coder · evgeniy-scherbina · Jun 24, 2026 · Jun 18, 2026 · Jun 20, 2026 · Jun 20, 2026
diff --git a/aibridge/aibridgetest/aibridgetest.go b/aibridge/aibridgetest/aibridgetest.go
@@ -0,0 +1,19 @@
+package aibridgetest
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/aibridge"
+)
+
+// NewAnthropicProvider builds an Anthropic provider for tests, failing the test
+// if credential resolution fails.
+func NewAnthropicProvider(t testing.TB, cfg aibridge.AnthropicConfig, bedrockCfg *aibridge.AWSBedrockConfig) aibridge.Provider {
+	t.Helper()
+	p, err := aibridge.NewAnthropicProvider(context.Background(), cfg, bedrockCfg)
+	require.NoError(t, err)
+	return p
+}
diff --git a/aibridge/api.go b/aibridge/api.go
@@ -45,8 +45,8 @@ func AsActor(ctx context.Context, actorID string, metadata recorder.Metadata) co
 	return aibcontext.AsActor(ctx, actorID, metadata)
 }
 
-func NewAnthropicProvider(cfg config.Anthropic, bedrockCfg *config.AWSBedrock) provider.Provider {
-	return provider.NewAnthropic(cfg, bedrockCfg)
+func NewAnthropicProvider(ctx context.Context, cfg config.Anthropic, bedrockCfg *config.AWSBedrock) (provider.Provider, error) {
+	return provider.NewAnthropic(ctx, cfg, bedrockCfg)
 }
 
 func NewOpenAIProvider(cfg config.OpenAI) provider.Provider {

diff --git a/aibridge/bridge_test.go b/aibridge/bridge_test.go
@@ -15,6 +15,7 @@ import (
 
 	"cdr.dev/slog/v3/sloggers/slogtest"
 	"github.com/coder/coder/v2/aibridge"
+	"github.com/coder/coder/v2/aibridge/aibridgetest"
 	"github.com/coder/coder/v2/aibridge/config"
 	"github.com/coder/coder/v2/aibridge/internal/testutil"
 	"github.com/coder/coder/v2/aibridge/provider"
@@ -36,7 +37,7 @@ func TestValidateProviders(t *testing.T) {
 			name: "all_supported_providers",
 			providers: []provider.Provider{
 				aibridge.NewOpenAIProvider(config.OpenAI{Name: "openai", BaseURL: "https://api.openai.com/v1/"}),
-				aibridge.NewAnthropicProvider(config.Anthropic{Name: "anthropic", BaseURL: "https://api.anthropic.com/"}, nil),
+				aibridgetest.NewAnthropicProvider(t, config.Anthropic{Name: "anthropic", BaseURL: "https://api.anthropic.com/"}, nil),
 				aibridge.NewCopilotProvider(config.Copilot{Name: "copilot", BaseURL: "https://api.individual.githubcopilot.com"}),
 				aibridge.NewCopilotProvider(config.Copilot{Name: "copilot-business", BaseURL: "https://api.business.githubcopilot.com"}),
 				aibridge.NewCopilotProvider(config.Copilot{Name: "copilot-enterprise", BaseURL: "https://api.enterprise.githubcopilot.com"}),
@@ -46,7 +47,7 @@ func TestValidateProviders(t *testing.T) {
 			name: "default_names_and_base_urls",
 			providers: []provider.Provider{
 				aibridge.NewOpenAIProvider(config.OpenAI{}),
-				aibridge.NewAnthropicProvider(config.Anthropic{}, nil),
+				aibridgetest.NewAnthropicProvider(t, config.Anthropic{}, nil),
 				aibridge.NewCopilotProvider(config.Copilot{}),
 			},
 		},
@@ -126,13 +127,13 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
 		name        string
 		baseURLPath string
 		requestPath string
-		provider    func(string) provider.Provider
+		provider    func(*testing.T, string) provider.Provider
 		expectPath  string
 	}{
 		{
 			name:        "openAI_no_base_path",
 			requestPath: "/openai/v1/conversations",
-			provider: func(baseURL string) provider.Provider {
+			provider: func(_ *testing.T, baseURL string) provider.Provider {
 				return aibridge.NewOpenAIProvider(config.OpenAI{BaseURL: baseURL})
 			},
 			expectPath: "/conversations",
@@ -141,32 +142,32 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
 			name:        "openAI_with_base_path",
 			baseURLPath: "/v1",
 			requestPath: "/openai/v1/conversations",
-			provider: func(baseURL string) provider.Provider {
+			provider: func(_ *testing.T, baseURL string) provider.Provider {
 				return aibridge.NewOpenAIProvider(config.OpenAI{BaseURL: baseURL})
 			},
 			expectPath: "/v1/conversations",
 		},
 		{
 			name:        "anthropic_no_base_path",
 			requestPath: "/anthropic/v1/models",
-			provider: func(baseURL string) provider.Provider {
-				return aibridge.NewAnthropicProvider(config.Anthropic{BaseURL: baseURL}, nil)
+			provider: func(t *testing.T, baseURL string) provider.Provider {
+				return aibridgetest.NewAnthropicProvider(t, config.Anthropic{BaseURL: baseURL}, nil)
 			},
 			expectPath: "/v1/models",
 		},
 		{
 			name:        "anthropic_with_base_path",
 			baseURLPath: "/v1",
 			requestPath: "/anthropic/v1/models",
-			provider: func(baseURL string) provider.Provider {
-				return aibridge.NewAnthropicProvider(config.Anthropic{BaseURL: baseURL}, nil)
+			provider: func(t *testing.T, baseURL string) provider.Provider {
+				return aibridgetest.NewAnthropicProvider(t, config.Anthropic{BaseURL: baseURL}, nil)
 			},
 			expectPath: "/v1/v1/models",
 		},
 		{
 			name:        "copilot_no_base_path",
 			requestPath: "/copilot/models",
-			provider: func(baseURL string) provider.Provider {
+			provider: func(_ *testing.T, baseURL string) provider.Provider {
 				return aibridge.NewCopilotProvider(config.Copilot{BaseURL: baseURL})
 			},
 			expectPath: "/models",
@@ -175,7 +176,7 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
 			name:        "copilot_with_base_path",
 			baseURLPath: "/v1",
 			requestPath: "/copilot/models",
-			provider: func(baseURL string) provider.Provider {
+			provider: func(_ *testing.T, baseURL string) provider.Provider {
 				return aibridge.NewCopilotProvider(config.Copilot{BaseURL: baseURL})
 			},
 			expectPath: "/v1/models",
@@ -196,7 +197,7 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
 			t.Cleanup(upstream.Close)
 
