeError("No AWS credentials found")
              frozen = creds.get_frozen_credentials()
              req = AWSRequest(
                  method="POST",
                  url="https://bedrock.amazonaws.com/",
                  headers={"host": "bedrock.amazonaws.com"},
                  params={"Action": "CallWithBearerToken"},
              )
              auth = SigV4QueryAuth(frozen, "bedrock", REGION, expires=3600)
              auth.add_auth(req)
              url_no_scheme = req.url.replace("https://", "") + "&Version=1"
              token = "bedrock-api-key-" + base64.b64encode(url_no_scheme.encode()).decode()
              return token

          def handler(event, context):
              body = event if isinstance(event, dict) else json.loads(event.get("body", "{}"))
              prompt = body.get("prompt", "Hello, respond in one sentence.")

              token = _get_token()
              payload = json.dumps({
                  "model": MODEL,
                  "input": [{"role": "user", "content": prompt}],
              }).encode()

              req = urllib.request.Request(
                  ENDPOINT,
                  data=payload,
                  headers={
                      "Content-Type": "application/json",
                      "Authorization": f"Bearer {token}",
                  },
              )
              with urllib.request.urlopen(req, timeout=90) as resp:
                  result = json.loads(resp.read())

              output_text = ""
              for item in result.get("output", []):
                  if item.get("type") == "message":
                      for c in item.get("content", []):
                          if c.get("type") == "output_text":
                              output_text += c.get("text", "")

              return {
                  "statusCode": 200,
                  "body": json.dumps({
                      "response": output_text,
                      "model": result.get("model"),
                      "usage": result.get("usage"),
                  }, ensure_ascii=False),
              }

Outputs:
  FunctionArn:
    Value: !GetAtt Function.Arn
  FunctionName:
    Value: !Ref Function