Add AWS STS AssumeRole configuration UI for AWS Bedrock endpoints - #1397
Open
e19166 wants to merge 4 commits into
Open
Add AWS STS AssumeRole configuration UI for AWS Bedrock endpoints#1397e19166 wants to merge 4 commits into
e19166 wants to merge 4 commits into
Conversation
e19166
requested review from
HeshanSudarshana,
Krishanx92,
PasanT9,
RakhithaRR,
ashera96,
hisanhunais,
lasanthaS,
piyumaldk and
tharikaGitHub
as code owners
July 19, 2026 19:43
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds stored and environment AWS credentials, optional STS AssumeRole fields, conditional validation, shared persistence, SigV4 reachability handling, localized labels, and Cypress coverage for Bedrock endpoints. ChangesAWS AI endpoint authentication
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant AddEditAIEndpoint
participant EndpointSecurityState
participant AWS_SigV4_Endpoint
AddEditAIEndpoint->>EndpointSecurityState: Hydrate AWS credentials and AssumeRole settings
EndpointSecurityState-->>AddEditAIEndpoint: Return masked security values
AddEditAIEndpoint->>AWS_SigV4_Endpoint: Test endpoint
AWS_SigV4_Endpoint-->>AddEditAIEndpoint: Return reachability status
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Jul 19, 2026
e19166
force-pushed
the
main
branch
8 times, most recently
from
July 26, 2026 04:57
3b4719b to
4f4812d
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@portals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AIEndpoints/AddEditAIEndpoint.jsx`:
- Around line 303-331: Reset all endpoint security state to its default values
at the start of hydrateEndpointSecurityState before applying values from
securityConfig, including assumeRole, authType, roleArn, roleRegion,
roleExternalId, accessKey, secretKey, and region. Ensure both dispatched-config
and fetched-endpoint load paths use this reset-and-override behavior so missing
fields cannot retain values from the previously edited endpoint.
- Around line 1320-1410: Update the Role ARN and Role Region TextFields in the
assumeRole section to bind their validation state to the existing
roleArn/roleRegion errors, using error and helperText props consistent with the
form’s other validated fields. Ensure empty required values visibly show the
corresponding validation message while preserving the existing formHasErrors
Save behavior.
In
`@tests/cypress/e2e/publisher/023-ai-api-create/01-aws-bedrock-endpoint-auth.cy.js`:
- Around line 19-26: Add an explicit conditional skip to the Bedrock provider
setup before `createBedrockAPI` or `selectAutocompleteOption` attempts to choose
a matching option. Detect whether a registered provider matches `/bedrock/i`;
skip the spec when none exists, while preserving the existing form assertions
when a provider is available. Update the header comment only if needed to
accurately describe the implemented behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: c1e546e2-ebd7-43bc-b0eb-1982d2d5733a
📒 Files selected for processing (3)
portals/publisher/src/main/webapp/site/public/locales/en.jsonportals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AIEndpoints/AddEditAIEndpoint.jsxtests/cypress/e2e/publisher/023-ai-api-create/01-aws-bedrock-endpoint-auth.cy.js
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
portals/publisher/src/main/webapp/site/public/locales/en.json (1)
1085-1085: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUse one stable message ID for the access URL label.
The call sites split between two formatted IDs that only differ in trailing newline/indentation, while the locale contains both malformed entries. Use the same normalized ID,
Apis.Details.Environments.Environments.select.vhost, for both call sites and the locale entry.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@portals/publisher/src/main/webapp/site/public/locales/en.json` at line 1085, Normalize the access URL localization key to `Apis.Details.Environments.Environments.select.vhost` everywhere: update both call sites and replace the malformed locale entry in the translations. Remove the variants containing trailing newline or indentation so all references use one stable message ID.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@portals/publisher/src/main/webapp/site/public/locales/en.json`:
- Line 891: Restore the missing spaces in the IAM-role tooltip text: update the
locale value in portals/publisher/src/main/webapp/site/public/locales/en.json at
lines 891-891 to use “securely manage temporary credentials”, and update the
concatenated tooltip fragments in
portals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AWSLambda/Credentials.jsx
at lines 173-175 to include the same spaces.
