[Feat]: add AWS STS assume-role and SigV4 signing for Bedrock

cli/planoai/config_generator.py

@@ -192,6 +192,7 @@ def validate_and_render_schema():
     llms_with_usage = []
     model_name_keys = set()
     model_usage_name_keys = set()
+    bedrock_providers_present = False
 
     print("listeners: ", listeners)
 
@@ -240,6 +241,8 @@ def validate_and_render_schema():
                     f"Invalid model name {model_name}. Please provide model name in the format <provider>/<model_id> or <provider>/* for wildcards."
                 )
             provider = model_name_tokens[0].strip()
+            if provider == "amazon_bedrock":
+                bedrock_providers_present = True
 
             # Check if this is a wildcard (provider/*)
             is_wildcard = model_name_tokens[-1].strip() == "*"
@@ -436,6 +439,20 @@ def validate_and_render_schema():
                     f"Model alias 2 - '{alias_name}' targets '{target}' which is not defined as a model. Available models: {', '.join(sorted(model_name_keys))}"
                 )
 
+    aws_credentials_config = {}
+    for key in ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]:
+        value = os.getenv(key)
+        if value:
+            aws_credentials_config[key] = value
+
+    if aws_credentials_config:
+        config_yaml["aws_credentials"] = aws_credentials_config
+        if not bedrock_providers_present:
+            print(
+                "WARNING: AWS credentials were detected but no amazon_bedrock model_providers were found. "
+                "These credentials will be unused unless Bedrock providers are configured."
+            )
+
     arch_config_string = yaml.dump(config_yaml)
     arch_llm_config_string = yaml.dump(config_yaml)
 

config/arch_config_schema.yaml

@@ -128,6 +128,16 @@ properties:
               timeout:
                 type: string
             additionalProperties: false
+  aws_credentials:
+    type: object
+    properties:
+      AWS_ACCESS_KEY_ID:
+        type: string
+      AWS_SECRET_ACCESS_KEY:
+        type: string
+      AWS_SESSION_TOKEN:
+        type: string
+    additionalProperties: false
   endpoints:
     type: object
     patternProperties:

crates/common/Cargo.toml

@@ -20,9 +20,24 @@ urlencoding = "2.1.3"
 url = "2.5.4"
 hermesllm = { version = "0.1.0", path = "../hermesllm" }
 serde_with = "3.13.0"
+aws-sigv4 = { version = "1", optional = true }
+aws-credential-types = { version = "1", optional = true }
+aws-types = { version = "1", optional = true }
+http = { version = "1", optional = true }
+bytes = { version = "1", optional = true }
+aws-smithy-runtime-api = { version = "1.9", optional = true }
 
 [features]
 default = []
+trace-collection = ["tokio", "reqwest", "tracing"]
+aws-sigv4 = [
+  "dep:aws-sigv4",
+  "dep:aws-credential-types",
+  "dep:aws-types",
+  "dep:http",
+  "dep:bytes",
+  "dep:aws-smithy-runtime-api",
+]
 
 [dev-dependencies]
 pretty_assertions = "1.4.1"

crates/common/src/aws_credentials.rs

@@ -0,0 +1,24 @@
+use crate::configuration::AwsCredentialsConfig;
+use crate::errors::AwsError;
+
+pub fn get_credentials_from_config(
+    config: &AwsCredentialsConfig,
+) -> Result<(String, String, Option<String>), AwsError> {
+    let access_key_id = config
+        .access_key_id
+        .as_ref()
+        .ok_or_else(|| AwsError::CredentialError("AWS_ACCESS_KEY_ID not found".to_string()))?
+        .clone();
+
+    let secret_access_key = config
+        .secret_access_key
+        .as_ref()
+        .ok_or_else(|| AwsError::CredentialError("AWS_SECRET_ACCESS_KEY not found".to_string()))?
+        .clone();
+
+    Ok((
+        access_key_id,
+        secret_access_key,
+        config.session_token.clone(),
+    ))
+}