feat(bedrock-mantle): add IAM credential auth via @aws/bedrock-token-… (openclaw#61563)

* feat(bedrock-mantle): add IAM credential auth via @aws/bedrock-token-generator

Mantle previously required a manually-created API key (AWS_BEARER_TOKEN_BEDROCK).
This adds automatic bearer token generation from IAM credentials using the
official @aws/bedrock-token-generator package.

Auth priority:
1. Explicit AWS_BEARER_TOKEN_BEDROCK env var (manual API key from Console)
2. IAM credentials via getTokenProvider() → Bearer token (instance roles,
   SSO profiles, access keys, EKS IRSA, ECS task roles)

Token is cached in memory (1hr TTL, generated with 2hr validity) and in
process.env.AWS_BEARER_TOKEN_BEDROCK for downstream sync reads.

Falls back gracefully when package is not installed or credentials are
unavailable — Mantle provider simply not registered.

Closes openclaw#45152

* fix(bedrock-mantle): harden IAM auth

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

Author: wirjo

CHANGELOG.md

@@ -40,6 +40,7 @@ Docs: https://docs.openclaw.ai
 - Memory/dreaming: write dreaming trail content to top-level `dreams.md` instead of daily memory notes, update `/dreaming` help text to point there, and keep `dreams.md` available for explicit reads without pulling it into default recall. Thanks @davemorin.
 - Memory/dreaming: add the Dream Diary surface in Dreams, simplify user-facing dreaming config to `enabled` plus optional `frequency`, treat phases as implementation detail in docs/UI, and keep the lobster animation visible above diary content. Thanks @vignesh07.
 - Memory/search: add Amazon Bedrock embeddings for Titan, Cohere, Nova, and TwelveLabs models, with AWS credential-chain auto-detection for `provider: "auto"` and provider-specific dimension controls. Thanks @wirjo.
+- Providers/Amazon Bedrock Mantle: generate bearer tokens from the AWS credential chain so Mantle auto-discovery can use IAM auth without manually exporting `AWS_BEARER_TOKEN_BEDROCK`. Thanks @wirjo.
 
 ### Fixes
 

docs/providers/bedrock-mantle.md

@@ -17,29 +17,42 @@ third-party models (GPT-OSS, Qwen, Kimi, GLM, and similar) through a standard
 
 - Provider: `amazon-bedrock-mantle`
 - API: `openai-completions` (OpenAI-compatible)
-- Auth: bearer token via `AWS_BEARER_TOKEN_BEDROCK`
+- Auth: explicit `AWS_BEARER_TOKEN_BEDROCK` or IAM credential-chain bearer-token generation
 - Region: `AWS_REGION` or `AWS_DEFAULT_REGION` (default: `us-east-1`)
 
 ## Automatic model discovery
 
-When `AWS_BEARER_TOKEN_BEDROCK` is set, OpenClaw automatically discovers
-available Mantle models by querying the region's `/v1/models` endpoint.
-Discovery results are cached for 1 hour.
+When `AWS_BEARER_TOKEN_BEDROCK` is set, OpenClaw uses it directly. Otherwise,
+OpenClaw attempts to generate a Mantle bearer token from the AWS default
+credential chain, including shared credentials/config profiles, SSO, web
+identity, and instance or task roles. It then discovers available Mantle
+models by querying the region's `/v1/models` endpoint. Discovery results are
+cached for 1 hour, and IAM-derived bearer tokens are refreshed hourly.
 
 Supported regions: `us-east-1`, `us-east-2`, `us-west-2`, `ap-northeast-1`,
 `ap-south-1`, `ap-southeast-3`, `eu-central-1`, `eu-west-1`, `eu-west-2`,
 `eu-south-1`, `eu-north-1`, `sa-east-1`.
 
