diff options
| author | Jacopo Binosi <[email protected]> | 2026-01-14 17:20:47 +0100 |
|---|---|---|
| committer | GitHub <[email protected]> | 2026-01-14 10:20:47 -0600 |
| commit | 3a9e6b558c883cde60398b05e7aab5242478a7b6 (patch) | |
| tree | 0287a1fe661912ff6020ee345f1963748af17857 /packages/web | |
| parent | 9d92ae75300cc55eced5a7277f17d7082b173940 (diff) | |
| download | opencode-3a9e6b558c883cde60398b05e7aab5242478a7b6.tar.gz opencode-3a9e6b558c883cde60398b05e7aab5242478a7b6.zip | |
feat(opencode): add AWS Web Identity Token File support for Bedrock (#8461)
Diffstat (limited to 'packages/web')
| -rw-r--r-- | packages/web/src/content/docs/providers.mdx | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/packages/web/src/content/docs/providers.mdx b/packages/web/src/content/docs/providers.mdx index effdd8d3c..e1d684de0 100644 --- a/packages/web/src/content/docs/providers.mdx +++ b/packages/web/src/content/docs/providers.mdx @@ -211,12 +211,13 @@ To use Amazon Bedrock with OpenCode: - **`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`**: Create an IAM user and generate access keys in the AWS Console - **`AWS_PROFILE`**: Use named profiles from `~/.aws/credentials`. First configure with `aws configure --profile my-profile` or `aws sso login` - **`AWS_BEARER_TOKEN_BEDROCK`**: Generate long-term API keys from the Amazon Bedrock console + - **`AWS_WEB_IDENTITY_TOKEN_FILE` / `AWS_ROLE_ARN`**: For EKS IRSA (IAM Roles for Service Accounts) or other Kubernetes environments with OIDC federation. These environment variables are automatically injected by Kubernetes when using service account annotations. #### Authentication Precedence Amazon Bedrock uses the following authentication priority: 1. **Bearer Token** - `AWS_BEARER_TOKEN_BEDROCK` environment variable or token from `/connect` command - 2. **AWS Credential Chain** - Profile, access keys, shared credentials, IAM roles, instance metadata + 2. **AWS Credential Chain** - Profile, access keys, shared credentials, IAM roles, Web Identity Tokens (EKS IRSA), instance metadata :::note When a bearer token is set (via `/connect` or `AWS_BEARER_TOKEN_BEDROCK`), it takes precedence over all AWS credential methods including configured profiles. |