Docs

AWS Bedrock Authentication with IAM and OIDC

STAR can use AWS Bedrock without a static INFERENCE_TOKEN. When the runner provides AWS credentials through one of the supported sources described below — an IAM instance role, ECS task role, profile, temporary environment credentials, or OIDC federation — STAR generates a short-lived Bedrock Bearer token automatically.

📘

Bedrock IAM and Bright WIF are separate

This page configures authentication from STAR to AWS Bedrock and replaces only the static inference token. It does not replace BRIGHT_TOKEN.

To exchange a CI/CD OIDC token for a temporary Bright API token, see Workload Identity Federation. You can use both flows in the same job.

How it works

For a CI/CD workload using OIDC, the authentication flow is:

CI/CD workload
    │ OIDC ID token
    ▼
AWS STS AssumeRoleWithWebIdentity
    │ temporary AWS credentials
    ▼
STAR
    │ generates a short-lived Bedrock Bearer token
    ▼
AWS Bedrock inference endpoint

STAR uses the AWS credential sources listed on this page. The CI/CD provider and AWS STS perform the OIDC exchange; STAR does not validate the CI/CD OIDC token itself.

When STAR uses Bedrock IAM

STAR selects Bedrock IAM automatically when all of these conditions are true:

  • INFERENCE_URL uses the documented AWS Bedrock hostname.
  • OPENAI_API_KEY is not defined.
  • INFERENCE_TOKEN is not defined.

Use the Bedrock Mantle endpoint documented for STAR:

export INFERENCE_URL="https://bedrock-mantle.us-east-1.api.aws/v1"
export AI_MODEL="anthropic.claude-sonnet-4-20250514-v1:0"
unset OPENAI_API_KEY
unset INFERENCE_TOKEN

The region is extracted from INFERENCE_URL. The endpoint region, IAM configuration, and selected model availability must match.

⚠️

Use only the exact AWS-owned endpoint

Set INFERENCE_URL to https://bedrock-mantle.<region>.api.aws/v1. Do not use a proxy or custom hostname: STAR sends the generated Bedrock credential to the configured inference URL.

⚠️

Remove token variables instead of setting empty values

For Bedrock IAM, remove both OPENAI_API_KEY and INFERENCE_TOKEN from the job environment. A configured token takes precedence over IAM, and an empty OPENAI_API_KEY can shadow INFERENCE_TOKEN during provider selection.

Before you begin

Make sure that:

  1. The selected model is available to your AWS account in the target region.
  2. The runner can reach AWS STS and bedrock-mantle.<region>.api.aws over HTTPS.
  3. The AWS principal has permission to invoke the selected Bedrock model.
  4. The CI/CD workload can obtain AWS credentials through OIDC or another supported credential source listed below.
  5. BRIGHT_TOKEN and repository access are configured separately as described in Installation & CI Integration.

Grant Bedrock permissions

For initial setup, you can attach the AWS managed AmazonBedrockLimitedAccess policy to the role. For least privilege, use a custom policy restricted to the models or inference profiles STAR may use. This example allows one foundation model in us-east-1:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-sonnet-4-20250514-v1:0"
    }
  ]
}

bedrock:InvokeModel is required. Keep bedrock:InvokeModelWithResponseStream when the selected model or endpoint uses streaming responses. If AI_MODEL names an inference profile, grant access to that profile and to the destination foundation models it invokes.

Configure GitHub Actions with OIDC

This is the recommended GitHub Actions setup. GitHub issues an OIDC ID token for the job, AWS STS exchanges it for temporary role credentials, and STAR uses those credentials to generate the Bedrock token.

Step 1: Create the AWS trust relationship

Create or reuse the GitHub OIDC provider in AWS IAM:

  • Provider URL: https://token.actions.githubusercontent.com
  • Audience: sts.amazonaws.com

Create an IAM role for STAR and restrict its trust policy to the intended repository and refs. Replace the sample account, organization, and repository values:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": [
            "repo:YOUR_ORG/YOUR_REPO:pull_request",
            "repo:YOUR_ORG/YOUR_REPO:ref:refs/heads/main"
          ]
        }
      }
    }
  ]
}

The example allows pull-request jobs and jobs running on main. Add other explicit refs or an environment subject only when your STAR workflow needs them. Avoid a broad repo:YOUR_ORG/YOUR_REPO:* condition unless every workflow context in that repository should be able to assume the role.