 			rec := testutil.MockRecorder{}
-			prov := tc.provider(upstream.URL + tc.baseURLPath)
+			prov := tc.provider(t, upstream.URL+tc.baseURLPath)
 			bridge, err := aibridge.NewRequestBridge(t.Context(), []provider.Provider{prov}, &rec, nil, logger, nil, bridgeTestTracer)
 			require.NoError(t, err)
 
@@ -213,13 +214,13 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
 func TestRequestBodySizeLimit(t *testing.T) {
 	t.Parallel()
 
-	newOpenAI := func(baseURL string) provider.Provider {
+	newOpenAI := func(_ *testing.T, baseURL string) provider.Provider {
 		return aibridge.NewOpenAIProvider(config.OpenAI{Name: "openai", BaseURL: baseURL})
 	}
-	newAnthropic := func(baseURL string) provider.Provider {
-		return aibridge.NewAnthropicProvider(config.Anthropic{Name: "anthropic", BaseURL: baseURL}, nil)
+	newAnthropic := func(t *testing.T, baseURL string) provider.Provider {
+		return aibridgetest.NewAnthropicProvider(t, config.Anthropic{Name: "anthropic", BaseURL: baseURL}, nil)
 	}
-	newCopilot := func(baseURL string) provider.Provider {
+	newCopilot := func(_ *testing.T, baseURL string) provider.Provider {
 		return aibridge.NewCopilotProvider(config.Copilot{Name: "copilot", BaseURL: baseURL})
 	}
 
@@ -232,7 +233,7 @@ func TestRequestBodySizeLimit(t *testing.T) {
 
 	tests := []struct {
 		name     string
-		provider func(baseURL string) provider.Provider
+		provider func(*testing.T, string) provider.Provider
 		path     string
 		body     []byte
 	}{
@@ -258,7 +259,7 @@ func TestRequestBodySizeLimit(t *testing.T) {
 			}))
 			t.Cleanup(upstream.Close)
 
-			prov := tc.provider(upstream.URL)
+			prov := tc.provider(t, upstream.URL)
 			bridge, err := aibridge.NewRequestBridge(
 				t.Context(),
 				[]provider.Provider{prov},

diff --git a/aibridge/config/config.go b/aibridge/config/config.go
@@ -33,6 +33,11 @@ type AWSBedrock struct {
 	// (https://bedrock-runtime.{region}.amazonaws.com).
 	// This is useful for routing requests through a proxy or for testing.
 	BaseURL string
+	// RoleARN, when set, is assumed via STS before calling Bedrock. The base
+	// identity (static keys or the AWS SDK default credential chain, e.g.
+	// IRSA / EKS Pod Identity / EC2 Instance Profile) signs the AssumeRole
+	// call, and the resulting temporary credentials sign Bedrock requests.
+	RoleARN string
 }
 
