fix(bedrock): address review on saved AWS credential signing

- Translate resolves the saved credential only for a Bedrock model, so a
  leftover credential choice no longer blocks a call to another provider.
- A transient STS failure resolving the credential reports 503 instead of
  400, using the classification the AWS tool operations already share.
- llm_chat forwards the run's execution ID to the resolver, naming the
  role session and the credential-access audit after the run.
- Native conversation binding keys a saved-credential request on the
  credential alone, ignoring inline keys left on the block.
- Handler tests share one central mock for the Bedrock credential module;
  the block declaration test is replaced by Translate behavior tests.
- The integration suite writes its credential-access audit inside a rollup
  scope and asserts it before teardown.

Author: waleedlatif1

apps/sim/blocks/bedrock-saved-credential.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest'
+import { TranslateBlock } from '@/blocks/blocks/translate'
+
+const toolParams = (params: Record<string, unknown>) => {
+  const build = TranslateBlock.tools.config?.params
+  if (!build) throw new Error('TranslateBlock.tools.config.params is missing')
+  return build({ context: 'Hello', targetLanguage: 'French', ...params })
+}
+
+describe('Translate Bedrock credential', () => {
+  it('sends the saved AWS credential with a Bedrock model call', () => {
+    expect(
+      toolParams({
+        model: 'bedrock/my-inference-profile',
+        bedrockAuthMode: 'credential',
+        bedrockCredential: 'aws-cred',
+      })
+    ).toMatchObject({ model: 'bedrock/my-inference-profile', bedrockCredential: 'aws-cred' })
+  })
+
+  it('refuses a Bedrock model call set to a saved AWS credential with none selected', () => {
+    expect(() =>
+      toolParams({
+        model: 'bedrock/my-inference-profile',
+        bedrockAuthMode: 'credential',
+        bedrockCredential: '',
+      })
+    ).toThrow('Select an AWS credential for Bedrock')
+  })
+
+  it('ignores a leftover Bedrock credential choice once the model is not on Bedrock', () => {
+    const params = toolParams({ model: 'gpt-4o', bedrockAuthMode: 'credential' })
+
+    expect(params).toMatchObject({ model: 'gpt-4o' })
+    expect(params.bedrockCredential).toBeUndefined()
+  })
+})

apps/sim/blocks/blocks/translate.test.ts

@@ -7,6 +7,7 @@ import {
   getSelectedBedrockCredential,
   PROVIDER_CREDENTIAL_INPUTS,
 } from '@/blocks/utils'
+import { findProviderFromModel } from '@/providers/models'
 
 const getTranslationPrompt = (targetLanguage: string) =>
   `Translate the following text into ${targetLanguage || 'English'}. Output ONLY the translated text with no additional commentary, explanations, or notes.`
@@ -82,7 +83,11 @@ export const TranslateBlock: BlockConfig = {
         bedrockAccessKeyId: params.bedrockAccessKeyId,
         bedrockSecretKey: params.bedrockSecretKey,
         bedrockRegion: params.bedrockRegion,
-        bedrockCredential: getSelectedBedrockCredential(params),
+        bedrockCredential:
+          typeof params.model === 'string' &&
+          findProviderFromModel(params.model.trim()) === 'bedrock'
+            ? getSelectedBedrockCredential(params)
+            : undefined,
       }),
     },
   },

apps/sim/blocks/blocks/translate.ts

@@ -6,6 +6,10 @@ import {
   schemaMock,
   setEnvFlags,
 } from '@sim/testing'
+import {
+  llmBedrockCredentialMock,
+  llmBedrockCredentialMockFns,
+} from '@sim/testing/mocks/llm-bedrock-credential.mock'
 import { getMockLogger } from '@sim/testing/mocks/logger.mock'
 import {
   permissionCheckMock,
@@ -61,6 +65,8 @@ mockGetBlock.mockReturnValue(undefined)
 const mockImportWorkspaceFileSecretProvenanceForModelView =
   workspaceFileSecretProvenanceMockFns.mockImportWorkspaceFileSecretProvenanceForModelView
 const mockValidateModelProvider = permissionCheckMockFns.mockValidateModelProvider
+const mockResolveBedrockCredentialSession =
+  llmBedrockCredentialMockFns.mockResolveBedrockCredentialSession
 mockImportWorkspaceFileSecretProvenanceForModelView.mockResolvedValue(true)
 providersUtilsMockFns.mockGetProviderFromModel.mockReturnValue('mock-provider')
 providersUtilsMockFns.mockIsDeepResearchModel.mockImplementation((model: string) =>
@@ -75,13 +81,7 @@ const { mockDiscoverMcpServerToolsAsExecutor, mockOpenAgentTurnSession } = vi.ho
   mockOpenAgentTurnSession: vi.fn().mockResolvedValue(undefined),
 }))
 
