assumed role support for bedrock application inference profile #1131
Conversation
|
DescriptionSummary By MatterAI
🔄 What ChangedThis pull request introduces support for AWS assumed roles when fetching Bedrock application inference profiles. The 🔍 Impact of the ChangeThis change enables applications to use AWS assumed roles for authenticating with Bedrock, enhancing security and flexibility by allowing temporary, role-based credentials. It simplifies the 📁 Total Files Changed1 file changed ( 🧪 Test AddedWhile specific test files are not provided in the patch, it is assumed that unit tests have been added or updated to cover the new assumed role authentication flow within
🔒Security VulnerabilitiesNo new security vulnerabilities were detected. The change enhances security by supporting AWS assumed roles, which is a best practice for managing temporary, least-privilege access. MotivationTo enable applications to use AWS assumed roles for authenticating with Bedrock, providing a more secure and flexible authentication mechanism. Type of Change
How Has This Been Tested?
Screenshots (if applicable)N/A Checklist
Related IssuesN/A Tip Quality Recommendations
Sequence DiagramsequenceDiagram
participant Caller as getFoundationModelFromInferenceProfile()
participant GIP as getInferenceProfile(inferenceProfileIdentifier, providerOptions, c)
participant GAC as getAssumedRoleCredentials(c, awsRoleArn, awsExternalId, awsRegion)
participant BedrockAPI as Bedrock API (bedrock.aws.com)
Caller->>GIP: Call getInferenceProfile(inferenceProfileIdentifier, { ...providerOptions }, c)
activate GIP
GIP->>GIP: Check providerOptions.awsAuthType
alt If awsAuthType is 'assumedRole'
GIP->>GAC: Request assumed role credentials (c, providerOptions.awsRoleArn, providerOptions.awsExternalId, providerOptions.awsRegion)
activate GAC
GAC-->>GIP: Return { accessKeyId, secretAccessKey, sessionToken } or {}
deactivate GAC
GIP->>GIP: Update local providerOptions copy with obtained credentials
end
GIP->>GIP: Extract awsRegion, awsAccessKeyId, awsSecretAccessKey, awsSessionToken from providerOptions
GIP->>GIP: Construct Bedrock API URL: `https://bedrock.${awsRegion}.amazonaws.com/inference-profiles/${encodedIdentifier}`
GIP->>GIP: Generate AWS Headers using extracted credentials
GIP->>BedrockAPI: HTTP GET Request to Bedrock Inference Profile API
activate BedrockAPI
BedrockAPI-->>GIP: Return Inference Profile Data
deactivate BedrockAPI
GIP-->>Caller: Return Inference Profile
deactivate GIP
|
|
Important PR Review SkippedPR review skipped as per the configuration setting. Run a manually review by commenting /matter review 💡Tips to use Matter AICommand List
|
92373cb to
d9a3459
Compare
|
Important PR Review SkippedPR review skipped as per the configuration setting. Run a manually review by commenting /matter review 💡Tips to use Matter AICommand List
|
No description provided.