 ## Onboarding
 
-1. Set the bearer token on the **gateway host**:
+1. Choose one auth path on the **gateway host**:
+
+Explicit bearer token:
 
 ```bash
 export AWS_BEARER_TOKEN_BEDROCK="..."
 # Optional (defaults to us-east-1):
 export AWS_REGION="us-west-2"
 ```
 
+IAM credentials:
+
+```bash
+# Any AWS SDK-compatible auth source works here, for example:
+export AWS_PROFILE="default"
+export AWS_REGION="us-west-2"
+```
+
 2. Verify models are discovered:
 
 ```bash
@@ -81,8 +94,8 @@ If you prefer explicit config instead of auto-discovery:
 
 ## Notes
 
-- Mantle requires a bearer token today. Plain IAM credentials (instance roles,
-  SSO, access keys) are not sufficient without a token.
+- OpenClaw can mint the Mantle bearer token for you from AWS SDK-compatible
+  IAM credentials when `AWS_BEARER_TOKEN_BEDROCK` is not set.
 - The bearer token is the same `AWS_BEARER_TOKEN_BEDROCK` used by the standard
   [Amazon Bedrock](/providers/bedrock) provider.
 - Reasoning support is inferred from model IDs containing patterns like

extensions/amazon-bedrock-mantle/api.ts

@@ -1,6 +1,8 @@
 export {
   discoverMantleModels,
+  generateBearerTokenFromIam,
   mergeImplicitMantleProvider,
+  resetIamTokenCacheForTest,
   resetMantleDiscoveryCacheForTest,
   resolveImplicitMantleProvider,
   resolveMantleBearerToken,

extensions/amazon-bedrock-mantle/bedrock-token-generator.d.ts

@@ -0,0 +1,6 @@
+declare module "@aws/bedrock-token-generator" {
+  export function getTokenProvider(opts?: {
+    region?: string;
+    expiresInSeconds?: number;
+  }): () => Promise<string>;
+}

extensions/amazon-bedrock-mantle/discovery.test.ts

@@ -1,19 +1,31 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import {
   discoverMantleModels,
+  generateBearerTokenFromIam,
   mergeImplicitMantleProvider,
+  resetIamTokenCacheForTest,
   resetMantleDiscoveryCacheForTest,
   resolveMantleBearerToken,
   resolveImplicitMantleProvider,
 } from "./api.js";
 
+const mocks = vi.hoisted(() => ({
+  getTokenProvider: vi.fn(),
+}));
+
+vi.mock("@aws/bedrock-token-generator", () => ({
+  getTokenProvider: mocks.getTokenProvider,
+}));
+
 describe("bedrock mantle discovery", () => {
   const originalEnv = process.env;
 
   beforeEach(() => {
     process.env = { ...originalEnv };
     vi.restoreAllMocks();
+    mocks.getTokenProvider.mockReset();
     resetMantleDiscoveryCacheForTest();
+    resetIamTokenCacheForTest();
   });
 
   afterEach(() => {
@@ -44,6 +56,68 @@ describe("bedrock mantle discovery", () => {
     ).toBe("my-token");
   });
 
+  // ---------------------------------------------------------------------------
+  // IAM token generation
+  // ---------------------------------------------------------------------------
+
+  it("generates token from IAM credentials when token generation succeeds", async () => {
+    const tokenProvider = vi.fn(async () => "bedrock-api-key-generated"); // pragma: allowlist secret
+    mocks.getTokenProvider.mockReturnValue(tokenProvider);
+
+    const token = await generateBearerTokenFromIam({ region: "us-east-1" });
+
+    expect(token).toBe("bedrock-api-key-generated");
+    expect(mocks.getTokenProvider).toHaveBeenCalledWith({
+      region: "us-east-1",
+      expiresInSeconds: 7200,
+    });
+    expect(tokenProvider).toHaveBeenCalledTimes(1);
+  });
+
+  it("caches generated IAM tokens within TTL", async () => {
+    const tokenProvider = vi.fn(async () => "bedrock-api-key-cached"); // pragma: allowlist secret
+    mocks.getTokenProvider.mockReturnValue(tokenProvider);
+    let now = 1000;
+
+    const t1 = await generateBearerTokenFromIam({ region: "us-east-1", now: () => now });
+    now += 1800_000; // 30 min — within 1hr cache TTL
+    const t2 = await generateBearerTokenFromIam({ region: "us-east-1", now: () => now });
+
+    expect(t1).toEqual(t2);
+    expect(tokenProvider).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not reuse an IAM token across regions", async () => {
+    const tokenProvider = vi
+      .fn<() => Promise<string>>()
+      .mockResolvedValueOnce("bedrock-api-key-east") // pragma: allowlist secret
