From 3a9e6b558c883cde60398b05e7aab5242478a7b6 Mon Sep 17 00:00:00 2001 From: Jacopo Binosi Date: Wed, 14 Jan 2026 17:20:47 +0100 Subject: feat(opencode): add AWS Web Identity Token File support for Bedrock (#8461) --- packages/web/src/content/docs/providers.mdx | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'packages/web/src') diff --git a/packages/web/src/content/docs/providers.mdx b/packages/web/src/content/docs/providers.mdx index effdd8d3c..e1d684de0 100644 --- a/packages/web/src/content/docs/providers.mdx +++ b/packages/web/src/content/docs/providers.mdx @@ -211,12 +211,13 @@ To use Amazon Bedrock with OpenCode: - **`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`**: Create an IAM user and generate access keys in the AWS Console - **`AWS_PROFILE`**: Use named profiles from `~/.aws/credentials`. First configure with `aws configure --profile my-profile` or `aws sso login` - **`AWS_BEARER_TOKEN_BEDROCK`**: Generate long-term API keys from the Amazon Bedrock console + - **`AWS_WEB_IDENTITY_TOKEN_FILE` / `AWS_ROLE_ARN`**: For EKS IRSA (IAM Roles for Service Accounts) or other Kubernetes environments with OIDC federation. These environment variables are automatically injected by Kubernetes when using service account annotations. #### Authentication Precedence Amazon Bedrock uses the following authentication priority: 1. **Bearer Token** - `AWS_BEARER_TOKEN_BEDROCK` environment variable or token from `/connect` command - 2. **AWS Credential Chain** - Profile, access keys, shared credentials, IAM roles, instance metadata + 2. **AWS Credential Chain** - Profile, access keys, shared credentials, IAM roles, Web Identity Tokens (EKS IRSA), instance metadata :::note When a bearer token is set (via `/connect` or `AWS_BEARER_TOKEN_BEDROCK`), it takes precedence over all AWS credential methods including configured profiles. -- cgit v1.2.3