fix(gateway): Bedrock BYOK must not inherit AWS_SESSION_TOKEN (IRSA)

[turisanapo]

Summary

Fixes #351.

@ai-sdk/amazon-bedrock builds SigV4 credentials from accessKeyId / secretAccessKey but still loads AWS_SESSION_TOKEN from the environment when no sessionToken option is set. On EKS/IRSA that merges the pod session token with BYOK IAM user keys and AWS rejects the request.

Change

Use credentialProvider: () => Promise.resolve({ accessKeyId, secretAccessKey }) for Bedrock access-key mode so only those fields are supplied (no env session token).

Summary by CodeRabbit

• Refactor
  • Improved how Bedrock access-key authentication supplies credentials: the access-key flow now provides credentials via an asynchronous provider callback (while still validating required fields). This is an internal credential-handling change with no user-facing behavior changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e4bccf06-9a0f-4189-95db-733d64c8bfc8

📥 Commits

Reviewing files that changed from the base of the PR and between 21451a4 and 6fed34c.

📒 Files selected for processing (1)

• apps/gateway/src/lib/provider.ts

✅ Files skipped from review due to trivial changes (1)

• apps/gateway/src/lib/provider.ts

---

📝 Walkthrough

Walkthrough

The Bedrock provider's "access-key" auth branch now supplies credentials via a credentialProvider async callback returning { accessKeyId, secretAccessKey } instead of passing keys directly, preventing environment AWS_SESSION_TOKEN from being merged into BYOK credentials.

Changes

Cohort / File(s)	Summary
Bedrock Access-Key Auth apps/gateway/src/lib/provider.ts	Replaced direct accessKeyId/secretAccessKey arguments with a credentialProvider: async () => ({ accessKeyId, secretAccessKey }) callback for the "bedrock" "access-key" auth mode; validation of key presence unchanged.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Gateway
  participant AmazonBedrockSDK
  participant BedrockAPI

  Client->>Gateway: request using Bedrock BYOK provider
  Gateway->>AmazonBedrockSDK: createAmazonBedrock(..., credentialProvider)
  AmazonBedrockSDK->>Gateway: invoke credentialProvider() -> { accessKeyId, secretAccessKey }
  AmazonBedrockSDK->>BedrockAPI: SigV4-signed request using returned keys
  BedrockAPI-->>AmazonBedrockSDK: response
  AmazonBedrockSDK-->>Gateway: response
  Gateway-->>Client: forward response

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Turisanapo/heb 270 gateway lazy init provider auth #167: Changes Bedrock provider auth to use a credentialProvider callback instead of raw access key arguments (directly related pattern).

Poem

🐰 I hopped through keys and env's mist,
Kept BYOK secrets in my fist.
No stray token may now intrude,
Bedrock sings, credentials shooed. 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly references the specific fix for Bedrock BYOK credentials and the AWS_SESSION_TOKEN inheritance issue with IRSA, directly matching the main code change.
Linked Issues check	✅ Passed	The PR successfully implements the required fix from issue #351: modifying Bedrock access-key authentication to use credentialProvider returning only accessKeyId and secretAccessKey, preventing AWS_SESSION_TOKEN environment variable from being merged into credentials.
Out of Scope Changes check	✅ Passed	All changes are directly related to fixing the linked issue #351. The modification to the Bedrock access-key authentication path is the intended scope with no extraneous changes present.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/gateway-bedrock-byok-session-token

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[heiwen]

According to AI SDK documentation the most minimal fix would be to explicitly set sessionToken: undefined: https://ai-sdk.dev/providers/ai-sdk-providers/amazon-bedrock#provider-instance

[turisanapo]

According to AI SDK documentation the most minimal fix would be to explicitly set sessionToken: undefined: https://ai-sdk.dev/providers/ai-sdk-providers/amazon-bedrock#provider-instance

Good catch. I tried the docs approach (sessionToken: undefined) with a AWS_SESSION_TOKEN in the env; it still breaks. With the current SDK, undefined doesn’t stop AWS_SESSION_TOKEN from being picked up, so we’re using credentialProvider until a fixed @ai-sdk/amazon-bedrock lands (vercel/ai#14137).