feat(dashboard-agent): support dedicated non-global Bedrock credentials

Add DASHBOARD_AGENT_AWS_ACCESS_KEY_ID/SECRET_ACCESS_KEY/REGION so the
agent's Bedrock creds don't hijack the default AWS chain the ECR/STS
deploy clients rely on. Falls back to the default chain and existing
AWS_REGION/AWS_DEFAULT_REGION order when unset.

Author: kathiekiwi

apps/webapp/app/env.server.ts

@@ -180,6 +180,13 @@ const EnvironmentSchema = z
     AWS_SECRET_ACCESS_KEY: z.string().optional(),
     AWS_SESSION_TOKEN: z.string().optional(),
     AWS_BEARER_TOKEN_BEDROCK: z.string().optional(),
+    // Dedicated, non-global credentials for the dashboard agent's Bedrock calls (a
+    // Bedrock-invoke-only IAM user). Kept separate from AWS_ACCESS_KEY_ID/etc so
+    // injecting them can't hijack the default credential chain the ECR/STS deploy
+    // clients rely on.
+    DASHBOARD_AGENT_AWS_ACCESS_KEY_ID: z.string().optional(),
+    DASHBOARD_AGENT_AWS_SECRET_ACCESS_KEY: z.string().optional(),
+    DASHBOARD_AGENT_AWS_REGION: z.string().optional(),
     DIRECT_URL: z
       .string()
       .refine(

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.ts

@@ -332,7 +332,7 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
       const repoSnapshot = await resolveDashboardAgentRepoSnapshot(project.id);
       const headStarted =
         dashboardAgentProvider() === "bedrock"
-          ? Boolean(env.AWS_REGION || env.AWS_DEFAULT_REGION)
+          ? Boolean(env.DASHBOARD_AGENT_AWS_REGION || env.AWS_REGION || env.AWS_DEFAULT_REGION)
           : Boolean(env.ANTHROPIC_API_KEY);
 
       // The lookups and the mint all run before the chat row exists, so a failure here can't

internal-packages/dashboard-agent/src/model-provider.test.ts

@@ -2,6 +2,8 @@ import { afterEach, describe, expect, it } from "vitest";
 import { PROMPT_CACHE_CONTROL } from "./prompt-prefix";
 import {
   BEDROCK_MODEL_IDS,
+  bedrockProviderSettings,
+  bedrockRegion,
   isLongLivedCacheBreakpoint,
   isStepCacheBreakpoint,
   resolveDashboardAgentModel,
@@ -14,8 +16,17 @@ function useBedrock() {
   process.env.DASHBOARD_AGENT_MODEL_PROVIDER = "bedrock";
 }
 
+const AWS_ENV_VARS = [
+  "DASHBOARD_AGENT_MODEL_PROVIDER",
+  "DASHBOARD_AGENT_AWS_ACCESS_KEY_ID",
+  "DASHBOARD_AGENT_AWS_SECRET_ACCESS_KEY",
+  "DASHBOARD_AGENT_AWS_REGION",
+  "AWS_REGION",
+  "AWS_DEFAULT_REGION",
+] as const;
+
 afterEach(() => {
-  delete process.env.DASHBOARD_AGENT_MODEL_PROVIDER;
+  for (const key of AWS_ENV_VARS) delete process.env[key];
 });
 