-const { mockResolveBedrockCredentialSession } = vi.hoisted(() => ({
-  mockResolveBedrockCredentialSession: vi.fn(),
-}))
-
-vi.mock('@/lib/internal/llm/bedrock-credential', () => ({
-  resolveBedrockCredentialSession: mockResolveBedrockCredentialSession,
-}))
+vi.mock('@/lib/internal/llm/bedrock-credential', () => llmBedrockCredentialMock)
 
 vi.mock('@/lib/memory/agent-turn-session', () => ({
   openAgentTurnSession: mockOpenAgentTurnSession,

apps/sim/executor/handlers/agent/handler.test.ts

@@ -2,6 +2,10 @@ import {
   credentialsAccessMock,
   credentialsAccessMockFns,
 } from '@sim/testing/mocks/credentials-access.mock'
+import {
+  llmBedrockCredentialMock,
+  llmBedrockCredentialMockFns,
+} from '@sim/testing/mocks/llm-bedrock-credential.mock'
 import { permissionsMock, permissionsMockFns } from '@sim/testing/mocks/permissions.mock'
 import '@sim/testing/mocks/executor'
 
@@ -12,13 +16,7 @@ const { mockResolveAutoModel } = vi.hoisted(() => ({
   mockResolveAutoModel: vi.fn(),
 }))
 
-const { mockResolveBedrockCredentialSession } = vi.hoisted(() => ({
-  mockResolveBedrockCredentialSession: vi.fn(),
-}))
-
-vi.mock('@/lib/internal/llm/bedrock-credential', () => ({
-  resolveBedrockCredentialSession: mockResolveBedrockCredentialSession,
-}))
+vi.mock('@/lib/internal/llm/bedrock-credential', () => llmBedrockCredentialMock)
 
 vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
 
@@ -60,6 +58,8 @@ credentialsAccessMockFns.mockGetCredentialActorContext.mockResolvedValue({
 })
 
 const mockCheckWorkspaceAccess = permissionsMockFns.mockCheckWorkspaceAccess
+const mockResolveBedrockCredentialSession =
+  llmBedrockCredentialMockFns.mockResolveBedrockCredentialSession
 
 const mockGetProviderFromModel = getProviderFromModel as Mock
 const mockExecuteProviderRequest = executeProviderRequest as Mock

apps/sim/executor/handlers/evaluator/handler.test.ts

@@ -2,6 +2,10 @@ import {
   credentialsAccessMock,
   credentialsAccessMockFns,
 } from '@sim/testing/mocks/credentials-access.mock'
+import {
+  llmBedrockCredentialMock,
+  llmBedrockCredentialMockFns,
+} from '@sim/testing/mocks/llm-bedrock-credential.mock'
 import { permissionsMock, permissionsMockFns } from '@sim/testing/mocks/permissions.mock'
 import '@sim/testing/mocks/executor'
 
@@ -18,13 +22,7 @@ const { mockResolveAutoModel } = vi.hoisted(() => ({
   mockResolveAutoModel: vi.fn(),
 }))
 
-const { mockResolveBedrockCredentialSession } = vi.hoisted(() => ({
-  mockResolveBedrockCredentialSession: vi.fn(),
-}))
-
-vi.mock('@/lib/internal/llm/bedrock-credential', () => ({
-  resolveBedrockCredentialSession: mockResolveBedrockCredentialSession,
-}))
+vi.mock('@/lib/internal/llm/bedrock-credential', () => llmBedrockCredentialMock)
 
 vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
 
@@ -67,6 +65,8 @@ credentialsAccessMockFns.mockGetCredentialActorContext.mockResolvedValue({
 })
 
 const mockCheckWorkspaceAccess = permissionsMockFns.mockCheckWorkspaceAccess
+const mockResolveBedrockCredentialSession =
+  llmBedrockCredentialMockFns.mockResolveBedrockCredentialSession
 
 const mockGenerateRouterPrompt = generateRouterPrompt as Mock
 const mockGenerateRouterV2Prompt = generateRouterV2Prompt as Mock

apps/sim/executor/handlers/router/handler.test.ts

@@ -120,7 +120,7 @@ const THROTTLING_ERROR_NAMES = new Set(['Throttling', 'ThrottlingException'])
  * (IDPCommunicationError, when STS could not reach Sim's OIDC issuer), throttling,
  * an STS 5xx, or a network failure. The SDK has already retried these.
  */
-function isTransientAwsFailure(error: unknown): boolean {
+export function isTransientAwsFailure(error: unknown): boolean {
   if (!isRecordLike(error)) return false
   const status = isRecordLike(error.$metadata) ? error.$metadata.httpStatusCode : undefined
   return (

apps/sim/lib/internal/aws/credentials.ts

@@ -1,5 +1,6 @@
 /** A saved AWS credential resolved for a Bedrock model call against real credential rows. */
 
