feat: Add support for credential providers (#7)

Author: ejunker

README.md

@@ -28,9 +28,15 @@ Add the following to your Prism configuration (`config/prism.php`):
 
 ```php
 'bedrock' => [ // Key should match Bedrock::KEY
-    'api_key' => env('AWS_ACCESS_KEY_ID'),
-    'api_secret' => env('AWS_SECRET_ACCESS_KEY'),
     'region' => env('AWS_REGION', 'us-east-1')
+
+    // Set to true to ignore other auth configuration and use the AWS SDK default credential chain
+    // read more at https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials_default_chain.html
+    'use_default_credential_provider' => env('AWS_USE_DEFAULT_CREDENTIAL_PROVIDER', false), 
+
+    'api_key' => env('AWS_ACCESS_KEY_ID'), //  Ignored with `use_default_credential_provider` === true
+    'api_secret' => env('AWS_SECRET_ACCESS_KEY'), //  Ignored with `use_default_credential_provider` === true
+    'session_token' => env('AWS_SESSION_TOKEN'), // Only required for temporary credentials. Ignored with `use_default_credential_provider` === true
 ],
 ```
 

src/Bedrock.php

@@ -24,8 +24,7 @@ class Bedrock implements Provider
     const KEY = 'bedrock';
 
     public function __construct(
-        #[\SensitiveParameter] protected string $apiKey,
-        #[\SensitiveParameter] protected string $apiSecret,
+        #[\SensitiveParameter] protected Credentials $credentials,
         protected string $region
     ) {}
 
@@ -141,10 +140,7 @@ protected function client(TextRequest|StructuredRequest|EmbeddingRequest $reques
 
                 $signature = new SignatureV4('bedrock', $this->region);
 
-                return $signature->signRequest($request, new Credentials(
-                    key: $this->apiKey,
-                    secret: $this->apiSecret
-                ));
+                return $signature->signRequest($request, $this->credentials);
             })
             ->throw();
     }

src/BedrockServiceProvider.php

@@ -2,6 +2,8 @@
 
 namespace Prism\Bedrock;
 
+use Aws\Credentials\CredentialProvider;
+use Aws\Credentials\Credentials;
 use Illuminate\Support\ServiceProvider;
 
 class BedrockServiceProvider extends ServiceProvider
@@ -11,11 +13,28 @@ public function boot(): void
         $this->registerWithPrism();
     }
 
+    /**
+     * @param  array<string,mixed>  $config
+     */
+    public static function getCredentials(array $config): Credentials
+    {
+        if ($config['use_default_credential_provider'] ?? false) {
+            $provider = CredentialProvider::defaultProvider();
+        } else {
+            $provider = CredentialProvider::fromCredentials(new Credentials(
+                key: $config['api_key'],
+                secret: $config['api_secret'],
+                token: $config['session_token'] ?? null,
+            ));
+        }
+
+        return $provider()->wait();
+    }
+
     protected function registerWithPrism(): void
     {
         $this->app->get('prism-manager')->extend(Bedrock::KEY, fn ($app, $config): \Prism\Bedrock\Bedrock => new Bedrock(
-            apiKey: $config['api_key'],
-            apiSecret: $config['api_secret'],
+            credentials: BedrockServiceProvider::getCredentials($config),
             region: $config['region']
         ));
     }