PR #9932 - simstudioai/sim

Summary

Agent, Router, and Evaluator blocks (and Translate) can now sign AWS Bedrock calls with a saved workspace AWS credential: access keys, an assumed IAM role, or a keyless OIDC role. The new AWS Authentication choice follows the Vertex service-account pattern. It is opt-in in the shared LLM credential fields: getProviderCredentialSubBlocks({ bedrockSavedCredential: true }) plus BEDROCK_SAVED_CREDENTIAL_INPUTS, and only blocks that forward the credential to their call opt in.
One rule decides the auth mode. A block uses a saved credential only when bedrockAuthMode is credential, and that same rule controls which fields the block shows and serializes. Blocks saved before this change have no mode and keep their access keys.
The credential is checked for the run's user and pinned to the workflow's workspace. It resolves through the existing resolveAuthorizedAwsCredential / resolveAwsSessionCredentials, and the provider signs with that session (including sessionToken) alone. A selected credential never falls back to inline keys or the deployment's own AWS credentials. A credential that can't be used, or a credential mode whose id resolves blank, fails the call. In the LLM operation, a caller who may not use the credential gets 401, the same as a Vertex refusal.
Client caching: an STS session (assumed or keyless role) is new on every resolve, so its Bedrock client is built for that one request and never enters the shared provider-client cache. The Bedrock runtime's default HTTP/2 handler uses an isolated session per request and closes it when the response ends, so a per-request client leaves no socket behind. A long-lived saved key pair is cached under credential id + a digest of the key material, with no raw secrets in the key. Inline-key and default-chain behavior and cache keys are unchanged.
The session is never forwarded to a fallback on another provider. Native conversation continuation binds to the credential, not to per-run session keys.
Save-time validation reuses the existing AWS credential check (sts:GetCallerIdentity / AssumeRole). The region still goes through validateAwsRegion.
llm_chat gains one optional hidden bedrockCredential param. Tool metadata is regenerated.
Guardrails and Pi are unchanged: their fields, inputs, and catalog/Copilot schema stay exactly as before. Guardrails evaluates provider credential conditions without values, so its Bedrock fields never render; that bug was already there and this PR leaves it alone. Pi has no Bedrock provider.

Product update (if relevant)

Teams running Bedrock can drop per-block access keys and pick a workspace AWS credential, including keyless IAM roles. Docs: Agent block (AWS Bedrock auth, inference-profile IAM scope, role session lifetime) and AWS credentials guide.

Deploy notes

Roll out every worker, including the trigger bundle, before announcing the option. An older worker ignores a saved-credential selection and signs with whatever inline keys are still on the block, or, on deployments with NEXT_PUBLIC_BEDROCK_DEFAULT_CREDENTIALS, with the deployment's own AWS chain.

Type of Change

Bug fix
New feature
Breaking change
Documentation
Other: ___________

Testing

Unit tests cover:
- Bedrock provider credential selection, and role sessions not evicting other cached clients.
- Agent, router, and evaluator handlers: session signing, fail-closed, no cross-provider leak, blank-id refusal.
- The LLM operation against the real resolver: session signing, 401 on refusal, 400 on an unusable credential.
- Conversation binding.
- Block field visibility for legacy and credential modes, and that the auth-mode rule agrees with what is serialized.
- Only blocks that forward the credential (agent, router, router v2, evaluator, translate) offer it. Guardrails and Pi neither show nor accept it, and the default shared fields keep access keys only.
Integration (real Postgres): bedrock-credential.integration.ts covers a member resolving its keys, and refusal for no user, a non-member, another workspace's credential, another provider's credential, a revoked credential, and an unknown id.
Reviewers: focus on providers/bedrock/index.ts credential selection and caching, and lib/internal/llm/bedrock-credential.ts authorization.
Backward compatibility: blocks saved before this change have no auth mode, keep showing and using their access keys, and serialize exactly as before. Blocks that don't opt in keep their pre-change schema.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

N/A