assumed role support for bedrock application inference profile

[narengogi]

No description provided.

[matterai-app]

Description

Summary By MatterAI

🔄 What Changed

• The getInferenceProfile function signature in src/providers/bedrock/utils.ts has been updated. It now accepts providerOptions (an object containing AWS configuration) and a Context object, replacing individual AWS credential parameters.
• Added logic within getInferenceProfile to support AWS assumed roles. If providerOptions.awsAuthType is set to 'assumedRole', the function now calls getAssumedRoleCredentials to dynamically fetch temporary AWS credentials (accessKeyId, secretAccessKey, sessionToken).
• The fetched assumed role credentials are then used to populate the providerOptions object for subsequent AWS API calls.
• The getFoundationModelFromInferenceProfile function has been updated to reflect the new getInferenceProfile signature, passing the providerOptions object and Context.

🔍 Impact of the Change

• Enhanced Authentication Flexibility: Introduces support for AWS assumed roles, allowing applications to securely access Bedrock inference profiles without hardcoding or directly managing long-lived AWS credentials.
• Improved Code Readability and Maintainability: Refactors the getInferenceProfile function signature to accept a single providerOptions object, making the function call cleaner and more extensible.
• Security Posture: Promotes a more secure authentication mechanism by leveraging temporary credentials via assumed roles.

📁 Total Files Changed

• 1 file (src/providers/bedrock/utils.ts)

🧪 Test Added

• Unit Tests: N/A (Not explicitly provided in PR data)
• Integration Tests: N/A (Not explicitly provided in PR data)
• Manual Testing: N/A (Not explicitly provided in PR data)

🔒Security Vulnerabilities

• No new critical security vulnerabilities were detected. However, improved error handling and explicit validation for assumed role parameters (awsRoleArn, awsExternalId) could enhance defensive programming.

Motivation

N/A

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)

How Has This Been Tested?

• Unit Tests
• Integration Tests
• Manual Testing

Screenshots (if applicable)

N/A

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Related Issues

N/A

Tip

Quality Recommendations

1. Consider adding explicit validation for providerOptions.awsRoleArn, providerOptions.awsExternalId, and providerOptions.awsRegion when awsAuthType is 'assumedRole'. Currently, empty strings are used if these are missing, which might lead to silent failures or unexpected behavior. Throwing a descriptive error would improve robustness.

2. Implement a try-catch block around the getAssumedRoleCredentials call to gracefully handle potential exceptions during credential retrieval, rather than solely relying on the || {} nullish coalescing, which only handles null/undefined returns.

3. Ensure that the default awsRegion ('us-east-1') is clearly documented, especially if the application is expected to operate in multiple regions without explicit configuration.

Sequence Diagram

sequenceDiagram
    participant F as getFoundationModelFromInferenceProfile
    participant I as getInferenceProfile
    participant G as getAssumedRoleCredentials
    participant H as generateAWSHeaders
    participant B as Bedrock API

    F->>I: Call getInferenceProfile(inferenceProfileIdentifier, providerOptions, context)
    I->>I: Check providerOptions.awsAuthType
    alt If awsAuthType is 'assumedRole'
        I->>G: Call getAssumedRoleCredentials(context, awsRoleArn, awsExternalId, awsRegion)
        G-->>I: Return {accessKeyId, secretAccessKey, sessionToken}
        I->>I: Update providerOptions with assumed role credentials
    end
    I->>I: Extract awsRegion, awsAccessKeyId, awsSecretAccessKey, awsSessionToken from providerOptions (with defaults)
    I->>H: Call generateAWSHeaders(url, method, awsRegion, awsAccessKeyId, awsSecretAccessKey, awsSessionToken)
    H-->>I: Return signed AWS headers
    I->>B: HTTP GET Request to bedrock.${awsRegion}.amazonaws.com/inference-profiles/{id} with signed headers
    B-->>I: Return Inference Profile Data
    I-->>F: Return Inference Profile Data

Loading

[matterai-app]

This PR adds support for AWS assumed role authentication when working with Bedrock inference profiles. The implementation looks good overall, but I've identified a few improvements that could make the code more robust.

[matterai-app]

Important

PR Review Skipped

PR review skipped as per the configuration setting. Run a manually review by commenting /matter review

💡Tips to use Matter AI

Command List

• /matter summary: Generate AI Summary for the PR
• /matter review: Generate AI Reviews for the latest commit in the PR
• /matter review-full: Generate AI Reviews for the complete PR
• /matter release-notes: Generate AI release-notes for the PR
• /matter : Chat with your PR with Matter AI Agent
• /matter remember : Generate AI memories for the PR
• /matter explain: Get an explanation of the PR
• /matter help: Show the list of available commands and documentation
• Need help? Join our Discord server: https://discord.gg/fJU5DvanU3

[matterai-app]

Important

PR Review Skipped

PR review skipped as per the configuration setting. Run a manually review by commenting /matter review

💡Tips to use Matter AI

Command List

• /matter summary: Generate AI Summary for the PR
• /matter review: Generate AI Reviews for the latest commit in the PR
• /matter review-full: Generate AI Reviews for the complete PR
• /matter release-notes: Generate AI release-notes for the PR
• /matter : Chat with your PR with Matter AI Agent
• /matter remember : Generate AI memories for the PR
• /matter explain: Get an explanation of the PR
• /matter help: Show the list of available commands and documentation
• Need help? Join our Discord server: https://discord.gg/fJU5DvanU3

[matterai-app]

Important

PR Review Skipped

PR review skipped as per the configuration setting. Run a manually review by commenting /matter review

💡Tips to use Matter AI

Command List

• /matter summary: Generate AI Summary for the PR
• /matter review: Generate AI Reviews for the latest commit in the PR
• /matter review-full: Generate AI Reviews for the complete PR
• /matter release-notes: Generate AI release-notes for the PR
• /matter : Chat with your PR with Matter AI Agent
• /matter remember : Generate AI memories for the PR
• /matter explain: Get an explanation of the PR
• /matter help: Show the list of available commands and documentation
• Need help? Join our Discord server: https://discord.gg/fJU5DvanU3