bedrock: Add Bedrock API key authentication support #41393
Draft
+141
−35
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cla-bot
bot
added
the
cla-signed
5herlocked
changed the title
SomeoneToIgnore
added
the
ai
Fixes zed-industries#41312 This adds support for AWS Bedrock API keys (bearer tokens) as an authentication method. Users can now authenticate using: - Traditional access keys (existing) - Bearer tokens via ZED_AWS_BEARER_TOKEN_BEDROCK environment variable (new) - Bearer tokens via UI input field (new) Changes: - Added bearer_token field to BedrockCredentials struct - Added ZED_AWS_BEARER_TOKEN_BEDROCK environment variable constant - Updated authentication logic to check for bearer tokens (read-only from ENV) - Implemented BearerTokenProvider using AWS SDK's ResolveIdentity trait - Modified client initialization to use token_provider when bearer token is present - Enhanced UI with bearer token input field and updated instructions - Updated all help text and tooltips to mention bearer token option Bearer tokens are: - Read from environment variables (never written) - Stored in Zed's credential store when provided via UI - Passed to AWS SDK using the proper token_provider configuration Also includes fix for duplicate Region field (issue zed-industries#41313). References: - AWS Bedrock API Key Documentation: https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-use.html Co-authored-by: Ona <[email protected]>
5herlocked
force-pushed
the
feature/bedrock-bearer-token-auth
branch
from
5f4a482 to
c715051
Compare
Replace unwrap() with proper error handling using context() to propagate errors instead of panicking when serializing credentials. Co-authored-by: Ona <[email protected]>
Support reading credentials from individual environment variables: - ZED_ACCESS_KEY_ID (required) - ZED_SECRET_ACCESS_KEY (required) - ZED_SESSION_TOKEN (optional) - ZED_AWS_REGION (defaults to us-east-1) This provides a more intuitive way to set credentials via environment variables, in addition to the existing ZED_AWS_CREDENTIALS JSON format and ZED_AWS_BEARER_TOKEN_BEDROCK for bearer tokens. Co-authored-by: Ona <[email protected]>
ZED_AWS_CREDENTIALS_VAR was never meant to be read from environment variables - it was a legacy constant for the credential store key. Credentials are now stored under AMAZON_AWS_URL in the credential store. Environment variables are now properly limited to: - ZED_ACCESS_KEY_ID + ZED_SECRET_ACCESS_KEY + ZED_SESSION_TOKEN (optional) - ZED_AWS_BEARER_TOKEN_BEDROCK - ZED_AWS_REGION Co-authored-by: Ona <[email protected]>
Improves environment variable handling to match the pattern used by Anthropic provider: - Use LazyLock<EnvVar> for all environment variables - Environment variables are cached and lazy-loaded - Cleaner code with .value and .name accessors - More consistent with other providers in the codebase This provides better performance (cached reads) and cleaner code structure while maintaining the same functionality. Co-authored-by: Ona <[email protected]>
Follow the AWS SDK Rust pattern for bearer token authentication as documented in release-2025-08-05: - Add HTTP_BEARER_AUTH_SCHEME_ID constant - Use auth_scheme_preference([HTTP_BEARER_AUTH_SCHEME_ID]) when bearer token is present - Create BedrockClient using from_conf() with service-specific config This ensures the SDK properly prefers httpBearerAuth scheme when using bearer tokens, matching the official AWS SDK pattern. Reference: https://github.com/awslabs/aws-sdk-rust/releases/tag/release-2025-08-05 Co-authored-by: Ona <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #41312
Release Notes:
Also includes fix for duplicate Region field (#41341).
References: