Support AWS Assume Role Functionality when Authenticating AI Gateway with AWS Bedrock
Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.
Proposal
To authenticate the AI Gateway instance to access AWS Bedrock requires defining the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_REGION_NAME when starting the Docker image (documentation).
We have customers that want to avoid using and storing long-term IAM credentials, and instead favor other authentication types such as the use of STS assume role. There is a separate issue for supporting instance profile credentials: #542389 (closed).
@erran pointed out on the following:
more work would be necessary to support STS assume role from our own AI gateway deployment including new credentials being provisioned for our AI gateway deployment which would need to be allow-listed by customers using an assume role policy in their account that they could specify in a new configuration dialog or something.
Conditions of satisfaction
- We update the LLM documentation to explain instance profile credentials are supported.
- We update the troubleshooting script to remove specific environment variable lookups and let boto3 perform credential lookup from environment variables which would cover any form of authentication a user likes.