amazon-bedrock provider not autoloaded with an EC2 instance role (IMDS) #35798

Description

Running opencode on an EC2 instance that only has an IAM role attached (no AWS env vars, no profile, no bearer token) never enables the amazon-bedrock provider, so requests fail with:

AWS SigV4 authentication requires AWS credentials ... AWS access key ID setting is missing.

The autoload check in packages/opencode/src/provider/provider.ts only turns the provider on when it finds one of: AWS_PROFILE, AWS_ACCESS_KEY_ID, a bearer token, a config apiKey, AWS_WEB_IDENTITY_TOKEN_FILE (EKS/IRSA), or AWS_CONTAINER_CREDENTIALS_* (ECS). Otherwise it returns { autoload: false }. A plain EC2 instance role over IMDS is not in that list, so ECS and EKS work but a normal EC2 instance role does not.

What's odd is the credential resolution right below that check already calls fromNodeProviderChain(), which resolves instance-role creds from IMDS without any problem. So only the detection gate is missing the case.

Workaround that works today: set AWS_PROFILE=default. That gets past the gate, and fromNodeProviderChain then picks up the role from IMDS.

Possible fix: add an EC2 instance-role signal to that gate (a cheap EC2 check plus a short IMDSv2 probe, honoring AWS_EC2_METADATA_DISABLED), the same way ECS and EKS are already handled. Happy to open a PR if that approach works for you.

Related: #12984 fixed the config credential-chain path and is closed. #17777 reported the same thing but was auto-closed for not using the [FEATURE]: title prefix.

Steps to reproduce

1. EC2 instance with an IAM role that allows bedrock:InvokeModel, and no AWS creds in env or profile
2. Point opencode at an amazon-bedrock/... model
3. Run a prompt, it fails with the SigV4 "access key ID missing" error

OpenCode version

1.17.15

Operating System

Ubuntu 24.04