IRSA (IAM roles for service accounts) support for sourcebot pod

[mohannara]

Hello,
I want to connect Sourcebot with AWS bedrock, attaching a service account to the pod rather than using AWS static ACCESS_KEY and SECRET_ACCESS_KEY. Is there a way?
I'm getting the below error with this approach.

[web] | 2025-09-08T04:10:33.646Z error: [web-actions] AWS SigV4 authentication requires AWS credentials. Please provide either:
[web] | 1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
[web] | 2. Provide accessKeyId and secretAccessKey in options
[web] | 3. Use a credentialProvider function
[web] | 4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option
[web] | Original error: AWS access key ID setting is missing. Pass it using the 'accessKeyId' parameter or the AWS_ACCESS_KEY_ID environment variable.
[web] | Error: AWS SigV4 authentication requires AWS credentials. Please provide either:
[web] | 1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
[web] | 2. Provide accessKeyId and secretAccessKey in options
[web] | 3. Use a credentialProvider function
[web] | 4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option
[web] | Original error: AWS access key ID setting is missing. Pass it using the 'accessKeyId' parameter or the AWS_ACCESS_KEY_ID environment variable.
[web] | at /app/packages/web/.next/server/chunks/5676.js:93:54278

[brendan-kellam]

Heya - I think setting the credentialProvider is probably what we want, so I can take a look at getting a PR out. Are you using EKS Service Accounts?

[mohannara]

Yes we are using EKS service accounts.

[brendan-kellam]

@mohannara Could you try the latest ghcr.io/sourcebot-dev/sourcebot:main build when you get the chance? Made a change in #513

• will be available when this build finishes: https://github.com/sourcebot-dev/sourcebot/actions/runs/17809381606

[brendan-kellam]

Update: shipped in 4.7.0

[brendan-kellam]

Closing for now - feel free to reopen if it doesn't work