feat(goose): add support for AWS_BEARER_TOKEN_BEDROCK environment variable by andreswebs · Pull Request #6739 · block/goose

andreswebs · 2026-01-27T14:18:07Z

Summary

Add support for bearer token authentication in the AWS Bedrock provider via the AWS_BEARER_TOKEN_BEDROCK environment variable.

This change allows users to authenticate with Amazon Bedrock using a bearer token as an alternative to standard AWS credentials (IAM/SSO). When AWS_BEARER_TOKEN_BEDROCK is set, the provider uses bearer token authentication; otherwise, it falls back to the existing credential-based authentication flow.

Changes:

Add AWS_BEARER_TOKEN_BEDROCK as a new optional secret config key
Refactor client creation into create_client_with_credentials helper method
Make AWS_PROFILE optional (since bearer token auth doesn't require it)
Make AWS_REGION required at runtime when AWS_BEARER_TOKEN_BEDROCK is used
Update provider metadata description to document the new authentication option

Type of Change

AI Assistance

This PR was created or reviewed with AI assistance

Testing

Added unit tests for metadata configuration:
- Config keys count validation
- Bearer token config key presence
- Bearer token marked as secret and optional
- AWS_PROFILE marked as optional
- Provider description mentions bearer token auth
- Added integration test test_bedrock_provider_bearer_token that validates authentication flow with bearer token (requires - AWS_BEARER_TOKEN_BEDROCK and AWS_REGION env vars)

Related Issues

Relates to #6577

Copilot

Pull request overview

Adds bearer token authentication support for the Amazon Bedrock provider via AWS_BEARER_TOKEN_BEDROCK, with a fallback to the existing AWS credentials flow when the token is not set.

Changes:

Add bearer-token-based Bedrock client construction and runtime region validation when a bearer token is used.
Update Bedrock provider metadata/config keys to include AWS_BEARER_TOKEN_BEDROCK (secret) and make AWS_PROFILE/AWS_REGION optional in metadata.
Update provider integration tests to improve env handling and add a bearer-token Bedrock test case.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
crates/goose/src/providers/bedrock.rs	Implements bearer token auth path, conditional region validation, updates provider metadata, and adds metadata-focused unit tests.
crates/goose/tests/providers.rs	Refines env handling in the shared provider test helper and adds an integration test for bearer-token Bedrock auth.

crates/goose/src/providers/bedrock.rs

michaelneale · 2026-01-27T21:43:01Z

thanks @andreswebs - just wanted to confirm as a little hard to look at just diffs, but this will be fine for non bearer token cases as before - and the new stuff only kick in when there is a bearer token variable configured? is that right?

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

crates/goose/tests/providers.rs

.gooseignore

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

crates/goose/src/providers/bedrock.rs

michaelneale

Looks good - the one copilot comment on potentially filtering out AWS_BEARER_TOKEN_BEDROCK is a nice to have I think @andreswebs if you wanted to include that and test it, but otherwise LGTM

andreswebs · 2026-01-28T21:45:25Z

Awesome, thanks @michaelneale
I'll include that and re-test in a bit

michaelneale · 2026-01-29T00:40:27Z

thanks for seeing this through @andreswebs and appreciate all the permutation testing and patience!

Signed-off-by: Andre Silva <andreswebs@pm.me>

* 'main' of github.com:block/goose: (62 commits) Swap canonical model from openrouter to models.dev (#6625) Hook thinking status (#6815) Fetch new skills hourly (#6814) copilot instructions: Update "No prerelease docs" instruction (#6795) refactor: centralize audience filtering before providers receive messages (#6728) update doc to remind contributors to activate hermit and document minimal npm and node version (#6727) nit: don't spit out compaction when in term mode as it fills up the screen (#6799) fix: correct tool support detection in Tetrate provider model fetching (#6808) Session manager fixes (#6809) fix(desktop): handle quoted paths with spaces in extension commands (#6430) fix: we can default gooseignore without writing it out (#6802) fix broken link (#6810) docs: add Beads MCP extension tutorial (#6792) feat(goose): add support for AWS_BEARER_TOKEN_BEDROCK environment variable (#6739) [docs] Add OSS Skills Marketplace (#6752) feat: make skills available in codemode (#6763) Fix: Recipe Extensions Not Loading in Desktop (#6777) Different approach to determining final confidence level of prompt injection evaluation outcomes (#6729) fix: read_resource_tool deadlock causing test_compaction to hang (#6737) Upgrade error handling (#6747) ...

…sion-session * 'main' of github.com:block/goose: (78 commits) copilot instructions: Update "No prerelease docs" instruction (#6795) refactor: centralize audience filtering before providers receive messages (#6728) update doc to remind contributors to activate hermit and document minimal npm and node version (#6727) nit: don't spit out compaction when in term mode as it fills up the screen (#6799) fix: correct tool support detection in Tetrate provider model fetching (#6808) Session manager fixes (#6809) fix(desktop): handle quoted paths with spaces in extension commands (#6430) fix: we can default gooseignore without writing it out (#6802) fix broken link (#6810) docs: add Beads MCP extension tutorial (#6792) feat(goose): add support for AWS_BEARER_TOKEN_BEDROCK environment variable (#6739) [docs] Add OSS Skills Marketplace (#6752) feat: make skills available in codemode (#6763) Fix: Recipe Extensions Not Loading in Desktop (#6777) Different approach to determining final confidence level of prompt injection evaluation outcomes (#6729) fix: read_resource_tool deadlock causing test_compaction to hang (#6737) Upgrade error handling (#6747) Fix/filter audience 6703 local (#6773) chore: re-sync package-lock.json (#6783) upgrade electron to 39.3.0 (#6779) ...