Step 2: Update the STAR workflow

Add id-token: write to the existing STAR permissions, then configure AWS credentials before running STAR:

permissions:
  id-token: write
  contents: write
  pull-requests: write
  statuses: write

jobs:
  bright-agent:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Configure AWS credentials through GitHub OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/BrightAgentRole
          aws-region: us-east-1
          role-session-name: bright-agent-${{ github.run_id }}

      # Download and verify the STAR binary as shown in the standard template.

      - name: Run STAR
        env:
          LOCAL_REPO_PATH: ${{ github.workspace }}
          REPO_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BRIGHT_TOKEN: ${{ secrets.BRIGHT_TOKEN }}
          INFERENCE_URL: https://bedrock-mantle.us-east-1.api.aws/v1
          AI_MODEL: anthropic.claude-sonnet-4-20250514-v1:0
        run: "${{ runner.temp }}/bright-agent-linux-x64"

Do not add INFERENCE_TOKEN or OPENAI_API_KEY to the run step. The configure-aws-credentials action exports temporary AWS credentials that STAR can use.

Use another AWS credential source

STAR currently recognizes these AWS credential sources before initializing the Bedrock token provider:

  • AWS_ROLE_ARN with AWS_WEB_IDENTITY_TOKEN_FILE.
  • Temporary AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and optional AWS_SESSION_TOKEN values.
  • AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE, or AWS_CONFIG_FILE.
  • EC2 instance metadata when it is enabled.
  • ECS task credentials exposed through AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.

For a direct web-identity setup:

export AWS_ROLE_ARN="arn:aws:iam::123456789012:role/BrightAgentRole"
export AWS_WEB_IDENTITY_TOKEN_FILE="/path/to/oidc-token"
export AWS_ROLE_SESSION_NAME="bright-agent"

export INFERENCE_URL="https://bedrock-mantle.us-east-1.api.aws/v1"
export AI_MODEL="anthropic.claude-sonnet-4-20250514-v1:0"
unset OPENAI_API_KEY
unset INFERENCE_TOKEN

./bright-agent

The token file must exist and be readable by the STAR process. Configure the OIDC issuer, audience, subject claims, and role trust policy according to your CI/CD provider.

Validate the configuration

Set BRIGHT_PREFLIGHT_ONLY=1 on the STAR run step, after configuring AWS credentials, to validate the core configuration and credentials without starting a scan:

- name: Validate STAR configuration
  env:
    BRIGHT_PREFLIGHT_ONLY: "1"
    LOCAL_REPO_PATH: ${{ github.workspace }}
    REPO_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    BRIGHT_TOKEN: ${{ secrets.BRIGHT_TOKEN }}
    INFERENCE_URL: https://bedrock-mantle.us-east-1.api.aws/v1
    AI_MODEL: anthropic.claude-sonnet-4-20250514-v1:0
  run: "${{ runner.temp }}/bright-agent-linux-x64"

A successful startup includes messages indicating that a Bedrock URL was detected and an IAM token was generated for the resolved region.

Security and runtime considerations

  • Restrict the IAM trust policy to the exact repository, branch, pull-request context, or protected CI environment that runs STAR.
  • Grant access only to the Bedrock models or inference profiles STAR needs.
  • Do not store OIDC ID tokens or temporary AWS credentials as long-lived CI secrets.
  • Do not print the OIDC token, AWS credentials, or generated Bedrock token to CI logs.
  • The generated Bedrock token is short-lived and cannot outlive the underlying AWS credentials. Keep the STAR job within the validity period of the role session; restart the job with fresh credentials if they expire.
  • BRIGHT_TOKEN remains a separate runtime requirement. It may be a regular Bright API key or a temporary token obtained through Bright Workload Identity Federation.

For common IAM, region, and credential-chain errors, see Logging & Troubleshooting.

Updated about 13 hours ago

What’s Next

Did this page help you?