+import { withAuditRollupScope } from '@sim/audit'
 import { db } from '@sim/db'
 import {
   auditLog,
@@ -11,7 +12,7 @@ import {
 } from '@sim/db/schema'
 import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
 import { generateId } from '@sim/utils/id'
-import { inArray } from 'drizzle-orm'
+import { and, eq, inArray } from 'drizzle-orm'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import {
@@ -155,11 +156,19 @@ describe('resolveBedrockCredentialSession', () => {
   })
 
   it("resolves a credential member's saved access keys for the credential's workspace", async () => {
-    await expect(resolveAs(memberId, awsCredentialId)).resolves.toEqual({
-      credentialId: awsCredentialId,
-      accessKeyId: ACCESS_KEY_ID,
-      secretAccessKey: SECRET_ACCESS_KEY,
-    })
+    await expect(withAuditRollupScope(() => resolveAs(memberId, awsCredentialId))).resolves.toEqual(
+      {
+        credentialId: awsCredentialId,
+        accessKeyId: ACCESS_KEY_ID,
+        secretAccessKey: SECRET_ACCESS_KEY,
+      }
+    )
+
+    const audits = await db
+      .select({ actorId: auditLog.actorId })
+      .from(auditLog)
+      .where(and(eq(auditLog.workspaceId, workspaceId), eq(auditLog.resourceId, awsCredentialId)))
+    expect(audits).toEqual([{ actorId: memberId }])
   })
 
   it('refuses a run with no acting user', async () => {

apps/sim/lib/internal/llm/bedrock-credential.integration.ts

@@ -1,23 +1,26 @@
 import { getErrorMessage } from '@sim/utils/errors'
 import { authorizeCredentialUseForAuth } from '@/lib/auth/credential-access'
 import { AuthType } from '@/lib/auth/hybrid'
-import { resolveAuthorizedAwsCredential } from '@/lib/internal/aws/credentials'
+import {
+  isTransientAwsFailure,
+  resolveAuthorizedAwsCredential,
+} from '@/lib/internal/aws/credentials'
 import { recordCredentialAccess } from '@/lib/oauth/token-resolution'
 import { AWS_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
 import type { BedrockCredentialSession } from '@/providers/types'
 
+type BedrockCredentialFailure = 'unauthorized' | 'unusable' | 'unavailable'
+
 /**
  * A saved AWS credential could not be used for a Bedrock request: the caller is
- * not allowed to use it (`unauthorized`), or it is not a live AWS credential or
- * AWS refused it (`unusable`).
+ * not allowed to use it (`unauthorized`), it is not a live AWS credential or AWS
+ * refused it (`unusable`), or AWS was briefly unreachable while resolving it
+ * (`unavailable`, worth retrying).
  */
 export class BedrockCredentialError extends Error {
-  readonly reason: 'unauthorized' | 'unusable'
+  readonly reason: BedrockCredentialFailure
 
-  constructor(
-    message: string,
-    options?: { reason?: 'unauthorized' | 'unusable'; cause?: unknown }
-  ) {
+  constructor(message: string, options?: { reason?: BedrockCredentialFailure; cause?: unknown }) {
     super(message, { cause: options?.cause })
     this.name = 'BedrockCredentialError'
     this.reason = options?.reason ?? 'unusable'
@@ -94,7 +97,7 @@ export async function resolveBedrockCredentialSession({
     signal?.throwIfAborted()
     throw new BedrockCredentialError(
       `Could not use the AWS credential: ${getErrorMessage(error, 'Unknown error')}`,
-      { cause: error }
+      { reason: isTransientAwsFailure(error) ? 'unavailable' : 'unusable', cause: error }
     )
   }
 

apps/sim/lib/internal/llm/bedrock-credential.ts

@@ -54,6 +54,7 @@ export const executeLlmTool: InternalToolOperationHandler = async (request) => {
       actorUserId: request.context.userId,
       headers: request.headers,
       requestId: request.requestId,
+      executionId: request.context.executionId,
       signal: request.signal,
     })
     request.signal?.throwIfAborted()