You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
amazon-bedrock provider may not support EC2 Instance Metadata (IMDSv2) as a credential source #17777
I have verified this feature I'm about to request hasn't been suggested before.
Describe the enhancement you want to request
Summary
When running OpenCode on an EC2 instance with an IAM Instance Profile (EC2 Role), the amazon-bedrock provider doesn't seem to load properly.
Background
I'm running OpenCode on an EC2 instance that has an IAM Instance Profile attached. IMDSv2 is enforced on the instance (IMDSv1 is disabled, which is the current AWS default for new instances). No explicit AWS credentials are configured — the expectation is that the AWS SDK would automatically discover credentials via the Instance Metadata Service, as it does with other AWS tools and SDKs.
However, without manually injecting credentials via environment variables, the amazon-bedrock provider does not appear to load and Bedrock models are unavailable.
Looking at the provider initialization code, there appears to be a guard condition along the lines of:
if (!profile && !awsAccessKeyId && !awsBearerToken && !awsWebIdentityTokenFile && !containerCreds)
return { autoload: false };
If this is indeed the case, EC2 Instance Metadata would not be among the recognized credential sources, causing the provider to exit early before fromNodeProviderChain() ever gets a chance to resolve credentials via IMDS — even though the bundled @smithy/credential-provider-imds package appears to support IMDSv2.
That said, I may be misreading the code or missing something. Is this the intended behavior, or could this be a gap in credential source coverage?
Environment
Running on: EC2 instance with IAM Instance Profile
Feature request titles must start with [FEATURE]: (e.g. [FEATURE]: amazon-bedrock provider may not support EC2 Instance Metadata (IMDSv2) as a credential source)
Please edit this issue to address the above within 2 hours, or it will be automatically closed.
This issue might be a duplicate of existing issues. Please check:
Activity
github-actions commentedon Mar 16, 2026
This issue doesn't fully meet our contributing guidelines.
What needs to be fixed:
[FEATURE]:(e.g.[FEATURE]: amazon-bedrock provider may not support EC2 Instance Metadata (IMDSv2) as a credential source)Please edit this issue to address the above within 2 hours, or it will be automatically closed.
This issue might be a duplicate of existing issues. Please check:
If you believe this was flagged incorrectly, please let a maintainer know.
github-actions commentedon Mar 16, 2026
This issue has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.
Feel free to open a new issue that follows our issue templates.