fix(ai): provide mechanism to connect to unauthenticated bedrock proxies (#1320)

fixes #1309

packages/ai/src/providers/amazon-bedrock.ts

@@ -90,6 +90,14 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream", BedrockOpt
 			profile: options.profile,
 		};
 
+		// Support proxies that don't need authentication
+		if (process.env.AWS_BEDROCK_SKIP_AUTH === "1") {
+			config.credentials = {
+				accessKeyId: "dummy-access-key",
+				secretAccessKey: "dummy-secret-key",
+			};
+		}
+
 		// in Node.js/Bun environment only
 		if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
 			config.region = config.region || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION;
@@ -114,6 +122,10 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream", BedrockOpt
 					httpAgent: agent,
 					httpsAgent: agent,
 				});
+			} else if (process.env.AWS_BEDROCK_FORCE_HTTP1 === "1") {
+				// Some custom endpoints require HTTP/1.1 instead of HTTP/2
+				const nodeHttpHandler = await import("@smithy/node-http-handler");
+				config.requestHandler = new nodeHttpHandler.NodeHttpHandler();
 			}
 		}
 

packages/coding-agent/docs/providers.md

@@ -140,6 +140,20 @@ Also supports ECS task roles (`AWS_CONTAINER_CREDENTIALS_*`) and IRSA (`AWS_WEB_
 pi --provider amazon-bedrock --model us.anthropic.claude-sonnet-4-20250514-v1:0
 ```
 
+If you are connecting to a bedrock API proxy, the following environment variables can be used
+instead:
+
+```bash
+# Set the URL for the bedrock proxy
+export AWS_ENDPOINT_URL_BEDROCK_RUNTIME
+
+# Set if your proxy does not require authentication
+export AWS_BEDROCK_SKIP_AUTH=1
+
+# Set if your proxy only supports HTTP 1.1
+export AWS_BEDROCK_FORCE_HTTP1=1
+```
+
 ### Google Vertex AI
 
 Uses Application Default Credentials: