From 19fe0e01c5eca791c9da0372b49256845555a783 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Krzywa=C5=BCnia?= <1815898+ribelo@users.noreply.github.com> Date: Sat, 11 Jul 2026 13:12:23 +0200 Subject: [PATCH] fix(ai): preserve ambient AWS auth for Bedrock MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Do not treat Pi’s internal ambient-auth marker as a Bedrock bearer token. This preserves SigV4 signing for AWS profiles, IAM credentials, and roles while retaining bearer authentication for real Bedrock API keys.\n\nFixes #6531 --- packages/ai/src/api/bedrock-converse-stream.ts | 3 ++- packages/ai/test/bedrock-endpoint-resolution.test.ts | 9 +++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/packages/ai/src/api/bedrock-converse-stream.ts b/packages/ai/src/api/bedrock-converse-stream.ts index 7a9e776e..d615d4ca 100644 --- a/packages/ai/src/api/bedrock-converse-stream.ts +++ b/packages/ai/src/api/bedrock-converse-stream.ts @@ -101,6 +101,7 @@ export interface BedrockOptions extends StreamOptions { type Block = (TextContent | ThinkingContent | ToolCall) & { index?: number; partialJson?: string }; const EMPTY_TEXT_PLACEHOLDER = ""; +const AMBIENT_AUTH_MARKER = ""; export const stream: StreamFunction<"bedrock-converse-stream", BedrockOptions> = ( model: Model<"bedrock-converse-stream">, @@ -153,7 +154,7 @@ export const stream: StreamFunction<"bedrock-converse-stream", BedrockOptions> = const skipAuth = getProviderEnvValue("AWS_BEDROCK_SKIP_AUTH", options.env) === "1"; const bearerToken = options.bearerToken || - options.apiKey || + (options.apiKey !== AMBIENT_AUTH_MARKER ? options.apiKey : undefined) || getProviderEnvValue("AWS_BEARER_TOKEN_BEDROCK", options.env) || undefined; const useBearerToken = bearerToken !== undefined && !skipAuth; diff --git a/packages/ai/test/bedrock-endpoint-resolution.test.ts b/packages/ai/test/bedrock-endpoint-resolution.test.ts index 0fef3662..a7c1fee2 100644 --- a/packages/ai/test/bedrock-endpoint-resolution.test.ts +++ b/packages/ai/test/bedrock-endpoint-resolution.test.ts @@ -190,4 +190,13 @@ describe("bedrock endpoint resolution", () => { expect(config.token).toEqual({ token: "bedrock-api-key" }); expect(config.authSchemePreference).toEqual(["httpBearerAuth"]); }); + + it("does not use the ambient AWS auth marker as a bearer token", async () => { + const model = getModel("amazon-bedrock", "us.anthropic.claude-opus-4-8"); + + const config = await captureClientConfig(model, { apiKey: "" }); + + expect(config.token).toBeUndefined(); + expect(config.authSchemePreference).toBeUndefined(); + }); });