<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Work on this issue](https://contributors.gitlab.com/manage-issue?action=work&projectId=278964&issueIid=542389) - [Close this issue](https://contributors.gitlab.com/manage-issue?action=close&projectId=278964&issueIid=542389) </details> <!--IssueSummary end--> <!--This template is a great use for issues that are feature::additions or technical tasks for larger issues.--> ### Proposal <!--Use this section to explain the feature and how it will work. It can be helpful to add technical details, design proposals, and links to related epics or issues.--> <!--Consider adding related issues and epics to this issue. You can also reference the Feature Proposal Template (https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/issue_templates/Feature%20proposal%20-%20detailed.md) for additional details to consider adding to this issue. Additionally, as a data oriented organization, when your feature exits planning breakdown, consider adding the `What does success look like, and how can we measure that?` section.--> To authenticate the AI Gateway instance to access AWS Bedrock requires defining the `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` and `AWS_REGION_NAME` when starting the Docker image ([documentation](https://docs.gitlab.com/administration/gitlab_duo_self_hosted/supported_llm_serving_platforms/#for-cloud-hosted-model-deployments)). We have customers that want to avoid using and storing long-term IAM credentials, and instead favor other authentication types such as the use of [instance profile credentials](https://docs.aws.amazon.com/athena/latest/ug/jdbc-v3-driver-instance-profile-credentials.html). There is a separate issue for supporting [assume role functionality](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html): https://gitlab.com/gitlab-org/gitlab/-/issues/542393. @erran pointed out on the following: > a new feature request to support AWS [instance profile credentials](https://docs.aws.amazon.com/athena/latest/ug/jdbc-v3-driver-instance-profile-credentials.html) should be created (work will need to be planned on the monolith for the configuration UI and the AI gateway backend to attempt to use the instance credentials). > > Since I'm not a DRI for AI gateway I'll just add that if you're adding a feature request you could include a link to https://docs.gitlab.com/ci/cloud_services/aws/ which is likely how the updated integration should be thought about/designed. <!--Label reminders Use the following resources to find the appropriate labels: - Use only one tier label choosing the lowest tier this is intended for - https://gitlab.com/gitlab-org/gitlab/-/labels - https://about.gitlab.com/handbook/product/categories/features/--> [Customer has confirmed ]()they have set up IAM instance profile credentials ## Definition of Done * We update the LLM documentation to explain instance profile credentials are supported. * We update the troubleshooting script to remove specific environment variable lookups and let boto3 perform credential lookup from environment variables which would cover any form of authentication a user likes.