feat: add AWS profile support for Bedrock credentials

[iElsha]

Pull Request Template

⚠️ Before Submitting a PR, Please Review:

• Please ensure that you have thoroughly read and understood the Contributing Docs before submitting your Pull Request.
• Done

⚠️ Documentation Updates Notice:

• Kindly note that documentation updates are managed in this repository: librechat.ai
• Done

Summary

This PR adds AWS profile support for Bedrock credentials, enabling automatic credential refresh using the AWS SDK's credential provider chain. This
improvement allows users to configure AWS profiles with optional credential_process for seamless token rotation, eliminating the need to manually
update static environment variables when credentials expire.

Key Changes:

• Added BEDROCK_AWS_PROFILE environment variable support
• Implemented AWS SDK credential provider chain following the existing S3 implementation pattern
• Updated credential loading logic to support three methods: user-provided credentials, static environment variables, and AWS profiles
• Added logging for credential source transparency
• Updated .env.example with comprehensive documentation on profile configuration and optional auto-refresh setup

Benefits:

• Automatic credential refresh for temporary credentials (no manual intervention needed)
• Follows AWS best practices for credential management
• Maintains backward compatibility with existing credential methods
• Supports IAM roles, EC2/ECS metadata, SSO, and AWS profiles

Change Type

Please delete any irrelevant options.

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

Testing

Please describe your test process and include instructions so that we can reproduce your test. If there are any important variables for your testing configuration, list them here.

Test Configuration:

Environment Variables:

BEDROCK_AWS_DEFAULT_REGION=us-west-2
BEDROCK_AWS_PROFILE=my-bedrock-profile

AWS Config (~/.aws/config):
[profile my-bedrock-profile]
region = us-west-2
credential_process = my-custom-refresh-command --format json

# This can also be   credential_process = node /path/to/LibreChat/config/get-aws-credentials.js or anything else...

Test Steps:

1. Set up AWS profile with credential_process in ~/.aws/config
2. Configure BEDROCK_AWS_PROFILE in .env file
3. Start LibreChat
4. Verify Bedrock endpoint connects successfully using profile credentials
5. Check logs confirm credential source: [Bedrock] Using AWS credential provider chain with profile: my-bedrock-profile
6. Test that credentials automatically refresh when expired

Backward Compatibility Testing:

• Verified existing static environment variable configuration still works
• Verified user-provided credentials flow unchanged
• Tested fallback to default credential provider chain when no profile specified

Checklist

Please delete any irrelevant options.

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• I have made pertinent documentation changes
• My changes do not introduce new warnings
• Local unit tests pass with my changes Test Suites: 1 skipped, 80 passed, 80 of 81 total
• A pull request for updating the documentation has been submitted.

[iElsha]

Issue: #10506

[danny-avila]

Please add corresponding documentation PR to https://github.com/LibreChat-AI/librechat.ai

[Copilot]

Pull request overview

This PR adds AWS profile support for Bedrock credentials, enabling automatic credential refresh through the AWS SDK's credential provider chain. This enhancement allows users to configure AWS profiles with optional credential_process for seamless token rotation, eliminating manual updates of static environment variables when credentials expire.

Key Changes:

• Added BEDROCK_AWS_PROFILE environment variable support for AWS profile-based authentication
• Refactored credential loading logic to support three methods: user-provided credentials, static environment variables, and AWS SDK credential provider chain
• Added comprehensive documentation in .env.example with configuration examples and AWS documentation references

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
api/server/services/Endpoints/bedrock/options.js	Refactored credential selection logic to support AWS profiles via credential provider chain, added logging for credential source transparency, and set profile property on llmConfig when applicable
.env.example	Added detailed documentation for AWS profile configuration including examples of credential_process setup and links to AWS documentation

Comments suppressed due to low confidence (2)

.env.example:172

• Corrected spelling of 'support' to 'supported'.

# The following models are not support due to not supporting streaming:

.env.example:175

• Corrected spelling of 'support' to 'supported'.

# The following models are not support due to not supporting conversation history:

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

[iElsha]

Please add corresponding documentation PR to https://github.com/LibreChat-AI/librechat.ai

That was already done - LibreChat-AI/librechat.ai#443

[danny-avila]

Hi @iElsha I can review/merge this soon. thanks for your patience. Also sent you a message on Discord so we can collaborate on better AWS compatibility