How can I use the IAM role attached to EC2 instance for access to AWS Bedrock?

[avx-rodmans]

I have deployed LibreChat via an AWS EC2 instance. I want to enable access to AWS Bedrock. I attached a policy to the instance and confirmed it's working by running aws bedrock list-foundation-models --region us-east-1.

My .env file includes this:

BEDROCK_AWS_DEFAULT_REGION=us-east-1 # A default region must be provided
# BEDROCK_AWS_ACCESS_KEY_ID=
# BEDROCK_AWS_SECRET_ACCESS_KEY=
# BEDROCK_AWS_SESSION_TOKEN=someSessionToken

However, I am getting an error that there are no credentials.

{"level":"error","message":"[handleAbortError] AI response error; aborting request: Could not load credentials from any providers","name":"CredentialsProviderError","pregelTaskId":"cecadb15-b357-520b-be49-aca2515cd3a0","stack":"CredentialsProviderError: Could not load credentials from any providers\n    at /app/node_modules/@aws-sdk/credential-provider-node/dist-cjs/index.js:136:13\n    at /app/node_modules/@smithy/property-provider/dist-cjs/index.js:97:33\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at async coalesceProvider (/app/node_modules/@smithy/property-provider/dist-cjs/index.js:124:18)\n    at async /app/node_modules/@smithy/property-provider/dist-cjs/index.js:142:18\n    at async coalesceProvider (/app/node_modules/@smithy/core/dist-cjs/index.js:290:18)\n    at async /app/node_modules/@smithy/core/dist-cjs/index.js:308:18\n    at async /app/node_modules/@smithy/core/dist-cjs/index.js:82:17\n    at async /app/node_modules/@aws-sdk/middleware-logger/dist-cjs/index.js:34:22\n    at async ChatBedrockConverse._streamResponseChunks (/app/node_modules/@langchain/aws/dist/chat_models.cjs:695:26)","tryNextLink":false}

According to the docs, I should be able to use the EC2/ECS Instance Metadata Service for authentication right? Am I misunderstanding this?

[danny-avila]

The docs answer this:

Doing so prompts the credential provider to find credentials from the following sources (listed in order of precedence):

Environment variables exposed via process.env
SSO credentials from token cache
Web identity token credentials
Shared credentials and config ini files
The EC2/ECS Instance Metadata Service

The default credential provider will invoke one provider at a time and only continue to the next if no credentials have been located.

For example, if the process finds values defined via the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, the files at ~/.aws/credentials and ~/.aws/config will not be read, nor will any messages be sent to the Instance Metadata Service.

So you may need to mount or make those directories available if they are not already to your instance

[danny-avila]

This was also answered here regarding a specific Fargate deployment:

#406 (reply in thread)