github/codex
4
0 Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-10 08:43:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add AWS credential export commands for Amazon Bedrock (#44028)

Browse Source 
## What changed

Support `model_providers.amazon-bedrock.aws.credential_export` with `command`, `args`, and `timeout_ms` to supply SigV4 signing credentials from a command's JSON output. Accept both flat credential-process output and nested STS `Credentials` objects.

Cache credentials in memory, refresh before expiration, and share exports across sessions with matching AWS configuration. On recoverable authentication failures, run the optional `aws.auth_refresh` command before exporting fresh credentials, coalescing concurrent recovery attempts.

Bound command execution time and output size, and keep credential values out of errors. Reject combining `aws.credential_export` with `aws.profile`. Bedrock setup and login reject changes while an exporter is configured, preserving configuration and saved credentials.

## Testing

Add coverage for output formats, expiration, credential precedence, caching, concurrent recovery, command failures, and secret redaction. Integration tests verify request signing with rotated credentials, bounded recovery attempts, and setup/login rejection across configuration layers.

GitOrigin-RevId: 4ef799f88ab5e3b2578f8f41a5e56e4f30e2cd81
This commit is contained in:
alexsong-oai authored and copyberry committed 2026-09-09 03:17:48 +00:00
1 parent 2ce38ae6d8
commit fe52d795c9
26 files changed
+1790 -89
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

codex-rs/core/src/config/config_tests.rs
+1 -1
View File
@@ -1241,7 +1241,7 @@ supports_websockets = true
assert_eq!(err.kind(), std::io::ErrorKind::InvalidData);
assert!(err.to_string().contains(
"model_providers.amazon-bedrock only supports changing `base_url`, `auth`, `http_headers`, `aws.profile`, `aws.region`, and `aws.auth_refresh`; other non-default provider fields are not supported"
"model_providers.amazon-bedrock only supports changing `base_url`, `auth`, `http_headers`, `aws.profile`, `aws.region`, `aws.credential_export`, and `aws.auth_refresh`; other non-default provider fields are not supported"
));
}