From 949fd827e0e7f52561ba25da34584342585aec52 Mon Sep 17 00:00:00 2001 From: Wei Lee Date: Wed, 19 Aug 2026 16:13:07 +0800 Subject: [PATCH] Fix reversed credential precedence in Bedrock hook docstring The PydanticAIBedrockHook docstring listed IAM keys before the bearer token, but BedrockProvider.__init__ in pydantic-ai checks api_key / AWS_BEARER_TOKEN_BEDROCK first and never passes the IAM key args to boto3 when it is set, so the bearer token actually wins when both are configured. Caught during review of #71774, which already documents the correct precedence on the connection docs page. --- .../ai/src/airflow/providers/common/ai/hooks/pydantic_ai.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/providers/common/ai/src/airflow/providers/common/ai/hooks/pydantic_ai.py b/providers/common/ai/src/airflow/providers/common/ai/hooks/pydantic_ai.py index 8f4e71a9a69dc..c0bea0ddcbc7d 100644 --- a/providers/common/ai/src/airflow/providers/common/ai/hooks/pydantic_ai.py +++ b/providers/common/ai/src/airflow/providers/common/ai/hooks/pydantic_ai.py @@ -355,9 +355,10 @@ class PydanticAIBedrockHook(PydanticAIHook): Credentials are resolved in order: - 1. IAM keys from ``extra`` (``aws_access_key_id`` + ``aws_secret_access_key``, + 1. Bearer token in ``extra`` (``api_key``, maps to env ``AWS_BEARER_TOKEN_BEDROCK``). + Takes precedence over IAM keys if both are set. + 2. IAM keys from ``extra`` (``aws_access_key_id`` + ``aws_secret_access_key``, optionally ``aws_session_token``). - 2. Bearer token in ``extra`` (``api_key``, maps to env ``AWS_BEARER_TOKEN_BEDROCK``). 3. Environment-variable / instance-role chain (``AWS_PROFILE``, IAM role, …) when no explicit keys are provided.