+      .mockResolvedValueOnce("bedrock-api-key-west"); // pragma: allowlist secret
+    mocks.getTokenProvider.mockReturnValue(tokenProvider);
+
+    const east = await generateBearerTokenFromIam({ region: "us-east-1", now: () => 1000 });
+    const west = await generateBearerTokenFromIam({ region: "us-west-2", now: () => 2000 });
+
+    expect(east).toBe("bedrock-api-key-east");
+    expect(west).toBe("bedrock-api-key-west");
+    expect(mocks.getTokenProvider).toHaveBeenNthCalledWith(1, {
+      region: "us-east-1",
+      expiresInSeconds: 7200,
+    });
+    expect(mocks.getTokenProvider).toHaveBeenNthCalledWith(2, {
+      region: "us-west-2",
+      expiresInSeconds: 7200,
+    });
+    expect(tokenProvider).toHaveBeenCalledTimes(2);
+  });
+
+  it("returns undefined when IAM token generation fails", async () => {
+    mocks.getTokenProvider.mockImplementation(() => {
+      throw new Error("no credentials");
+    });
+
+    await expect(generateBearerTokenFromIam({ region: "us-east-1" })).resolves.toBeUndefined();
+  });
+
   // ---------------------------------------------------------------------------
   // Model discovery
   // ---------------------------------------------------------------------------
@@ -278,23 +352,47 @@ describe("bedrock mantle discovery", () => {
     expect(provider?.models).toHaveLength(1);
   });
 
-  it("returns null when no bearer token is available", async () => {
+  it("returns null when no auth is available", async () => {
+    mocks.getTokenProvider.mockImplementation(() => {
+      throw new Error("no credentials");
+    });
+
     const provider = await resolveImplicitMantleProvider({
       env: {} as NodeJS.ProcessEnv,
     });
 
     expect(provider).toBeNull();
   });
 
-  it("does not infer Mantle auth from plain IAM env vars alone", async () => {
+  it("uses a generated IAM token when no explicit token is set", async () => {
+    const tokenProvider = vi.fn(async () => "bedrock-api-key-iam"); // pragma: allowlist secret
+    const mockFetch = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        data: [{ id: "openai.gpt-oss-120b", object: "model" }],
+      }),
+    });
+    mocks.getTokenProvider.mockReturnValue(tokenProvider);
+
     const provider = await resolveImplicitMantleProvider({
       env: {
         AWS_PROFILE: "default",
         AWS_REGION: "us-east-1",
       } as NodeJS.ProcessEnv,
+      fetchFn: mockFetch as unknown as typeof fetch,
     });
 
-    expect(provider).toBeNull();
+    expect(provider).not.toBeNull();
+    expect(provider?.apiKey).toBe("bedrock-api-key-iam");
+    expect(tokenProvider).toHaveBeenCalledTimes(1);
+    expect(mockFetch).toHaveBeenCalledWith(
+      "https://bedrock-mantle.us-east-1.api.aws/v1/models",
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: "Bearer bedrock-api-key-iam",
+        }),
+      }),
+    );
   });
 
   it("returns null for unsupported regions", async () => {

extensions/amazon-bedrock-mantle/discovery.ts

@@ -54,10 +54,8 @@ export type MantleBearerTokenProvider = () => Promise<string>;
  * Resolve a bearer token for Mantle authentication.
  *
  * Returns the value of AWS_BEARER_TOKEN_BEDROCK if set, undefined otherwise.
- *
- * Mantle's OpenAI-compatible surface expects a bearer token today in OpenClaw.
- * Plain IAM credentials (instance roles, SSO, access keys) are not enough
- * until we wire in SigV4-derived token generation via `@aws/bedrock-token-generator`.
+ * When no explicit token is set, `resolveImplicitMantleProvider` will attempt
+ * to generate one from IAM credentials via `@aws/bedrock-token-generator`.
  */
 export function resolveMantleBearerToken(env: NodeJS.ProcessEnv = process.env): string | undefined {
   const explicitToken = env.AWS_BEARER_TOKEN_BEDROCK?.trim();
@@ -67,6 +65,54 @@ export function resolveMantleBearerToken(env: NodeJS.ProcessEnv = process.env):
   return undefined;
 }
 
+/** Token cache for IAM-derived bearer tokens, keyed by region. */
+const iamTokenCache = new Map<string, { token: string; expiresAt: number }>();
