openclaw - 💡(How to fix) Fix fix(bedrock): #61194 fix not included in 2026.4.5 build — resolveBedrockConfigApiKey still falls back to "AWS_PROFILE" [1 comments, 1 participants]

Summary

PR #61194 ("Fix/bedrock aws sdk apikey injection") was merged on 2026-04-05T07:24:05Z and should be included in 2026.4.5, but the built artifact still contains the unfixed code.

Evidence

In dist/discovery-Ct-NeLF_.js (installed via npm i -g [email protected]):

function resolveBedrockConfigApiKey(env = process.env) {
	return resolveAwsSdkEnvVarName(env) ?? "AWS_PROFILE";
}

In dist/models-config-DtEglJiL.js:

function resolveAwsSdkApiKeyVarName(env = process.env) {
	return resolveAwsSdkEnvVarName(env) ?? "AWS_PROFILE";
}

Both should return undefined (not "AWS_PROFILE") when no AWS env vars are detected, as the PR intended.

Impact

On EC2 instances using IAM instance roles (no AWS_ACCESS_KEY_ID / AWS_PROFILE env vars):

1. Gateway startup calls resolveBedrockConfigApiKey() → gets "AWS_PROFILE"
2. Writes apiKey: "AWS_PROFILE" into agents/*/agent/models.json
3. Auth resolver sees apiKey: "AWS_PROFILE", isKnownEnvApiKeyMarker() excludes AWS SDK markers → resolveUsableCustomProviderApiKey() returns null
4. All Bedrock models fail: "No API key found for amazon-bedrock"
5. Full fallback chain (Opus 4.6 → Opus 4.5 → Sonnet 4.6 → Sonnet 4.5) exhausted, agent is dead

This is the exact same issue as #49891, #50699, #54274 — the PR was supposed to fix it.

Workaround

A systemd ExecStartPost script deletes apiKey from models.json after gateway starts. This works on 2026.4.2 but not on 4.5 because the plugin extension also injects it via resolveBedrockConfigApiKey() at runtime.

Environment

• OpenClaw 2026.4.5 (npm i -g openclaw@latest)
• EC2 c8i.2xlarge, us-west-2, IMDSv2
• No AWS env vars set — relying on instance role
• Rolled back to 2026.4.2 as workaround

Expected

resolveBedrockConfigApiKey() and resolveAwsSdkApiKeyVarName() should return undefined when no AWS env vars exist, allowing the AWS SDK to resolve credentials via the default provider chain (instance role → ECS task role → etc).

Related

• #61194 (the merged fix that did not make it into the build)
• #49891, #50699, #54274 (original reports)
• #55571 (same root cause in /btw)

/cc @openclaw/providers