fix(amazon-bedrock): avoid env AWS_SESSION_TOKEN with explicit static keys#14137
Open
turisanapo wants to merge 3 commits intovercel:mainfrom
Open
fix(amazon-bedrock): avoid env AWS_SESSION_TOKEN with explicit static keys#14137turisanapo wants to merge 3 commits intovercel:mainfrom
turisanapo wants to merge 3 commits intovercel:mainfrom
Conversation
When accessKeyId and secretAccessKey are both passed as options, resolve sessionToken only from options — not AWS_SESSION_TOKEN — so workload tokens (e.g. IRSA) are not mixed with IAM user keys. Fixes vercel#14136 Made-with: Cursor
tigent
bot
added
ai/provider
- Document that explicit static keys no longer merge AWS_SESSION_TOKEN - Remove misleading sessionToken: undefined advice; note credentialProvider for older releases - Extend changeset summary for docs Made-with: Cursor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Background
createAmazonBedrockmerged explicit staticaccessKeyId/secretAccessKeywithAWS_SESSION_TOKENfrom the environment vialoadOptionalSetting. On EKS IRSA (and similar), that token is for the workload—not the IAM user keys in options—so SigV4 fails with invalid security token (#14136).The published docs also claimed that setting
sessionToken: undefinedavoids env defaults.undefineddoes not skip env inloadOptionalSetting(settingValue != nullis false), which we confirmed manually (Hebo + fakeAWS_SESSION_TOKEN). The bug is both implementation and documentation.Summary
accessKeyIdandsecretAccessKeyare string options,sessionTokencomes only from thesessionTokenoption (or omitted);AWS_SESSION_TOKENis not read for that path. If either key is env-resolved, behavior is unchanged (AWS_SESSION_TOKENstill applies when needed).08-amazon-bedrock.mdx: removed the incorrectsessionToken: undefinedguidance; documented static keys vs env; pointed tocredentialProviderfor older releases / edge cases.@ai-sdk/amazon-bedrock; body mentions doc correction.Manual Verification
pnpm build --filter=@ai-sdk/amazon-bedrock...pnpm --filter=@ai-sdk/amazon-bedrock test:nodeAWS_SESSION_TOKEN=fakeand real static keys in options, Bedrock request should succeed after this change (and docs match behavior).Checklist
pnpm changesetin the project root)Future Work
None required.
Related Issues
Fixes #14136