[Feature] AWS AssumeRoleWithWebIdentity Support for Bedrock

[Rapcohen]

What Would You Like to See with the Gateway?

The Portkey AI Gateway should allow users to set the AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN environment variables, which can then be used to call the AssumeRoleWithWebIdentity API. This would enable the gateway to retrieve a set of temporary security credentials that can be used to access Bedrock.

Specifically, the gateway should:

1. Accept the AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN environment variables as part of the configuration.
2. Use the provided credentials to call the AssumeRoleWithWebIdentity API and obtain security credentials.
3. Use these credentials to authenticate and authorize requests to Bedrock.

Context for your Request

My organization is using the open-source version of the Portkey AI Gateway, which is deployed on our Kubernetes cluster. We want to define a role-based policy that allows the gateway to access Bedrock. The goal is to enable other services running on the same Kubernetes cluster to access Bedrock through the gateway, without having to manage their own AWS credentials.

Your Twitter/LinkedIn

No response

[narengogi]

Hey @Rapcohen we already support using AssumeRoleWithWebIdentity API in the enterprise version of Portkey and we have plans to open source it, but have not planned any timelines around it.

cc'ing @sk-portkey who implemented this if you need more implementation details

[Rapcohen]

Thanks for the reply @narengogi !