fix(bedrock): offer the saved AWS credential only on blocks that forward it

Guardrails and Pi spread the shared provider credential fields and inputs but
never pass a saved credential to their call, so the AWS Authentication choice
and credential picker are now opt-in. Agent, Router, Evaluator, and Translate
opt in; Guardrails and Pi keep the fields and catalog schema they had before.

Author: waleedlatif1

apps/sim/blocks/bedrock-saved-credential.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest'
+import { AgentBlock } from '@/blocks/blocks/agent'
+import { EvaluatorBlock } from '@/blocks/blocks/evaluator'
+import { GuardrailsBlock } from '@/blocks/blocks/guardrails'
+import { PiBlock } from '@/blocks/blocks/pi'
+import { RouterBlock, RouterV2Block } from '@/blocks/blocks/router'
+import { TranslateBlock } from '@/blocks/blocks/translate'
+import type { BlockConfig } from '@/blocks/types'
+
+const SAVED_CREDENTIAL_FIELDS = ['bedrockAuthMode', 'bedrockCredential', 'bedrockManualCredential']
+const SAVED_CREDENTIAL_INPUTS = ['bedrockAuthMode', 'bedrockCredential']
+
+/** The saved-credential fields and inputs a block publishes to the editor and the block catalog. */
+function savedCredentialSurface(block: BlockConfig) {
+  return {
+    fields: block.subBlocks
+      .map((subBlock) => subBlock.id)
+      .filter((id) => SAVED_CREDENTIAL_FIELDS.includes(id)),
+    inputs: Object.keys(block.inputs ?? {}).filter((key) => SAVED_CREDENTIAL_INPUTS.includes(key)),
+  }
+}
+
+describe('Bedrock saved AWS credential surface', () => {
+  // Guardrails never serializes its Bedrock fields and Pi has no Bedrock provider, so a
+  // saved credential set on either would be dropped and the call signed some other way.
+  it.each([
+    ['guardrails', GuardrailsBlock],
+    ['pi', PiBlock],
+  ])('is absent from the %s block, which cannot forward a saved credential', (_, block) => {
+    expect(savedCredentialSurface(block)).toEqual({ fields: [], inputs: [] })
+  })
+
+  it.each([
+    ['agent', AgentBlock],
+    ['router', RouterBlock],
+    ['router_v2', RouterV2Block],
+    ['evaluator', EvaluatorBlock],
+    ['translate', TranslateBlock],
+  ])('is offered by the %s block, which forwards it to the Bedrock call', (_, block) => {
+    expect(savedCredentialSurface(block)).toEqual({
+      fields: SAVED_CREDENTIAL_FIELDS,
+      inputs: SAVED_CREDENTIAL_INPUTS,
+    })
+  })
+})

apps/sim/blocks/blocks/agent.ts

@@ -4,6 +4,7 @@ import { getModelFallbackSubBlock, MODEL_FALLBACK_INPUTS } from '@/blocks/model-
 import type { BlockConfig } from '@/blocks/types'
 import { AuthMode, IntegrationType } from '@/blocks/types'
 import {
+  BEDROCK_SAVED_CREDENTIAL_INPUTS,
   getAgentModelOptions,
   getModelCapabilityCondition,
   getProviderCredentialSubBlocks,
@@ -136,7 +137,7 @@ Return ONLY the JSON array.`,
       options: getAgentModelOptions,
       commandSearchable: true,
     },
-    ...getProviderCredentialSubBlocks(),
+    ...getProviderCredentialSubBlocks({ bedrockSavedCredential: true }),
     {
       id: 'evaluationState',
       title: 'State',
@@ -559,15 +560,7 @@ Return ONLY the JSON array.`,
     bedrockAccessKeyId: { type: 'string', description: 'AWS Access Key ID for Bedrock' },
     bedrockSecretKey: { type: 'string', description: 'AWS Secret Access Key for Bedrock' },
     bedrockRegion: { type: 'string', description: 'AWS region for Bedrock' },
-    bedrockAuthMode: {
-      type: 'string',
-      description: "How Bedrock authenticates: 'access_keys' (default) or 'credential'",
-    },
-    bedrockCredential: {
-      type: 'string',
-      description:
-        "Saved AWS credential ID for Bedrock, used instead of access keys when bedrockAuthMode is 'credential'",
-    },
+    ...BEDROCK_SAVED_CREDENTIAL_INPUTS,
     responseFormat: {
       type: 'json',
       description: 'JSON response format schema',

apps/sim/blocks/blocks/evaluator.ts

@@ -3,6 +3,7 @@ import { ChartBarIcon } from '@/components/icons'
 import { getModelFallbackSubBlock, MODEL_FALLBACK_INPUTS } from '@/blocks/model-fallbacks'
 import type { BlockConfig, ParamType } from '@/blocks/types'
 import {
+  BEDROCK_SAVED_CREDENTIAL_INPUTS,
   getModelOptions,
   getProviderCredentialSubBlocks,
   getSerializedModelProviderId,
@@ -170,7 +171,7 @@ export const EvaluatorBlock: BlockConfig = {
       defaultValue: 'claude-sonnet-5-5',
       options: getModelOptions,
     },
-    ...getProviderCredentialSubBlocks(),
+    ...getProviderCredentialSubBlocks({ bedrockSavedCredential: true }),
     getModelFallbackSubBlock(),
     {
       id: 'temperature',
@@ -277,6 +278,7 @@ export const EvaluatorBlock: BlockConfig = {
     },
     model: { type: 'string' as ParamType, description: 'AI model to use' },
     ...PROVIDER_CREDENTIAL_INPUTS,
+    ...BEDROCK_SAVED_CREDENTIAL_INPUTS,
     ...MODEL_FALLBACK_INPUTS,
     temperature: {
       type: 'number' as ParamType,

