Skip to content

amazon-bedrock provider may not support EC2 Instance Metadata (IMDSv2) as a credential source #17777

Closed as not planned

Description

@amanzw

Feature hasn't been suggested before.

  • I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Summary
When running OpenCode on an EC2 instance with an IAM Instance Profile (EC2 Role), the amazon-bedrock provider doesn't seem to load properly.

Background
I'm running OpenCode on an EC2 instance that has an IAM Instance Profile attached. IMDSv2 is enforced on the instance (IMDSv1 is disabled, which is the current AWS default for new instances). No explicit AWS credentials are configured — the expectation is that the AWS SDK would automatically discover credentials via the Instance Metadata Service, as it does with other AWS tools and SDKs.
However, without manually injecting credentials via environment variables, the amazon-bedrock provider does not appear to load and Bedrock models are unavailable.

Looking at the provider initialization code, there appears to be a guard condition along the lines of:
if (!profile && !awsAccessKeyId && !awsBearerToken && !awsWebIdentityTokenFile && !containerCreds)
return { autoload: false };
If this is indeed the case, EC2 Instance Metadata would not be among the recognized credential sources, causing the provider to exit early before fromNodeProviderChain() ever gets a chance to resolve credentials via IMDS — even though the bundled @smithy/credential-provider-imds package appears to support IMDSv2.
That said, I may be misreading the code or missing something. Is this the intended behavior, or could this be a gap in credential source coverage?

Environment

  • Running on: EC2 instance with IAM Instance Profile
  • IMDSv1: disabled (IMDSv2 only)
  • OpenCode installed via npm install -g opencode-ai
  • Bundled credential provider: @smithy/[email protected]

Activity

  1. added
    discussionUsed for feature requests, proposals, ideas, etc. Open discussion
    on Mar 16, 2026
  2. added
    coreAnything pertaining to core functionality of the application (opencode server stuff)
    on Mar 16, 2026
  3. github-actions commented on Mar 16, 2026

    @github-actions
    Contributor

    This issue doesn't fully meet our contributing guidelines.

    What needs to be fixed:

    • Feature request titles must start with [FEATURE]: (e.g. [FEATURE]: amazon-bedrock provider may not support EC2 Instance Metadata (IMDSv2) as a credential source)

    Please edit this issue to address the above within 2 hours, or it will be automatically closed.


    This issue might be a duplicate of existing issues. Please check:

    If you believe this was flagged incorrectly, please let a maintainer know.

  4. github-actions commented on Mar 16, 2026

    @github-actions
    Contributor

    This issue has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

    Feel free to open a new issue that follows our issue templates.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

coreAnything pertaining to core functionality of the application (opencode server stuff)discussionUsed for feature requests, proposals, ideas, etc. Open discussion

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions