Bedrock Mantle without the AWS SDK — #35 with environment credentials - #37
Open
alexshapalov wants to merge 2 commits into
Open
Bedrock Mantle without the AWS SDK — #35 with environment credentials#37alexshapalov wants to merge 2 commits into
alexshapalov wants to merge 2 commits into
Conversation
…onment credentials Reworks #35 per the maintainer's decision to keep the no-vendor-SDK rule. The routing (openai.* via the Responses API, anthropic.* via the Messages API), regional endpoint restriction, redirect refusal, token format, and tests are the contributor's; what changes: - aws-sdk-go-v2 and its 13 transitive modules are gone (binary back from 30.0 to 26.9 MB). Bedrock's bearer token is a SigV4 query-presigned URL, so it is minted by ~100 lines over crypto/hmac; the PR's golden-signature test from AWS's reference generator pins the two implementations to the same token. - Credentials come only from the environment: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, with AWS_CREDENTIAL_EXPIRATION (emitted by `aws configure export-credentials --format env`) bounding the token. No profiles, config files, STS, SSO, or instance metadata. The missing-credentials error names the export command. - The "no vendor SDKs" package doc, the fantasy/binary-size rationale, and the "keys only from the environment, enforced once" doc are restored, with Bedrock added; README and CHANGELOG describe the environment model. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013qGZKWgfGTBCoHsDjy1SuB
Contributor
|
Thanks for building on this. I’m happy with keeping the implementation SDK-free, but environment-only credentials leave a gap for my deployment: pgbot will run as a long-lived MCP server in ECS using its task IAM role. ECS exposes those credentials through Would you be open to adding ECS task-role credential retrieval and automatic refresh using the standard HTTP client? We could keep profile/SSO resolution out of scope and preserve the no-SDK approach while supporting unattended ECS deployments. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Carries #35 by @edwardsb (commit 2998a37, unchanged) plus one commit that removes the AWS SDK dependency per the maintainer's decision to keep pgbot's no-vendor-SDK rule. See the discussion on #35.
What stays from #35: GPT/Claude routing, the regional Mantle endpoint restriction, redirect refusal, the bearer-token format, and the tests (including the golden signature from AWS's reference generator, which now pins the standard-library presigner to the same output).
What changes: credentials come from
AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_SESSION_TOKEN(bounded byAWS_CREDENTIAL_EXPIRATION), whichaws configure export-credentials --format envproduces for any profile, SSO login, or assumed role.AWS_BEARER_TOKEN_BEDROCKandPGBOT_AI_API_KEYstill work as before. No profiles, config files, STS, SSO, or instance metadata. Binary size 30.0 MB back to 26.9 MB; go.mod gains nothing.The contributor's fork is organization-owned, so this could not be pushed to #35's branch. Merging this lands #35's commit and marks it merged.
Closes #35.
🤖 Generated with Claude Code
https://claude.ai/code/session_013qGZKWgfGTBCoHsDjy1SuB