* main: docs: usage data collection (#6822) feat: platform extension migrator + code mode rename (#6611) feat: CLI flag to skip loading profile extensions (#6780) Swap canonical model from openrouter to models.dev (#6625) Hook thinking status (#6815) Fetch new skills hourly (#6814) copilot instructions: Update "No prerelease docs" instruction (#6795) refactor: centralize audience filtering before providers receive messages (#6728) update doc to remind contributors to activate hermit and document minimal npm and node version (#6727) nit: don't spit out compaction when in term mode as it fills up the screen (#6799) fix: correct tool support detection in Tetrate provider model fetching (#6808) Session manager fixes (#6809) fix(desktop): handle quoted paths with spaces in extension commands (#6430) fix: we can default gooseignore without writing it out (#6802) fix broken link (#6810) docs: add Beads MCP extension tutorial (#6792) feat(goose): add support for AWS_BEARER_TOKEN_BEDROCK environment variable (#6739)

…iable (block#6739) Signed-off-by: Andre Silva <andreswebs@pm.me>

Copilot AI review requested due to automatic review settings January 27, 2026 14:18

Copilot started reviewing on behalf of andreswebs January 27, 2026 14:18 View session

andreswebs force-pushed the dev branch from 3a4faf3 to 6a6471f Compare January 27, 2026 14:23

Copilot AI reviewed Jan 27, 2026

View reviewed changes

crates/goose/src/providers/bedrock.rs Outdated Show resolved Hide resolved

crates/goose/src/providers/bedrock.rs Outdated Show resolved Hide resolved

andreswebs force-pushed the dev branch from 6a6471f to 7e1e1fb Compare January 27, 2026 14:53

michaelneale reviewed Jan 27, 2026

View reviewed changes

crates/goose/src/providers/bedrock.rs Outdated Show resolved Hide resolved

michaelneale self-assigned this Jan 27, 2026

michaelneale added the waiting label Jan 28, 2026

andreswebs force-pushed the dev branch from 7e1e1fb to 3904dc9 Compare January 28, 2026 13:10

Copilot AI review requested due to automatic review settings January 28, 2026 13:10

Copilot started reviewing on behalf of andreswebs January 28, 2026 13:11 View session

Copilot AI reviewed Jan 28, 2026

View reviewed changes

crates/goose/tests/providers.rs Show resolved Hide resolved

.gooseignore Outdated Show resolved Hide resolved

andreswebs force-pushed the dev branch from 3904dc9 to d2c9c41 Compare January 28, 2026 13:20

andreswebs requested a review from a team as a code owner January 28, 2026 13:20

andreswebs force-pushed the dev branch from d2c9c41 to e680811 Compare January 28, 2026 13:23

Copilot AI review requested due to automatic review settings January 28, 2026 13:23

Copilot started reviewing on behalf of andreswebs January 28, 2026 13:24 View session

andreswebs force-pushed the dev branch 3 times, most recently from 156322a to 7489ebf Compare January 28, 2026 13:27

Copilot AI reviewed Jan 28, 2026

View reviewed changes

crates/goose/src/providers/bedrock.rs Show resolved Hide resolved

crates/goose/src/providers/bedrock.rs Outdated Show resolved Hide resolved

michaelneale approved these changes Jan 28, 2026

View reviewed changes

feat(goose): add support for AWS_BEARER_TOKEN_BEDROCK env var

9a94126

Signed-off-by: Andre Silva <andreswebs@pm.me>

andreswebs force-pushed the dev branch from 7489ebf to 9a94126 Compare January 29, 2026 06:50

michaelneale merged commit 5290f61 into block:main Jan 29, 2026
18 checks passed

This was referenced Jan 29, 2026

chore(release): release version 1.22.0 (minor) #6812

Closed

chore(release): release version 1.22.0 (minor) #6813

Closed

Tyler-Hardin pushed a commit to Tyler-Hardin/goose that referenced this pull request Feb 11, 2026

feat(goose): add support for AWS_BEARER_TOKEN_BEDROCK environment var…

02b4432

…iable (block#6739) Signed-off-by: Andre Silva <andreswebs@pm.me>

Tyler-Hardin pushed a commit to Tyler-Hardin/goose that referenced this pull request Feb 11, 2026

feat(goose): add support for AWS_BEARER_TOKEN_BEDROCK environment var…

9865ce3

…iable (block#6739) Signed-off-by: Andre Silva <andreswebs@pm.me>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(goose): add support for AWS_BEARER_TOKEN_BEDROCK environment variable#6739

feat(goose): add support for AWS_BEARER_TOKEN_BEDROCK environment variable#6739
michaelneale merged 1 commit intoblock:mainfrom
andreswebs:dev

andreswebs commented Jan 27, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

michaelneale commented Jan 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

michaelneale left a comment

Uh oh!

andreswebs commented Jan 28, 2026

Uh oh!

michaelneale commented Jan 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

Conversation

andreswebs commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

AI Assistance

Testing

Related Issues

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

michaelneale commented Jan 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

michaelneale left a comment

Choose a reason for hiding this comment

Uh oh!

andreswebs commented Jan 28, 2026

Uh oh!

michaelneale commented Jan 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

andreswebs commented Jan 27, 2026 •

edited

Loading