apps/sim/blocks/blocks/router.ts

@@ -2,6 +2,7 @@ import { ConnectIcon } from '@/components/icons'
 import { getModelFallbackSubBlock, MODEL_FALLBACK_INPUTS } from '@/blocks/model-fallbacks'
 import { AuthMode, type BlockConfig } from '@/blocks/types'
 import {
+  BEDROCK_SAVED_CREDENTIAL_INPUTS,
   getModelOptions,
   getProviderCredentialSubBlocks,
   getSerializedModelProviderId,
@@ -163,7 +164,7 @@ export const RouterBlock: BlockConfig = {
       defaultValue: 'claude-sonnet-5-5',
       options: getModelOptions,
     },
-    ...getProviderCredentialSubBlocks(),
+    ...getProviderCredentialSubBlocks({ bedrockSavedCredential: true }),
     getModelFallbackSubBlock(),
     {
       id: 'temperature',
@@ -200,6 +201,7 @@ export const RouterBlock: BlockConfig = {
     prompt: { type: 'string', description: 'Routing prompt content' },
     model: { type: 'string', description: 'AI model to use' },
     ...PROVIDER_CREDENTIAL_INPUTS,
+    ...BEDROCK_SAVED_CREDENTIAL_INPUTS,
     ...MODEL_FALLBACK_INPUTS,
     temperature: {
       type: 'number',
@@ -254,7 +256,7 @@ export const RouterV2Block: BlockConfig = {
       defaultValue: 'claude-sonnet-5-5',
       options: getModelOptions,
     },
-    ...getProviderCredentialSubBlocks(),
+    ...getProviderCredentialSubBlocks({ bedrockSavedCredential: true }),
     getModelFallbackSubBlock(),
   ],
   tools: {
@@ -275,6 +277,7 @@ export const RouterV2Block: BlockConfig = {
     routes: { type: 'json', description: 'Route definitions with descriptions' },
     model: { type: 'string', description: 'AI model to use' },
     ...PROVIDER_CREDENTIAL_INPUTS,
+    ...BEDROCK_SAVED_CREDENTIAL_INPUTS,
     ...MODEL_FALLBACK_INPUTS,
   },
   outputs: {

apps/sim/blocks/blocks/translate.ts

@@ -1,6 +1,7 @@
 import { TranslateIcon } from '@/components/icons'
 import { AuthMode, type BlockConfig, IntegrationType } from '@/blocks/types'
 import {
+  BEDROCK_SAVED_CREDENTIAL_INPUTS,
   getModelOptions,
   getProviderCredentialSubBlocks,
   getSelectedBedrockCredential,
@@ -53,7 +54,7 @@ export const TranslateBlock: BlockConfig = {
       required: true,
       options: getModelOptions,
     },
-    ...getProviderCredentialSubBlocks(),
+    ...getProviderCredentialSubBlocks({ bedrockSavedCredential: true }),
     {
       id: 'systemPrompt',
       title: 'System Prompt',
@@ -89,6 +90,7 @@ export const TranslateBlock: BlockConfig = {
     context: { type: 'string', description: 'Text to translate' },
     targetLanguage: { type: 'string', description: 'Target language' },
     ...PROVIDER_CREDENTIAL_INPUTS,
+    ...BEDROCK_SAVED_CREDENTIAL_INPUTS,
     systemPrompt: { type: 'string', description: 'Translation instructions' },
   },
   outputs: {

apps/sim/blocks/utils.test.ts

@@ -115,8 +115,11 @@ describe('Bedrock credential fields', () => {
     'bedrockRegion',
   ]
 
-  const visibleBedrockFields = (values: Record<string, unknown>) =>
-    getProviderCredentialSubBlocks()
+  const visibleBedrockFields = (
+    values: Record<string, unknown>,
+    subBlocks = getProviderCredentialSubBlocks({ bedrockSavedCredential: true })
+  ) =>
+    subBlocks
       .filter((subBlock) => BEDROCK_FIELDS.includes(subBlock.id))
       .filter((subBlock) => evaluateSubBlockCondition(subBlock.condition, values))
       .map((subBlock) => subBlock.id)
@@ -139,6 +142,15 @@ describe('Bedrock credential fields', () => {
   it('shows no Bedrock field for a model of another provider', () => {
     expect(visibleBedrockFields({ model: 'gpt-4o', bedrockAuthMode: 'credential' })).toEqual([])
   })
+
+  it('offers no saved credential, and keeps the access keys, for a block that cannot forward one', () => {
+    expect(
+      visibleBedrockFields(
+        { model: 'bedrock/my-inference-profile', bedrockAuthMode: 'credential' },
+        getProviderCredentialSubBlocks()
+      )
+    ).toEqual(['bedrockAccessKeyId', 'bedrockSecretKey', 'bedrockRegion'])
+  })
 })
 
 describe('getSelectedBedrockCredential', () => {
@@ -165,7 +177,7 @@ describe('getSelectedBedrockCredential', () => {
   })
 
   it('signs with a credential exactly when the block shows and serializes the credential picker', () => {
-    const picker = getProviderCredentialSubBlocks().find(
+    const picker = getProviderCredentialSubBlocks({ bedrockSavedCredential: true }).find(
       (subBlock) => subBlock.id === 'bedrockCredential'
     )
     const cases: Record<string, unknown>[] = [