Bedrock Provider using profile

[liorheber]

Bedrock Provider using profile

[lgrammel]

Good point! I'll think about how to expose the full range of authentication options, while keeping the most basic one as easy as possible

[skorfmann]

get this error in a AWS Lambda context with implicit role credentials from the Lambda function. So that's essentially the session token missing here as well, I believe.

  "errorType": "Error",
  "errorMessage": "The security token included in the request is invalid.",
  "trace": [
    "Error: The security token included in the request is invalid.",
    "    at Runtime.handler (/var/task/index.js:6720:11)",
    "    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
  ]
}

[lgrammel]

Note sure if this will fully address this issue, since I did not find profile in BedrockRuntimeClientConfig, but this is the level of integration that I want to support: #2074 - you can pass any custom client config.

[liorheber]

Thank you for the quick solution!

[lgrammel]

#2074

[skorfmann]

Note sure if this will fully address this issue, since I did not find profile in BedrockRuntimeClientConfig, but this is the level of integration that I want to support: #2074 - you can pass any custom client config.

I think this will do. This allows passing in https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-credential-providers/#fromini to the client

[airtonix]

Note sure if this will fully address this issue, since I did not find profile in BedrockRuntimeClientConfig, but this is the level of integration that I want to support: #2074 - you can pass any custom client config.

I think this will do. This allows passing in docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-credential-providers/#fromini to the client

I'm still getting an issue with regards to using aws sso profiles to access bedrock.

...
    "@ai-sdk/amazon-bedrock": "^0.0.3",
    "@ai-sdk/openai": "^0.0.34",
    "@ai-sdk/provider": "0.0.11",
    "ai": "^3.2.14",
    "ollama-ai-provider": "^0.7.0",
...

I debug everything, and the secret key, etc all available as envvars, but i still get

UnrecognizedClientException: The security token included in the request is invalid.

[airtonix]

ok maybe I misinterpreted what is required.

@lgrammel I see you've marked it as complete. (as a result of #2074)

does this mean if we need to use a session token that we then are expected to own all the pieces of relicating this in our own code:

ai/packages/amazon-bedrock/src/bedrock-provider.ts

Lines 49 to 69 in 77df9f0

	region: loadSetting({
	settingValue: options.region,
	settingName: 'region',
	environmentVariableName: 'AWS_REGION',
	description: 'AWS region',
	}),
	credentials: {
	accessKeyId: loadSetting({
	settingValue: options.accessKeyId,
	settingName: 'accessKeyId',
	environmentVariableName: 'AWS_ACCESS_KEY_ID',
	description: 'AWS access key ID',
	}),
	secretAccessKey: loadSetting({
	settingValue: options.secretAccessKey,
	settingName: 'secretAccessKey',
	environmentVariableName: 'AWS_SECRET_ACCESS_KEY',
	description: 'AWS secret access key',
	}),
	},
	},

[airtonix]

ok yep... I had to provide this:

import { loadSetting } from '@ai-sdk/provider-utils';
import {
  AmazonBedrockProviderSettings,
  createAmazonBedrock,
  type AmazonBedrockProvider,
} from '@ai-sdk/amazon-bedrock';


const bedrock = createAmazonBedrock({
  bedrockOptions: {
    region: loadSetting({
      settingValue: this.options.region,
      settingName: 'region',
      environmentVariableName: 'AWS_REGION',
      description: 'AWS region',
    }),
    credentials: {
      accessKeyId: loadSetting({
        settingValue: this.options.accessKeyId,
        settingName: 'accessKeyId',
        environmentVariableName: 'AWS_ACCESS_KEY_ID',
        description: 'AWS access key ID',
      }),
      secretAccessKey: loadSetting({
        settingValue: this.options.secretAccessKey,
        settingName: 'secretAccessKey',
        environmentVariableName: 'AWS_SECRET_ACCESS_KEY',
        description: 'AWS secret access key',
      }),
      sessionToken: loadSetting({
        settingValue: this.options.sessionToken,
        settingName: 'sessionToken',
        environmentVariableName: 'AWS_SESSION_TOKEN',
        description: 'AWS secret access key',
      }),
    },
  },
});

[lgrammel]

@airtonix yes you need to provide the bedrockOptions that you otherwise would use directly w/ Bedrock. However, your version has this.options which is not valid in this context. You could try the following (which does not have error handling though):

const bedrock = createAmazonBedrock({
  bedrockOptions: {
    region: process.env.AWS_REGION!,
    credentials: {
      accessKeyId: process.env.AWS_ACCESS_KEY!,
      secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
      sessionToken: process.env.AWS_SESSION_TOKEN!
    },
  },
});

[airtonix]

Oh the soul less abandonment to !.

🥺🥹😭

All good. I just replicated what you did internally.