---
Outside diff comments:
In `@portals/publisher/src/main/webapp/site/public/locales/en.json`:
- Line 1085: Normalize the access URL localization key to
`Apis.Details.Environments.Environments.select.vhost` everywhere: update both
call sites and replace the malformed locale entry in the translations. Remove
the variants containing trailing newline or indentation so all references use
one stable message ID.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: ede2af80-9faa-4127-874e-4fe07051fe8c
📒 Files selected for processing (7)
portals/admin/src/main/webapp/site/public/locales/en.jsonportals/admin/src/main/webapp/site/public/locales/fr.jsonportals/devportal/src/main/webapp/site/public/locales/en.jsonportals/publisher/src/main/webapp/site/public/locales/en.jsonportals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AIEndpoints/AddEditAIEndpoint.jsxportals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AWSLambda/Credentials.jsxtests/cypress/e2e/publisher/023-ai-api-create/01-aws-bedrock-endpoint-auth.cy.js
🚧 Files skipped from review as they are similar to previous changes (1)
- tests/cypress/e2e/publisher/023-ai-api-create/01-aws-bedrock-endpoint-auth.cy.js
e19166
force-pushed
the
main
branch
2 times, most recently
from
August 3, 2026 09:05
4c4d35b to
d9cd463
Compare
ashera96
previously approved these changes
Aug 3, 2026
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
portals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AIEndpoints/AddEditAIEndpoint.jsx (1)
1370-1441: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winSurface validation errors when Save is disabled.
The button disables on
formHasErrors(true), but rendered field errors usevalidating.validatingbecomes true only informSave. On an initially invalid form, the disabled button preventsformSavefrom activating validation feedback.The Access Key, Secret Key, and Region fields also have no
errororhelperTextbindings. Use one active validation state for the button and all field-level validators. The Role ARN and Role Region controls already have the required bindings.Also applies to: 1584-1587
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@portals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AIEndpoints/AddEditAIEndpoint.jsx` around lines 1370 - 1441, Unify the validation state used by the Save button’s formHasErrors check and field-level rendering so initially invalid forms display feedback even while Save is disabled. Bind the Access Key, Secret Key, and Region TextFields to that same state with error and helperText, matching the existing Role ARN and Role Region bindings. Update validating/formSave usage so validation activates consistently without changing the existing validation rules.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In
`@portals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AIEndpoints/AddEditAIEndpoint.jsx`:
- Around line 1370-1441: Unify the validation state used by the Save button’s
formHasErrors check and field-level rendering so initially invalid forms display
feedback even while Save is disabled. Bind the Access Key, Secret Key, and
Region TextFields to that same state with error and helperText, matching the
existing Role ARN and Role Region bindings. Update validating/formSave usage so
validation activates consistently without changing the existing validation
rules.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 629a9763-944a-4e12-911a-e39d810aa30b
📒 Files selected for processing (4)
portals/publisher/src/main/webapp/site/public/locales/en.jsonportals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AIEndpoints/AddEditAIEndpoint.jsxportals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AWSLambda/Credentials.jsxtests/cypress/e2e/publisher/023-ai-api-create/01-aws-bedrock-endpoint-auth.cy.js
🚧 Files skipped from review as they are similar to previous changes (2)
- portals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AWSLambda/Credentials.jsx
- portals/publisher/src/main/webapp/site/public/locales/en.json
ashera96
approved these changes
Aug 5, 2026
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue: wso2/api-manager#5154
Purpose
Extends the AWS Bedrock (AWS SigV4) AI endpoint configuration in the Publisher with two
additional ways to authenticate to AWS, on top of the existing static access/secret keys:
IAM role.
(EC2 instance profile / EKS IRSA) instead of storing any keys.
Both are the UI counterpart of the gateway/backend support (see related PRs).
What changed
AddEditAIEndpoint.jsx(AWS SigV4 auth section):1. STS AssumeRole
External ID fields.
roleArn/roleRegionare required when the toggle is on; the role config is persistedand hydrated on edit.
overwrites the stored secret with the masked
********placeholder.2. Environment credentials
an
authTypefield (stored|environment).validation is skipped (no keys are needed).
authTypeis included in the saved endpoint-security payload and hydrated on edit.Region and Service remain required in all modes.
site/public/locales/en.jsonuseEnvironmentCredentialsoption.Behaviour
Backward compatible: when
authTypeis absent and no role is configured (existingendpoints), the UI behaves exactly as before (stored keys, no role).
Related PRs (feature spans three repos)
AWSSigV4Signer(AssumeRole via STS + environment credentialsvia the AWS SDK default provider chain, incl. session-token signing),
authTypeplumbing,and publisher secret-handling for both modes. Add role assume feature for bedrock endpoints carbon-apimgt#13928
authType/role properties andmakes the key properties conditional. Wire AWS STS AssumeRole properties into the AI API endpoint sequence template product-apim#14266