feat(terraform): add claude-agent-sdk input validation and CLAUDE_CODE_USE_BEDROCK env var

- Add precondition to prevent zip deployment with claude-agent-sdk patterns
- Add conditional CLAUDE_CODE_USE_BEDROCK=1 environment variable
- Add is_claude_agent_sdk local flag

Mirrors CDK backend-stack.ts changes from PR awslabs#45.

Author: kaleko

infra-terraform/modules/backend/locals.tf

@@ -42,6 +42,9 @@ locals {
   is_docker = var.backend_deployment_type == "docker"
   is_zip    = var.backend_deployment_type == "zip"
 
+  # Pattern flags
+  is_claude_agent_sdk = contains(["claude-agent-sdk-single-agent", "claude-agent-sdk-multi-agent"], var.backend_pattern)
+
   # Project paths (for zip packaging)
   project_root = "${path.module}/../../.."
   pattern_dir  = "${local.project_root}/patterns/${var.backend_pattern}"

infra-terraform/modules/backend/runtime.tf

@@ -471,16 +471,24 @@ resource "aws_bedrockagentcore_agent_runtime" "main" {
   }
 
   # Environment variables for the runtime
-  environment_variables = {
-    AWS_REGION                       = local.region
-    AWS_DEFAULT_REGION               = local.region
-    MEMORY_ID                        = aws_bedrockagentcore_memory.main.id
-    STACK_NAME                       = var.stack_name_base
-    GATEWAY_CREDENTIAL_PROVIDER_NAME = "${var.stack_name_base}-runtime-gateway-auth"
-  }
+  environment_variables = merge(
+    {
+      AWS_REGION                       = local.region
+      AWS_DEFAULT_REGION               = local.region
+      MEMORY_ID                        = aws_bedrockagentcore_memory.main.id
+      STACK_NAME                       = var.stack_name_base
+      GATEWAY_CREDENTIAL_PROVIDER_NAME = "${var.stack_name_base}-runtime-gateway-auth"
+    },
+    # claude-agent-sdk patterns require CLAUDE_CODE_USE_BEDROCK=1
+    local.is_claude_agent_sdk ? { CLAUDE_CODE_USE_BEDROCK = "1" } : {}
+  )
 
   # Force runtime replacement when agent code changes (zip or docker)
   lifecycle {
+    precondition {
+      condition     = !local.is_claude_agent_sdk || local.is_docker
+      error_message = "claude-agent-sdk patterns require Docker deployment (backend_deployment_type = \"docker\") because they need Node.js and the claude-code CLI installed at build time."
+    }
     precondition {
       condition     = var.backend_network_mode != "VPC" || (var.backend_vpc_id != null && var.backend_vpc_id != "")
       error_message = "backend_vpc_id is required when backend_network_mode is 'VPC'."

infra-terraform/modules/backend/variables.tf

@@ -17,7 +17,7 @@ variable "backend_pattern" {
 }
 
 variable "backend_deployment_type" {
-  description = "Deployment type: 'docker' (container via ECR) or 'zip' (Python package via S3)."
+  description = "Deployment type: 'docker' (container via ECR) or 'zip' (Python package via S3). Note: claude-agent-sdk patterns require 'docker'."
   type        = string
   default     = "docker"
 }