+const IAM_TOKEN_TTL_MS = 3600_000; // Refresh every 1 hour (tokens valid up to 12h)
+
+/**
+ * Generate a bearer token from IAM credentials using `@aws/bedrock-token-generator`.
+ *
+ * Uses the AWS default credential chain (instance roles, SSO, access keys, EKS IRSA).
+ * Returns undefined if the package is not installed or credentials are unavailable.
+ */
+export async function generateBearerTokenFromIam(params: {
+  region: string;
+  now?: () => number;
+}): Promise<string | undefined> {
+  const now = params.now?.() ?? Date.now();
+  const cached = iamTokenCache.get(params.region);
+
+  if (cached && cached.expiresAt > now) {
+    return cached.token;
+  }
+
+  try {
+    const { getTokenProvider } = (await import("@aws/bedrock-token-generator")) as {
+      getTokenProvider: (opts?: {
+        region?: string;
+        expiresInSeconds?: number;
+      }) => () => Promise<string>;
+    };
+    const token = await getTokenProvider({
+      region: params.region,
+      expiresInSeconds: 7200, // 2 hours
+    })();
+    iamTokenCache.set(params.region, { token, expiresAt: now + IAM_TOKEN_TTL_MS });
+    return token;
+  } catch (error) {
+    log.debug?.("Mantle IAM token generation unavailable", {
+      region: params.region,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return undefined;
+  }
+}
+
+/** Reset the IAM token cache (for testing). */
+export function resetIamTokenCacheForTest(): void {
+  iamTokenCache.clear();
+}
+
 // ---------------------------------------------------------------------------
 // OpenAI-format model list response
 // ---------------------------------------------------------------------------
@@ -198,10 +244,11 @@ export async function discoverMantleModels(params: {
 // ---------------------------------------------------------------------------
 
 /**
- * Resolve an implicit Bedrock Mantle provider if bearer-token auth is available.
+ * Resolve an implicit Bedrock Mantle provider if authentication is available.
  *
- * Detection:
- * - AWS_BEARER_TOKEN_BEDROCK is set → Mantle is available
+ * Detection priority:
+ * 1. AWS_BEARER_TOKEN_BEDROCK env var → use directly
+ * 2. IAM credentials → generate bearer token via `@aws/bedrock-token-generator`
  * - Region from AWS_REGION / AWS_DEFAULT_REGION / default us-east-1
  * - Models discovered from `/v1/models`
  */
@@ -210,16 +257,18 @@ export async function resolveImplicitMantleProvider(params: {
   fetchFn?: typeof fetch;
 }): Promise<ModelProviderConfig | null> {
   const env = params.env ?? process.env;
-  const bearerToken = resolveMantleBearerToken(env);
+  const region = env.AWS_REGION ?? env.AWS_DEFAULT_REGION ?? "us-east-1";
+  const explicitBearerToken = resolveMantleBearerToken(env);
 
-  if (!bearerToken) {
+  if (!isSupportedRegion(region)) {
+    log.debug?.("Mantle not available in region", { region });
     return null;
   }
 
-  const region = env.AWS_REGION ?? env.AWS_DEFAULT_REGION ?? "us-east-1";
+  // Try explicit token first, then generate from IAM credentials
+  const bearerToken = explicitBearerToken ?? (await generateBearerTokenFromIam({ region }));
 
-  if (!isSupportedRegion(region)) {
-    log.debug?.("Mantle not available in region", { region });
+  if (!bearerToken) {
     return null;
   }
 
@@ -233,11 +282,13 @@ export async function resolveImplicitMantleProvider(params: {
     return null;
   }
 
+  log.debug?.("Mantle provider resolved", { region, modelCount: models.length });
+
   return {
     baseUrl: `${mantleEndpoint(region)}/v1`,
     api: "openai-completions",
     auth: "api-key",
-    apiKey: "env:AWS_BEARER_TOKEN_BEDROCK",
+    apiKey: explicitBearerToken ? "env:AWS_BEARER_TOKEN_BEDROCK" : bearerToken,
     models,
   };
 }

extensions/amazon-bedrock-mantle/package.json

@@ -4,6 +4,9 @@
   "private": true,
   "description": "OpenClaw Amazon Bedrock Mantle (OpenAI-compatible) provider plugin",
   "type": "module",
+  "dependencies": {
+    "@aws/bedrock-token-generator": "^1.1.0"
+  },
   "openclaw": {
     "bundle": {
       "stageRuntimeDependencies": true