Skip to content

Conversation

@samclark2015
Copy link
Contributor

@samclark2015 samclark2015 commented Nov 13, 2025

This PR adds infrastructure to support autoconfiguring Bedrock as a provider when:

  • used on Workbench, and
  • amazon-bedrock is in positron.assistant.enabledProviders, and
  • environment variables AWS_WEB_IDENTITY_TOKEN_FILE contains the substring 'posit-workbench'

TODO:

  • Test on real Workbench instance w/ Managed Credentials

Addresses #10179

Release Notes

New Features

  • On Workbench, AWS Bedrock is automatically enabled within Assistant when Managed Credentials are available

Bug Fixes

  • N/A

QA Notes

e2e: @:web @:assistant

Logic updated to support env var configurations, or a more complex custom logic to do the same.
@github-actions
Copy link

github-actions bot commented Nov 13, 2025

E2E Tests 🚀
This PR will run tests tagged with: @:critical @:web @:assistant

readme  valid tags

@samclark2015 samclark2015 marked this pull request as ready for review November 13, 2025 21:20
return undefined;
}

static override async autoconfigure(): Promise<AutoconfigureResult> {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you think about making the LanguageModelAutoconfigureType.Custom more specific to Workbench and refactoring this function so that the environment variables are passed with keys? This would make it straightforward to add autoconfigure functionality for other Workbench creds relying on environment variables.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried to keep this method as agnostic as possible, to allow for the possibility of other autoconfiguration mechanisms in the future (in addition to Managed Creds).

Perhaps a happy medium is a helper function to check for Managed Creds that other providers can use?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That sounds reasonable. Since we're including logic to check if we're running in PWB, can we rename autoconfigure to something that indicates this is only for Workbench?

Copy link
Contributor

@melissa-barca melissa-barca left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@samclark2015
Copy link
Contributor Author

We were able to test this locally by setting the AWS_WEB_IDENTITY_TOKEN_FILE and RS_SERVER_URL env variables, and running a web build.

Note: this is faking the setup, so testing also needs to be done in a live PWB instance; however, constraints on running a local PWB build with managed credentials that authenticate to Bedrock makes this difficult to do outside of a true PWB setup.

@samclark2015 samclark2015 merged commit 4e1d748 into main Nov 20, 2025
13 checks passed
@samclark2015 samclark2015 deleted the feature/assistant-bedrock-10179 branch November 20, 2025 22:50
@github-actions github-actions bot locked and limited conversation to collaborators Nov 20, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants