feat(bedrock): run Bedrock models with a saved AWS credential by waleedlatif1 · Pull Request #9932 · simstudioai/sim

waleedlatif1 · 2026-11-12T11:51:47Z

Summary

Agent, Router, and Evaluator blocks (and Translate) can now sign AWS Bedrock calls with a saved workspace AWS credential: access keys, an assumed IAM role, or a keyless OIDC role. The new AWS Authentication choice follows the Vertex service-account pattern. It is opt-in in the shared LLM credential fields: getProviderCredentialSubBlocks({ bedrockSavedCredential: true }) plus BEDROCK_SAVED_CREDENTIAL_INPUTS, and only blocks that forward the credential to their call opt in.
One rule decides the auth mode. A block uses a saved credential only when bedrockAuthMode is credential, and that same rule controls which fields the block shows and serializes. Blocks saved before this change have no mode and keep their access keys.
The credential is checked for the run's user and pinned to the workflow's workspace. It resolves through the existing resolveAuthorizedAwsCredential / resolveAwsSessionCredentials, and the provider signs with that session (including sessionToken) alone. A selected credential never falls back to inline keys or the deployment's own AWS credentials. A credential that can't be used, or a credential mode whose id resolves blank, fails the call. In the LLM operation, a caller who may not use the credential gets 401, the same as a Vertex refusal.
Client caching: an STS session (assumed or keyless role) is new on every resolve, so its Bedrock client is built for that one request and never enters the shared provider-client cache. The Bedrock runtime's default HTTP/2 handler uses an isolated session per request and closes it when the response ends, so a per-request client leaves no socket behind. A long-lived saved key pair is cached under credential id + a digest of the key material, with no raw secrets in the key. Inline-key and default-chain behavior and cache keys are unchanged.
The session is never forwarded to a fallback on another provider. Native conversation continuation binds to the credential, not to per-run session keys.
Save-time validation reuses the existing AWS credential check (sts:GetCallerIdentity / AssumeRole). The region still goes through validateAwsRegion.
llm_chat gains one optional hidden bedrockCredential param. Tool metadata is regenerated.
Guardrails and Pi are unchanged: their fields, inputs, and catalog/Copilot schema stay exactly as before. Guardrails evaluates provider credential conditions without values, so its Bedrock fields never render; that bug was already there and this PR leaves it alone. Pi has no Bedrock provider.

Product update (if relevant)

Teams running Bedrock can drop per-block access keys and pick a workspace AWS credential, including keyless IAM roles. Docs: Agent block (AWS Bedrock auth, inference-profile IAM scope, role session lifetime) and AWS credentials guide.

Deploy notes

Roll out every worker, including the trigger bundle, before announcing the option. An older worker ignores a saved-credential selection and signs with whatever inline keys are still on the block, or, on deployments with NEXT_PUBLIC_BEDROCK_DEFAULT_CREDENTIALS, with the deployment's own AWS chain.

Type of Change

Testing

Unit tests cover:
- Bedrock provider credential selection, and role sessions not evicting other cached clients.
- Agent, router, and evaluator handlers: session signing, fail-closed, no cross-provider leak, blank-id refusal.
- The LLM operation against the real resolver: session signing, 401 on refusal, 400 on an unusable credential.
- Conversation binding.
- Block field visibility for legacy and credential modes, and that the auth-mode rule agrees with what is serialized.
- Only blocks that forward the credential (agent, router, router v2, evaluator, translate) offer it. Guardrails and Pi neither show nor accept it, and the default shared fields keep access keys only.
Integration (real Postgres): bedrock-credential.integration.ts covers a member resolving its keys, and refusal for no user, a non-member, another workspace's credential, another provider's credential, a revoked credential, and an unknown id.
Reviewers: focus on providers/bedrock/index.ts credential selection and caching, and lib/internal/llm/bedrock-credential.ts authorization.
Backward compatibility: blocks saved before this change have no auth mode, keep showing and using their access keys, and serialize exactly as before. Blocks that don't opt in keep their pre-change schema.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

N/A

vercel · 2026-11-12T11:51:49Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 12, 2026 1:30pm UTC

greptile-apps · 2026-11-12T11:55:49Z

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge; no new actionable issue was found.

Summary

Adds saved workspace AWS credentials for Bedrock calls from Agent, Router, Evaluator, and Translate.

Bedrock blocks can choose a saved AWS credential instead of typing keys.
Workflow blocks sign Bedrock calls with the selected workspace credential.
The internal llm_chat operation can use a saved AWS credential for Bedrock.
Bedrock uses saved credentials safely across requests and conversations.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Block selects Bedrock] --> B{Saved credential mode?}
  B -->|No| C[Existing access keys or default chain]
  B -->|Yes| D[Require credential ID]
  D --> E[Check acting user and workspace]
  E -->|Denied| F[Fail the call]
  E -->|Allowed| G[Resolve AWS signing keys]
  G --> H{Temporary session?}
  H -->|Yes| I[Build uncached Bedrock client]
  H -->|No| J[Cache client by credential and key digest]
  I --> K[Call Bedrock]
  J --> K

_{Reviews (3) · Last reviewed commit: "fix(bedrock): address review on saved AW..." · Reviewed by Greptile}

cubic-dev-ai

All reported issues were addressed across 30 files

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-11-12T12:30:22Z

@greptile

waleedlatif1 · 2026-11-12T12:30:24Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-12T12:30:30Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 34 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

… resolved A resolved saved-credential session on the provider request is used alone, passes its session token, and never falls back to inline keys or the deployment's own AWS credentials. Its client cache key names the credential and session expiry plus a digest of the key material, never a raw secret.

