ffb6029c2d
## Summary - `buildBedrockProvider` ignored `authType: "role"` and only honored static `accessKeyId`/`secretAccessKey` pairs, so deployments relying on IRSA (e.g. EKS pods with `AWS_WEB_IDENTITY_TOKEN_FILE` + `AWS_ROLE_ARN`) had no way to authenticate — `@ai-sdk/amazon-bedrock` does not walk the AWS default credential chain on its own. - When `authType === 'role'`, wire `fromNodeProviderChain()` from `@aws-sdk/credential-providers` (already a server dependency, used by the S3 and logic-function drivers) into `createAmazonBedrock` so IRSA and other ambient AWS credentials resolve correctly. - The static-credentials path is unchanged for `authType !== 'role'`. ## Test plan - [ ] Deploy a server pod with IRSA + an `ai-models-config` entry using `"authType": "role"` and verify Bedrock calls succeed (no `Could not load credentials from any providers` error). - [ ] Verify static-credentials providers (`accessKeyId` + `secretAccessKey`) still work as before. - [ ] `npx nx lint:diff-with-main twenty-server` passes. - [ ] `npx nx typecheck twenty-server` passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>