Module: OpenAI::Providers

Defined in:

lib/openai/providers/bedrock.rb,
sig/openai/providers.rbs

Defined Under Namespace

Modules: Bedrock

Class Method Summary

• .bedrock(region: nil, base_url: OpenAI::Internal::OMIT, api_key: OpenAI::Internal::OMIT, token_provider: nil, access_key_id: nil, secret_access_key: nil, session_token: nil, profile: nil, credentials_provider: nil) ⇒ OpenAI::Provider

  Configure the standard OpenAI client for Amazon Bedrock Mantle.

Class Method Details

.bedrock(region: nil, base_url: OpenAI::Internal::OMIT, api_key: OpenAI::Internal::OMIT, token_provider: nil, access_key_id: nil, secret_access_key: nil, session_token: nil, profile: nil, credentials_provider: nil) ⇒ OpenAI::Provider

Configure the standard OpenAI client for Amazon Bedrock Mantle.

Authentication precedence is an explicit bearer or AWS mode, then AWS_BEARER_TOKEN_BEDROCK, then the standard AWS credential chain.

Parameters:

• region (String, nil) (defaults to: nil) —

  AWS signing region. Defaults to AWS_REGION, AWS_DEFAULT_REGION, or the selected profile's configured region.

• base_url (String, nil) (defaults to: OpenAI::Internal::OMIT) —

  Bedrock API root. Defaults to AWS_BEDROCK_BASE_URL or the regional Bedrock Mantle endpoint.

• api_key (String, nil) (defaults to: OpenAI::Internal::OMIT) —

  Explicit Bedrock bearer credential. Passing nil explicitly skips the AWS_BEARER_TOKEN_BEDROCK fallback.

• token_provider (#call, nil) (defaults to: nil) —

  Callable returning a fresh bearer credential before each request attempt.

• access_key_id (String, nil) (defaults to: nil) —

  Explicit AWS access key ID. Must be paired with secret_access_key.

• secret_access_key (String, nil) (defaults to: nil) —

  Explicit AWS secret access key.

• session_token (String, nil) (defaults to: nil) —

  Optional session token for explicit temporary AWS credentials.

• profile (String, nil) (defaults to: nil) —

  Explicit AWS shared-config profile.

• credentials_provider (#credentials, #call, nil) (defaults to: nil) —

  Refreshable AWS credentials provider. A callable must return an AWS credential identity.

Returns:

• (OpenAI::Provider)

# File 'lib/openai/providers/bedrock.rb', line 374

def bedrock(
  region: nil,
  base_url: OpenAI::Internal::OMIT,
  api_key: OpenAI::Internal::OMIT,
  token_provider: nil,
  access_key_id: nil,
  secret_access_key: nil,
  session_token: nil,
  profile: nil,
  credentials_provider: nil
)
  normalized_region = Bedrock.normalize_optional_string(region)
  if !region.nil? && normalized_region.nil?
    raise ArgumentError, "The Bedrock AWS `region` must not be empty."
  end
  normalized_region ||= Bedrock.normalize_optional_string(ENV["AWS_REGION"]) ||
                        Bedrock.normalize_optional_string(ENV["AWS_DEFAULT_REGION"])

  normalized_profile = Bedrock.normalize_optional_string(profile)
  if !profile.nil? && normalized_profile.nil?
    raise ArgumentError, "The Bedrock AWS `profile` must not be empty."
  end

  configured_base_url =
    if base_url.equal?(OpenAI::Internal::OMIT)
      Bedrock.normalize_optional_string(ENV["AWS_BEDROCK_BASE_URL"])
    elsif base_url.nil?
      nil
    else
      normalized = Bedrock.normalize_optional_string(base_url)
      raise(ArgumentError, "The Bedrock `base_url` must not be empty.") unless normalized
      normalized
    end
  configured_base_url = Bedrock.normalize_base_url(configured_base_url) if configured_base_url

  has_access_key = !access_key_id.nil?
  has_secret_key = !secret_access_key.nil?
  if has_access_key != has_secret_key || (!session_token.nil? && !has_access_key)
    raise ArgumentError, Bedrock::PARTIAL_STATIC_CREDENTIALS_MESSAGE
  end
  normalized_access_key_id = Bedrock.normalize_optional_string(access_key_id)
  normalized_secret_access_key = Bedrock.normalize_optional_string(secret_access_key)
  normalized_session_token = Bedrock.normalize_optional_string(session_token)
  if has_access_key && [normalized_access_key_id, normalized_secret_access_key].any?(&:nil?)
    raise ArgumentError,
          "Static AWS credentials require non-empty `access_key_id` and `secret_access_key` values."
  end
  if !session_token.nil? && normalized_session_token.nil?
    raise ArgumentError, "A static AWS `session_token` must not be empty when provided."
  end

  explicit_api_key = !api_key.equal?(OpenAI::Internal::OMIT) && !api_key.nil?
  normalized_api_key = Bedrock.normalize_optional_string(api_key)
  if explicit_api_key && normalized_api_key.nil?
    raise ArgumentError, "The Bedrock bearer credential must not be empty."
  end
  if explicit_api_key && !token_provider.nil?
    raise ArgumentError,
          "The `api_key` and `token_provider` options are mutually exclusive. Configure only one."
  end
  if !token_provider.nil? && !token_provider.respond_to?(:call)
    raise ArgumentError, "The Bedrock `token_provider` must respond to `call`."
  end
  if !credentials_provider.nil? &&
     !credentials_provider.respond_to?(:call) &&
     !credentials_provider.respond_to?(:credentials)
    raise ArgumentError,
          "The Bedrock `credentials_provider` must respond to `call` or `credentials`."
  end

  explicit_bearer = explicit_api_key || !token_provider.nil?
  aws_modes = [has_access_key, !normalized_profile.nil?, !credentials_provider.nil?].count(true)
  if aws_modes > 1
    raise ArgumentError, Bedrock::AMBIGUOUS_AWS_AUTH_MESSAGE
  end
  if explicit_bearer && aws_modes.positive?
    raise ArgumentError, Bedrock::AMBIGUOUS_AUTH_MESSAGE
  end

  skip_environment_bearer = !api_key.equal?(OpenAI::Internal::OMIT) && api_key.nil?
  environment_bearer =
    !explicit_bearer && aws_modes.zero? && !skip_environment_bearer &&
    !Bedrock.normalize_optional_string(ENV["AWS_BEARER_TOKEN_BEDROCK"]).nil?
  bearer_provider =
    if explicit_api_key
      normalized_api_key.freeze
      -> { normalized_api_key }
    elsif !token_provider.nil?
      token_provider
    elsif environment_bearer
      lambda do
        ENV["AWS_BEARER_TOKEN_BEDROCK"] ||
          raise(OpenAI::Errors::Error, Bedrock::MISSING_CREDENTIALS_MESSAGE)
      end
    end

  if bearer_provider && configured_base_url.nil? && normalized_region.nil?
    raise ArgumentError, Bedrock::MISSING_REGION_MESSAGE
  end

  definition = Bedrock::Definition.new(
    region: normalized_region,
    base_url: configured_base_url,
    bearer_provider: bearer_provider,
    profile: normalized_profile,
    access_key_id: normalized_access_key_id,
    secret_access_key: normalized_secret_access_key,
    session_token: normalized_session_token,
    credentials_provider: credentials_provider,
    default_chain: aws_modes.zero?
  )
  OpenAI::Internal::Provider.create(definition)
end