 describe("resolveDashboardAgentModel", () => {
@@ -118,3 +129,49 @@ describe("cache breakpoints", () => {
     expect(withoutCacheBreakpoint(legacyStep)).toEqual({ anthropic: { keep: true } });
   });
 });
+
+describe("Bedrock region and credential resolution", () => {
+  it("prefers DASHBOARD_AGENT_AWS_REGION over the global AWS region vars", () => {
+    process.env.AWS_REGION = "us-east-1";
+    process.env.AWS_DEFAULT_REGION = "us-west-2";
+    process.env.DASHBOARD_AGENT_AWS_REGION = "eu-west-1";
+    expect(bedrockRegion()).toBe("eu-west-1");
+  });
+
+  it("falls back to AWS_REGION, then AWS_DEFAULT_REGION", () => {
+    process.env.AWS_DEFAULT_REGION = "us-west-2";
+    expect(bedrockRegion()).toBe("us-west-2");
+
+    process.env.AWS_REGION = "us-east-1";
+    expect(bedrockRegion()).toBe("us-east-1");
+  });
+
+  it("treats an empty region as unset at every tier", () => {
+    process.env.DASHBOARD_AGENT_AWS_REGION = "";
+    process.env.AWS_REGION = "";
+    process.env.AWS_DEFAULT_REGION = "";
+    expect(bedrockRegion()).toBeUndefined();
+  });
+
+  it("passes explicit credentials when the dedicated pair is set", () => {
+    process.env.DASHBOARD_AGENT_AWS_ACCESS_KEY_ID = "AKIA_DASHBOARD_AGENT";
+    process.env.DASHBOARD_AGENT_AWS_SECRET_ACCESS_KEY = "secret";
+    process.env.DASHBOARD_AGENT_AWS_REGION = "eu-west-1";
+
+    expect(bedrockProviderSettings()).toEqual({
+      region: "eu-west-1",
+      accessKeyId: "AKIA_DASHBOARD_AGENT",
+      secretAccessKey: "secret",
+    });
+  });
+
+  it("keeps the default credential chain when the dedicated pair is unset", () => {
+    process.env.AWS_REGION = "us-east-1";
+    expect(bedrockProviderSettings()).toEqual({ region: "us-east-1" });
+  });
+
+  it("keeps the default chain when only one half of the dedicated pair is set", () => {
+    process.env.DASHBOARD_AGENT_AWS_ACCESS_KEY_ID = "AKIA_DASHBOARD_AGENT";
+    expect(bedrockProviderSettings()).toEqual({ region: undefined });
+  });
+});

internal-packages/dashboard-agent/src/model-provider.ts

@@ -21,11 +21,34 @@ export function dashboardAgentProvider(): DashboardAgentProvider {
   return process.env.DASHBOARD_AGENT_MODEL_PROVIDER === "bedrock" ? "bedrock" : "anthropic";
 }
 
-// Region passed explicitly since the SDK reads only AWS_REGION; credentials stay on
-// its own chain. `||` treats an empty region as unset, matching the webapp gate.
-const bedrock = createAmazonBedrock({
-  region: process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION,
-});
+// Region passed explicitly since the SDK reads only AWS_REGION. `||` treats an empty
+// region as unset. DASHBOARD_AGENT_AWS_REGION takes priority over the global vars.
+export function bedrockRegion(): string | undefined {
+  return (
+    process.env.DASHBOARD_AGENT_AWS_REGION ||
+    process.env.AWS_REGION ||
+    process.env.AWS_DEFAULT_REGION ||
+    undefined
+  );
+}
+
+// Dedicated, non-global credentials only — the default chain (and the global
+// AWS_ACCESS_KEY_ID/etc, if ever set) stays untouched for the ECR/STS deploy clients.
+function bedrockCredentials(): { accessKeyId: string; secretAccessKey: string } | undefined {
+  const accessKeyId = process.env.DASHBOARD_AGENT_AWS_ACCESS_KEY_ID;
+  const secretAccessKey = process.env.DASHBOARD_AGENT_AWS_SECRET_ACCESS_KEY;
+  return accessKeyId && secretAccessKey ? { accessKeyId, secretAccessKey } : undefined;
+}
+
+export function bedrockProviderSettings(): {
+  region?: string;
+  accessKeyId?: string;
+  secretAccessKey?: string;
+} {
+  return { region: bedrockRegion(), ...bedrockCredentials() };
+}
+
+const bedrock = createAmazonBedrock(bedrockProviderSettings());
 
 export const registry = createProviderRegistry({ anthropic, bedrock });