Codex adds command-based AWS credentials for Bedrock

Codex added a setting that fetches AWS Bedrock credentials by running an external command instead of storing them directly. The new model_providers.amazon-bedrock.aws.credential_export option accepts two shapes, flat credential-process output or a nested STS Credentials object, per the credential_export pull request.

For anyone running Codex against Bedrock, this moves where the keys live. Instead of a static access key in a config file, Codex calls a command you name and trusts what it returns.

The caching is specific. Credentials sit in memory and refresh before they expire. Sessions with matching AWS config share that cached set instead of each running their own fetch.

Auth failures get a second chance. If a request fails with a recoverable error, an optional aws.auth_refresh command runs first to try to fix it. When several sessions hit that recovery path at once, Codex coalesces the attempts rather than firing off duplicate refresh commands.

One combination is blocked outright. Setting credential_export alongside aws.profile gets rejected, so you pick one credential source, not both. The pull request doesn't say what happens to credentials already cached in memory if the export command starts failing mid-session. It also doesn't say whether a compromised export script could hand Codex credentials for the wrong AWS account.

That second gap is the one to sit with before flipping this on in a Bedrock deployment with credential rotation. The export command becomes a trusted part of the auth path, and nothing in the PR describes how Codex would catch it handing back the wrong account's keys.