Tools
Codex can now pull Bedrock SigV4 credentials from an external command instead of an AWS profile
PR #44028, merged 2026-09-09T03:18Z, adds `model_providers.amazon-bedrock.aws.credential_export` with command, args and timeout_ms, accepting both flat credential-process output and nested STS Credentials objects. Credentials are cached in memory, refreshed before expiry, and shared across sessions with matching AWS config; on recoverable auth failures an optional `aws.auth_refresh` command runs first, with concurrent recovery attempts coalesced. Command execution time and output size are bounded and credential values are kept out of errors. Combining credential_export with aws.profile is rejected outright, and Bedrock setup/login refuse to change anything while an exporter is configured.
Source
↳ Follow the thread