 // OpenAI carries configuration for an OpenAI provider.

diff --git a/aibridge/intercept/credential.go b/aibridge/intercept/credential.go
@@ -28,7 +28,7 @@ const (
 // before failover selects a key, and a key resolved dynamically at request time.
 const (
 	hintFailoverKey     = "<failover key>"
-	hintBedrockChainKey = "<aws chain credentials>"
+	hintBedrockChainKey = "<aws chain>"
 )
 
 // Credential is the per-request upstream authentication for an interception:

diff --git a/aibridge/intercept/credential_test.go b/aibridge/intercept/credential_test.go
@@ -19,6 +19,9 @@ import (
 func TestCredential(t *testing.T) {
 	t.Parallel()
 
+	// Matches the VARCHAR(15) DB constraint.
+	const maxCredentialHintLength = 15
+
 	tests := []struct {
 		name                    string
 		newCred                 func(t *testing.T) intercept.Credential
@@ -72,7 +75,7 @@ func TestCredential(t *testing.T) {
 			},
 			expectKind:       intercept.CredentialKindCentralized,
 			expectAuthHeader: "",
-			expectHint:       "<aws chain credentials>",
+			expectHint:       "<aws chain>",
 			expectLength:     0,
 		},
 		{
@@ -118,6 +121,8 @@ func TestCredential(t *testing.T) {
 			assert.Equal(t, tc.expectKind, cred.Kind(), "Kind")
 			assert.Equal(t, tc.expectAuthHeader, cred.AuthHeader(), "AuthHeader")
 			assert.Equal(t, tc.expectHint, cred.Hint(), "Hint")
+			assert.LessOrEqual(t, len(cred.Hint()), maxCredentialHintLength,
+				"Hint must fit the credential_hint column")
 			assert.Equal(t, tc.expectLength, cred.Length(), "Length")
 
 			credBYOK, credBYOKOK := intercept.AsBYOK(cred)

diff --git a/aibridge/intercept/messages/base.go b/aibridge/intercept/messages/base.go
@@ -16,8 +16,7 @@ import (
 	"github.com/anthropics/anthropic-sdk-go/option"
 	"github.com/anthropics/anthropic-sdk-go/shared"
 	"github.com/anthropics/anthropic-sdk-go/shared/constant"
-	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/google/uuid"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/trace"
@@ -65,13 +64,26 @@ var bedrockSupportedBetaFlags = map[string]bool{
 	"tool-examples-2025-10-29": true,
 }
 
+// BedrockRuntime carries everything a Bedrock-backed interception needs: the
+// static Bedrock config plus the AWS credentials provider.
+type BedrockRuntime struct {
+	Cfg   aibconfig.AWSBedrock
+	Creds aws.CredentialsProvider
+	// ResolvedRegion is the region the AWS SDK resolved at construction (from
+	// the environment, shared config, or IMDS). It is used for request signing
+	// when Cfg.Region is empty, e.g. a custom base URL with the region supplied
+	// via AWS_REGION.
+	ResolvedRegion string
+}
+
 type interceptionBase struct {
 	id         uuid.UUID
 	reqPayload RequestPayload
 
-	cfg        intercept.Config
-	cred       intercept.Credential
-	bedrockCfg *aibconfig.AWSBedrock
+	cfg  intercept.Config
+	cred intercept.Credential
+	// bedrock is nil for non-Bedrock providers.
+	bedrock *BedrockRuntime
 
 	// clientHeaders are the original HTTP headers from the client request.
 	clientHeaders http.Header
@@ -107,10 +119,10 @@ func (i *interceptionBase) Model() string {
 		return "coder-aibridge-unknown"
 	}
 
-	if i.bedrockCfg != nil {
-		model := i.bedrockCfg.Model
+	if i.bedrock != nil {
+		model := i.bedrock.Cfg.Model
 		if i.isSmallFastModel() {
-			model = i.bedrockCfg.SmallFastModel
+			model = i.bedrock.Cfg.SmallFastModel
 		}
 		return model
 	}
@@ -126,7 +138,7 @@ func (i *interceptionBase) baseTraceAttributes(r *http.Request, streaming bool)
 		attribute.String(tracing.Provider, i.cfg.ProviderName),
 		attribute.String(tracing.Model, i.Model()),
 		attribute.Bool(tracing.Streaming, streaming),
-		attribute.Bool(tracing.IsBedrock, i.bedrockCfg != nil),
+		attribute.Bool(tracing.IsBedrock, i.bedrock != nil),
 	}
 }
 
