feat: update Bedrock config to use AWS_BEARER_TOKEN_BEDROCK

[skamenan7]

Summary

Update Bedrock configuration to align with upstream llama-stack PR #4152.

Changes

Replace boto3 credential fields with bearer token configuration.

Related

• Upstream PR: feat!: change bedrock bearer token env variable to match AWS docs & boto3 convention llamastack/llama-stack#4152
• JIRA: RHAIENG-2046

Summary by CodeRabbit

• Documentation

  • Clarified Bedrock provider setup and environment requirements in distribution docs.

• Chores

  • Switched Bedrock authentication to a bearer-token API key sourced from AWS_BEARER_TOKEN_BEDROCK.
  • Removed legacy AWS credential and session fields plus related retry and timeout settings from Bedrock configuration.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Bedrock provider configuration switches from AWS credential-based auth to a single bearer-token API key. The enable-condition env var changes from AWS_ACCESS_KEY_ID to AWS_BEARER_TOKEN_BEDROCK; several legacy AWS credential/session fields are removed and region remains configured via AWS_DEFAULT_REGION.

Changes

Cohort / File(s)	Summary
Docs update distribution/README.md	Updated table to change bedrock provider environment variable from AWS_ACCESS_KEY_ID to AWS_BEARER_TOKEN_BEDROCK.
Runtime/provider config distribution/run.yaml	Switched bedrock provider enable condition to AWS_BEARER_TOKEN_BEDROCK; replaced AWS access/secret/session auth with a single api_key sourced from AWS_BEARER_TOKEN_BEDROCK; removed fields: aws_access_key_id, aws_secret_access_key, aws_session_token, profile_name, total_max_attempts, retry_mode, connect_timeout, read_timeout, session_ttl; retained region_name (from AWS_DEFAULT_REGION, default shown as us-east-2 in diff).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Verify the new api_key usage in run.yaml matches runtime expectations.
• Confirm removal of AWS credential/session fields doesn't break other provider codepaths or tooling.
• Ensure the env var name change is propagated to any deployment/CI docs or environment configurations.

Poem

🐰 I hopped through configs, gentle and quick,
Swapped keys for a token — tidy and slick.
One bearer to bind, old secrets unwind,
Quiet bedrock now hums, peaceful and primed. ✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately and specifically describes the main change: updating Bedrock configuration to use AWS_BEARER_TOKEN_BEDROCK.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f882843 and a2c9db7.

📒 Files selected for processing (2)

• distribution/README.md (1 hunks)
• distribution/run.yaml (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• distribution/run.yaml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: build-test-push (linux/amd64)
• GitHub Check: Summary

🔇 Additional comments (2)

distribution/README.md (2)

1-1: Confirm file regeneration via script.

This file is marked as auto-generated and should not be manually updated. Please verify that the change on line 24 was properly regenerated using scripts/gen_distro_doc.py rather than manually edited.

---

24-24: Environment variable update aligns with PR objectives.

The change from AWS_ACCESS_KEY_ID to AWS_BEARER_TOKEN_BEDROCK correctly reflects the upstream bedrock configuration change (upstream PR #4152) and aligns with the PR objectives to support bearer token authentication.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mergify]

This pull request has merge conflicts that must be resolved before it can be merged. @skamenan7 please rebase it. https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork

[skamenan7]

Container Repo's merge request(#90) is merged.

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f82fc15 and f882843.

📒 Files selected for processing (2)

• distribution/README.md (1 hunks)
• distribution/run.yaml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Summary

🔇 Additional comments (1)

distribution/README.md (1)

24-24: Documentation accurately reflects the configuration change.

The README update correctly identifies AWS_BEARER_TOKEN_BEDROCK as the new environment variable for enabling the bedrock provider.

[skamenan7]

✅ Rebased onto latest main and resolved merge conflicts.

Regarding the duplicate question from @ktdreyer about #119:

Yes, this PR (#134) supersedes #119. Both PRs update the Bedrock provider configuration, but:

• feat: Update Bedrock provider to use OpenAI-compatible API #119 updated to use AWS_BEDROCK_API_KEY (based on upstream PR #3748)
• feat: update Bedrock config to use AWS_BEARER_TOKEN_BEDROCK #134 updates to use AWS_BEARER_TOKEN_BEDROCK (based on upstream PR #4152)

The upstream project renamed the variable from AWS_BEDROCK_API_KEY → AWS_BEARER_TOKEN_BEDROCK to align with AWS documentation. This PR follows the latest upstream naming convention, so #119 should be closed in favor of this PR.