Self Checks

• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report (Language Policy).
• Non-english title submitions will be closed directly ( 非英文标题的提交将会被直接关闭 ) (Language Policy).
• Please do not modify this template :) and fill in all the required fields.

Is your feature request related to a problem?

Yes. In enterprise environments, AWS credentials (Access Key and Secret Key) are often not directly provided to applications. Instead, organizations enforce the use of IAM Assumed Roles for security and compliance reasons. Currently, RAGFlow's Bedrock integration requires bedrock_ak and bedrock_sk as mandatory fields, which prevents users in such environments from using Bedrock models.

Describe the feature you'd like

Add support for AWS IAM Assumed Role authentication for Bedrock integration. This would allow users to use Bedrock without providing explicit Access Key and Secret Key credentials.

The feature should:

1. Make bedrock_ak and bedrock_sk fields optional in the UI
2. When credentials are not provided, use the default AWS credential chain (environment variables, IAM role, instance profile, etc.)
3. Optionally support specifying an IAM Role ARN to assume

Describe implementation you've considered

Backend:

The BedrockEmbed class in rag/llm/embedding_model.py already has partial support for this:

if self.bedrock_ak == "" or self.bedrock_sk == "" or self.bedrock_region == "":
    self.client = boto3.client("bedrock-runtime")
else:
    self.client = boto3.client(...)

However, the LiteLLMBase class in rag/llm/chat_model.py always passes credentials to litellm:

completion_args.update({
    "aws_access_key_id": self.bedrock_ak,
    "aws_secret_access_key": self.bedrock_sk,
    "aws_region_name": self.bedrock_region,
})

Suggested changes:

1. Modify _construct_completion_args() to only include AWS credentials if they are provided
2. When credentials are empty, let boto3/litellm use the default credential provider chain_

Frontend (React):

1. Remove required: true validation from bedrock_ak and bedrock_sk fields in bedrock-modal/index.tsx
2. Add a note explaining that credentials are optional if using IAM roles

Documentation, adoption, use case

Use Cases:

- Enterprise environments: Companies using AWS Organizations with centralized IAM policies
- EKS/ECS deployments: Applications running on AWS with IAM Roles for Service Accounts (IRSA) or Task Roles
- EC2 instances: Applications using Instance Profiles
- Local development: Developers using aws configure or AWS_PROFILE environment variable

Example scenario: A company deploys RAGFlow on Amazon EKS. The pod has an IAM service account with permissions to invoke Bedrock. They cannot use Access Keys due to security policies, but the current implementation requires them.

Additional information

No response