monadical/opencode
14
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

feat(opencode): add AWS Web Identity Token File support for Bedrock (#8461)

Browse Source
This commit is contained in:
Jacopo Binosi
2026-01-14 17:20:47 +01:00
committed by GitHub
parent 9d92ae7530
commit 3a9e6b558c
4 changed files with 97 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
packages/web/src/content/docs/providers.mdx
View File

@@ -211,12 +211,13 @@ To use Amazon Bedrock with OpenCode:
- **`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`**: Create an IAM user and generate access keys in the AWS Console
- **`AWS_PROFILE`**: Use named profiles from `~/.aws/credentials`. First configure with `aws configure --profile my-profile` or `aws sso login`
- **`AWS_BEARER_TOKEN_BEDROCK`**: Generate long-term API keys from the Amazon Bedrock console
- **`AWS_WEB_IDENTITY_TOKEN_FILE` / `AWS_ROLE_ARN`**: For EKS IRSA (IAM Roles for Service Accounts) or other Kubernetes environments with OIDC federation. These environment variables are automatically injected by Kubernetes when using service account annotations.
#### Authentication Precedence
Amazon Bedrock uses the following authentication priority:
1. **Bearer Token** - `AWS_BEARER_TOKEN_BEDROCK` environment variable or token from `/connect` command
2. **AWS Credential Chain** - Profile, access keys, shared credentials, IAM roles, instance metadata
2. **AWS Credential Chain** - Profile, access keys, shared credentials, IAM roles, Web Identity Tokens (EKS IRSA), instance metadata
:::note
When a bearer token is set (via `/connect` or `AWS_BEARER_TOKEN_BEDROCK`), it takes precedence over all AWS credential methods including configured profiles.