…ck model calls resolveBedrockCredentialSession runs the shared credential-use authorization, then loads the credential only within its workspace and only as a live AWS credential, resolving it to the stored key pair or a fresh STS session and recording the credential access.

…credential A saved credential resolves to fresh session keys every run, so the binding names the credential instead; requests without one hash exactly as before.

… saved AWS credential A block's bedrockCredential is authorized and resolved for the run's acting user within the workflow's workspace before the provider call; a failure fails the call instead of falling back. The session stays off fallbacks on another provider.

…drails operations Translate (llm_chat) and the guardrails hallucination check resolve a selected Bedrock credential for the acting user before the scoring or chat call, the same way the executor handlers do; a credential that cannot be used fails the call before any provider work.

…redential fields Agent, router, evaluator, and translate get an AWS Authentication choice for Bedrock models: access keys (the default, and what every existing block keeps) or a saved AWS credential picker, following the Vertex credential pattern.

…rors

…esolves blank A block whose AWS Authentication is a saved credential, but whose credential field resolves empty at run time (an empty reference), fell through to inline keys or the deployment's own AWS credentials. The agent, router, evaluator, and translate blocks now share one selector that refuses that case, and honors an explicit access-keys mode over a stale credential ID.

…credential

…of filling the shared client cache An assumed or keyless role resolves to a fresh STS session on every call, so a session-keyed cache entry was never read again and pushed other providers' warm clients out of the shared LRU. Long-lived saved keys stay cached. The session type now derives from AwsSessionCredentials, and authorization refusals carry a reason.

…igning A block signs with a saved AWS credential only when bedrockAuthMode is 'credential', the same rule that shows and serializes the picker. The agent test no longer leaks a persistent mock rejection.

…ke Vertex

…mbing The Guardrails block evaluates its provider credential conditions without values, so its Bedrock fields never render or serialize; the param could only arrive outside the shared auth-mode rule.

…etime

…ard it Guardrails and Pi spread the shared provider credential fields and inputs but never pass a saved credential to their call, so the AWS Authentication choice and credential picker are now opt-in. Agent, Router, Evaluator, and Translate opt in; Guardrails and Pi keep the fields and catalog schema they had before.

- Translate resolves the saved credential only for a Bedrock model, so a leftover credential choice no longer blocks a call to another provider. - A transient STS failure resolving the credential reports 503 instead of 400, using the classification the AWS tool operations already share. - llm_chat forwards the run's execution ID to the resolver, naming the role session and the credential-access audit after the run. - Native conversation binding keys a saved-credential request on the credential alone, ignoring inline keys left on the block. - Handler tests share one central mock for the Bedrock credential module; the block declaration test is replaced by Translate behavior tests. - The integration suite writes its credential-access audit inside a rollup scope and asserts it before teardown.

waleedlatif1 · 2026-11-12T13:25:45Z

@greptile

waleedlatif1 · 2026-11-12T13:25:46Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-12T13:26:13Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 34 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

greptile-apps Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread apps/sim/tools/llm/chat.ts Resolved

Comment thread apps/sim/blocks/bedrock-saved-credential.test.ts Resolved

Comment thread apps/sim/executor/handlers/evaluator/handler.test.ts Resolved

vercel Bot deployed to Preview November 12, 2026 11:56

View deployment

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

vercel Bot deployed to Preview November 12, 2026 12:34

View deployment

waleedlatif1 added 16 commits November 12, 2026 05:09

fix(bedrock): bind native conversation continuation to the saved AWS …

a75aaae

…credential A saved credential resolves to fresh session keys every run, so the binding names the credential instead; requests without one hash exactly as before.

test(bedrock): keep the LLM operation credential test free of type er…

ae0d704

…rors

docs(bedrock): document signing Bedrock model calls with a saved AWS …

3cf2717

…credential

fix(bedrock): decide the AWS auth mode with one rule for fields and s…

06ed398

…igning A block signs with a saved AWS credential only when bedrockAuthMode is 'credential', the same rule that shows and serializes the picker. The agent test no longer leaks a persistent mock rejection.

fix(bedrock): refuse an unauthorized saved AWS credential with 401 li…

6629800

…ke Vertex

revert(bedrock): drop the unreachable guardrails saved-credential plu…

626cdac

…mbing The Guardrails block evaluates its provider credential conditions without values, so its Bedrock fields never render or serialize; the param could only arrive outside the shared auth-mode rule.

docs(bedrock): cover inference-profile IAM scope and role session lif…

1a76159

…etime

waleedlatif1 force-pushed the feat/bedrock-saved-aws-credential branch from eb0e862 to 6da9081 Compare November 12, 2026 13:25

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

vercel Bot deployed to Preview November 12, 2026 13:30

View deployment

waleedlatif1 merged commit 7288b2d into staging Nov 12, 2026
83 checks passed

waleedlatif1 deleted the feat/bedrock-saved-aws-credential branch November 12, 2026 17:02

Conversation

waleedlatif1 commented Nov 12, 2026

Summary

Product update (if relevant)

Deploy notes

Type of Change

Testing

Checklist

Screenshots/Videos

Uh oh!

vercel Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Nov 12, 2026 •

edited

Loading

greptile-apps Bot commented Nov 12, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading