mirror of
https://github.com/simstudioai/sim.git
synced 2026-10-24 23:06:59 +08:00
feat(providers): server-side credential hiding for Azure and Bedrock (#3884)
* fix: allow Bedrock provider to use AWS SDK default credential chain Remove hard requirement for explicit AWS credentials in Bedrock provider. When access key and secret key are not provided, the AWS SDK automatically falls back to its default credential chain (env vars, instance profile, ECS task role, EKS IRSA, SSO). Closes #3694 Signed-off-by: majiayu000 <1835304752@qq.com> * fix: add partial credential guard for Bedrock provider Reject configurations where only one of bedrockAccessKeyId or bedrockSecretKey is provided, preventing silent fallback to the default credential chain with a potentially different identity. Add tests covering all credential configuration scenarios. Signed-off-by: majiayu000 <1835304752@qq.com> * fix: clean up bedrock test lint and dead code Remove unused config parameter and dead _lastConfig assignment from mock factory. Break long mockReturnValue chain to satisfy biome line-length rule. Signed-off-by: majiayu000 <1835304752@qq.com> * fix: address greptile review feedback on PR #3708 Use BedrockRuntimeClientConfig from SDK instead of inline type. Add default return value for prepareToolsWithUsageControl mock. Signed-off-by: majiayu000 <1835304752@qq.com> * feat(providers): server-side credential hiding for Azure and Bedrock * fix(providers): revert Bedrock credential fields to required with original placeholders * fix(blocks): add hideWhenEnvSet to getProviderCredentialSubBlocks for Azure and Bedrock * fix(agent): use getProviderCredentialSubBlocks() instead of duplicating credential subblocks * fix(blocks): consolidate Vertex credential into shared factory with basic/advanced mode * fix(types): resolve pre-existing TypeScript errors across auth, secrets, and copilot * lint * improvement(blocks): make Vertex AI project ID a password field * fix(blocks): preserve vertexCredential subblock ID for backwards compatibility * fix(blocks): follow canonicalParamId pattern correctly for vertex credential subblocks * fix(blocks): keep vertexCredential subblock ID stable to preserve saved workflow state * fix(blocks): add canonicalParamId to vertexCredential basic subblock to complete the swap pair * fix types * more types --------- Signed-off-by: majiayu000 <1835304752@qq.com> Co-authored-by: majiayu000 <1835304752@qq.com> Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai>
This commit is contained in:
Waleed
co-authored by
majiayu000
Vikhyath Mondreti
majiayu000
Vikhyath Mondreti
parent
076c835ba2
commit
8527ae5d3b
@@ -45,6 +45,10 @@ app:
|
||||
NODE_ENV: "production"
|
||||
NEXT_TELEMETRY_DISABLED: "1"
|
||||
|
||||
# AWS Bedrock - when using IRSA (see serviceAccount below), the default credential chain
|
||||
# resolves automatically. Setting this hides the credential fields in the Agent block UI.
|
||||
NEXT_PUBLIC_BEDROCK_DEFAULT_CREDENTIALS: "true" # Uncomment if using Bedrock with IRSA
|
||||
|
||||
# AWS S3 Cloud Storage Configuration (RECOMMENDED for production)
|
||||
# Create S3 buckets in your AWS account and configure IAM permissions
|
||||
AWS_REGION: "us-west-2"
|
||||
|
||||
@@ -47,6 +47,17 @@ app:
|
||||
NODE_ENV: "production"
|
||||
NEXT_TELEMETRY_DISABLED: "1"
|
||||
|
||||
# Azure OpenAI / Azure Anthropic (Azure AI Foundry) — set to use server-side credentials.
|
||||
# When NEXT_PUBLIC_AZURE_CONFIGURED is true, the endpoint/key/version fields are hidden in
|
||||
# the Agent block UI so users just pick a model and run.
|
||||
AZURE_OPENAI_ENDPOINT: "" # e.g. https://your-resource.openai.azure.com
|
||||
AZURE_OPENAI_API_KEY: "" # Azure OpenAI API key
|
||||
AZURE_OPENAI_API_VERSION: "" # e.g. 2024-07-01-preview
|
||||
AZURE_ANTHROPIC_ENDPOINT: "" # Azure AI Foundry endpoint for Anthropic models
|
||||
AZURE_ANTHROPIC_API_KEY: "" # Azure Anthropic API key
|
||||
AZURE_ANTHROPIC_API_VERSION: "" # Azure Anthropic API version (e.g., 2023-06-01)
|
||||
NEXT_PUBLIC_AZURE_CONFIGURED: "true" # Set to "true" once credentials are configured above
|
||||
|
||||
# Azure Blob Storage Configuration (RECOMMENDED for production)
|
||||
# Create a storage account and containers in your Azure subscription
|
||||
AZURE_ACCOUNT_NAME: "simstudiostorageacct" # Azure storage account name
|
||||
|
||||
+24
-1
@@ -113,13 +113,24 @@ app:
|
||||
# Google Vertex AI Configuration
|
||||
VERTEX_PROJECT: "" # Google Cloud project ID for Vertex AI
|
||||
VERTEX_LOCATION: "us-central1" # Google Cloud region for Vertex AI (e.g., "us-central1")
|
||||
|
||||
|
||||
# Azure OpenAI Configuration (leave empty if not using Azure OpenAI)
|
||||
AZURE_OPENAI_ENDPOINT: "" # Azure OpenAI service endpoint (e.g., https://your-resource.openai.azure.com)
|
||||
AZURE_OPENAI_API_KEY: "" # Azure OpenAI API key
|
||||
AZURE_OPENAI_API_VERSION: "" # Azure OpenAI API version (e.g., 2024-07-01-preview)
|
||||
|
||||
# Azure Anthropic Configuration (leave empty if not using Azure Anthropic via AI Foundry)
|
||||
AZURE_ANTHROPIC_ENDPOINT: "" # Azure AI Foundry endpoint for Anthropic models
|
||||
AZURE_ANTHROPIC_API_KEY: "" # Azure Anthropic API key
|
||||
AZURE_ANTHROPIC_API_VERSION: "" # Azure Anthropic API version (e.g., 2023-06-01)
|
||||
|
||||
# AI Provider API Keys (leave empty if not using)
|
||||
OPENAI_API_KEY: "" # Primary OpenAI API key
|
||||
OPENAI_API_KEY_1: "" # Additional OpenAI API key for load balancing
|
||||
OPENAI_API_KEY_2: "" # Additional OpenAI API key for load balancing
|
||||
OPENAI_API_KEY_3: "" # Additional OpenAI API key for load balancing
|
||||
MISTRAL_API_KEY: "" # Mistral AI API key
|
||||
FIREWORKS_API_KEY: "" # Fireworks AI API key (for hosted model access)
|
||||
ANTHROPIC_API_KEY_1: "" # Primary Anthropic Claude API key
|
||||
ANTHROPIC_API_KEY_2: "" # Additional Anthropic API key for load balancing
|
||||
ANTHROPIC_API_KEY_3: "" # Additional Anthropic API key for load balancing
|
||||
@@ -223,6 +234,18 @@ app:
|
||||
SSO_ENABLED: "" # Enable SSO authentication ("true" to enable)
|
||||
NEXT_PUBLIC_SSO_ENABLED: "" # Show SSO login button in UI ("true" to enable)
|
||||
|
||||
# AWS Bedrock Credential Mode
|
||||
# Set to "true" when the deployment uses AWS default credential chain (IAM roles, instance
|
||||
# profiles, ECS task roles, IRSA, etc.) instead of explicit access key/secret per workflow.
|
||||
# When enabled, the AWS Access Key ID and Secret fields are hidden in the Agent block UI.
|
||||
NEXT_PUBLIC_BEDROCK_DEFAULT_CREDENTIALS: "" # Set to "true" to hide Bedrock credential fields
|
||||
|
||||
# Azure Provider Credential Mode
|
||||
# Set to "true" when AZURE_OPENAI_ENDPOINT/API_KEY (and/or AZURE_ANTHROPIC_*) are configured
|
||||
# server-side. When enabled, the Azure endpoint, API key, and API version fields are hidden
|
||||
# in the Agent block UI — users just pick an Azure model and run.
|
||||
NEXT_PUBLIC_AZURE_CONFIGURED: "" # Set to "true" to hide Azure credential fields
|
||||
|
||||
# AWS S3 Cloud Storage Configuration (optional - for file storage)
|
||||
# If configured, files will be stored in S3 instead of local storage
|
||||
AWS_REGION: "" # AWS region (e.g., "us-east-1")
|
||||
|
||||
Reference in New Issue
Block a user