@@ -238,10 +250,10 @@ func (i *interceptionBase) newMessagesService(ctx context.Context, opts ...optio
 		opts = append(opts, option.WithMiddleware(mw))
 	}
 
-	if i.bedrockCfg != nil {
+	if i.bedrock != nil {
 		ctx, cancel := context.WithTimeout(ctx, time.Second*30)
 		defer cancel()
-		bedrockOpts, err := i.withAWSBedrockOptions(ctx, i.bedrockCfg)
+		bedrockOpts, err := i.withAWSBedrockOptions(ctx)
 		if err != nil {
 			return anthropic.MessageService{}, err
 		}
@@ -262,14 +274,13 @@ func (i *interceptionBase) withBody() option.RequestOption {
 
 // withAWSBedrockOptions returns request options for authenticating with AWS Bedrock.
 //
-// When both AccessKey and AccessKeySecret are set in the aibridge config, they are
-// used directly as static credentials. Otherwise, the AWS SDK default credential chain
-// resolves credentials (environment variables, shared config/credentials files, IAM
-// roles, IRSA, SSO, IMDS, etc.).
-func (*interceptionBase) withAWSBedrockOptions(ctx context.Context, cfg *aibconfig.AWSBedrock) ([]option.RequestOption, error) {
-	if cfg == nil {
-		return nil, xerrors.New("nil config given")
+// Credentials come from i.bedrock.Creds. It is a shared credentials cache, so the per-request Retrieve()
+// below is served from that cache and does not re-resolve or re-assume on every request.
+func (i *interceptionBase) withAWSBedrockOptions(ctx context.Context) ([]option.RequestOption, error) {
+	if i.bedrock == nil {
+		return nil, xerrors.New("nil bedrock runtime")
 	}
+	cfg := i.bedrock.Cfg
 	if cfg.Region == "" && cfg.BaseURL == "" {
 		return nil, xerrors.New("region or base url required")
 	}
@@ -280,38 +291,22 @@ func (*interceptionBase) withAWSBedrockOptions(ctx context.Context, cfg *aibconf
 		return nil, xerrors.New("small fast model required")
 	}
 
-	loadOpts := []func(*config.LoadOptions) error{
-		config.WithRegion(cfg.Region),
-	}
-
-	// Use static credentials when explicitly provided, otherwise fall back to the SDK default credential chain.
-	switch {
-	// Both set: use static credentials directly.
-	case cfg.AccessKey != "" && cfg.AccessKeySecret != "":
-		loadOpts = append(loadOpts, config.WithCredentialsProvider(
-			credentials.NewStaticCredentialsProvider(
-				cfg.AccessKey,
-				cfg.AccessKeySecret,
-				"",
-			),
-		))
-	// Only one set: misconfiguration.
-	case cfg.AccessKey != "" || cfg.AccessKeySecret != "":
-		return nil, xerrors.New("both access key and access key secret must be provided together")
-	// Neither set: SDK default credential chain resolves credentials.
-	default:
+	// Fail fast: ensure credentials can be resolved before signing. Served from
+	// the shared cache on most requests (no network); on the cold or refresh
+	// path this performs the actual STS/IMDS call.
+	if _, err := i.bedrock.Creds.Retrieve(ctx); err != nil {
+		return nil, xerrors.Errorf("resolve AWS credentials: %w", err)
 	}
 
-	awsCfg, err := config.LoadDefaultConfig(ctx, loadOpts...)
-	if err != nil {
-		return nil, xerrors.Errorf("failed to load AWS Bedrock config: %w", err)
+	// Fall back to the SDK-resolved region (e.g. from AWS_REGION) when no
+	// explicit region is configured.
+	region := cfg.Region
+	if region == "" {
+		region = i.bedrock.ResolvedRegion
 	}
-
-	// Fail fast: ensure credentials can be resolved before making any requests.
-	// awsCfg already carries the credentials provider, and the Bedrock middleware
-	// will call Retrieve on it when signing each request.
-	if _, err := awsCfg.Credentials.Retrieve(ctx); err != nil {
-		return nil, xerrors.Errorf("no AWS credentials found: %w", err)
+	awsCfg := aws.Config{
+		Region:      region,
+		Credentials: i.bedrock.Creds,
 	}
 
 	var out []option.RequestOption
@@ -336,7 +331,7 @@ func (*interceptionBase) withAWSBedrockOptions(ctx context.Context, cfg *aibconf
 // don't support adaptive thinking natively, or enabled thinking to adaptive for models that only support
 // adaptive (Opus 4.7+).
 func (i *interceptionBase) augmentRequestForBedrock() {
-	if i.bedrockCfg == nil {
+	if i.bedrock == nil {
 		return
 	}