Bedrock AWS_PROFILE authentication is sent as an invalid bearer token

[ribelo]

After commit 3ea064ea (“support Bedrock API key login”), Bedrock requests using AWS_PROFILE fail with:

AccessDeniedException: 403

Reproduction

export AWS_PROFILE=my-profile

pi \
  --provider amazon-bedrock \
  --model 'arn:aws:bedrock:us-east-1:123456789012:application-inference-profile/example' \
  -p 'hi'

The same profile and model work through the AWS SDK and AWS CLI.

Observed behavior

Pi sends its internal ambient-auth value, <authenticated>, as a bearer token. AWS rejects the request with 403.

Expected behavior

• Bedrock API keys use bearer authentication.
• AWS_PROFILE, IAM credentials, and role credentials use AWS request signing.
• Internal authentication state is not sent to AWS.

[ribelo]

@mitsuhiko Can I handle this? I'm in the middle of fixing my AI-generated slop in the PR draft ; P

[mitsuhiko]

@ribelo yes, i'm fixing it :)