elsodiop commented on PR #13249:
URL: https://github.com/apache/apisix/pull/13249#issuecomment-5059804671
Hello,
ai-proxy accepts $secret:// references in auth.aws, but the Bedrock provider
passes access_key_id directly to the SigV4 signer without resolving the secret
first. The signer therefore builds the credential scope using the literal
secret URI.
I created a Bedrock toute with:
- name: ai-proxy
enable: true
config:
provider: bedrock
auth:
aws:
access_key_id:
"$secret://aws/xxxxxxxx/secret-name/access-key-id"
secret_access_key:
"$secret://aws/xxxx/secret-name/secret-access-key"
provider_conf:
region: us-east-1
options:
model: anthropic.claude-3-5-sonnet-20240620-v1:0
When i test my route i get {"message":"Credential must have exactly 5
slash-delimited elements, e.g. keyid/date/region/service/term, got
'$secret://aws/xxxx/secret-name/access-key-id/20260723/us-east-1/bedrock/aws4_request'"}
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
