spring-projects / spring-projects/spring-ai

BedrockKnowledgeBaseVectorStoreAutoConfiguration ignores existing AwsCredentialsProvider bean

Open
#5,768 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage
Dominant language
Java
Stars
9.5k
Forks
2.9k
Avg merge
1d 10h
Merged PRs (30d)
5

Description

Bug description

When using Spring Cloud AWS for credential management (spring.cloud.aws.credentials), the Bedrock Converse chat model works correctly but the Bedrock Knowledge Base vector store fails with SdkClientException: Unable to load credentials

it's look like BedrockKnowledgeBaseVectorStoreAutoConfiguration creates its BedrockAgentRuntimeClient and ignore AwsCredentialsProvider

Environment

  • Spring AI: 2.0.0-M4
  • Spring Boot: 3.x
  • Spring Cloud AWS 4.0.1

Steps to reproduce

  1. Configure Spring Cloud AWS credentials:
  spring:                                                                                                                                                                                                                              
    cloud:                                                                                                                                                                                                                             
      aws:                                                                                                                                                                                                                         
        credentials:
          access-key: <key>                                                                                                                                                                                                            
          secret-key: <secret>                                                                                                                                                                                                         
    ai:                                                                                                                                                                                                                                
      bedrock:                                                                                                                                                                                                                         
        converse:                                                                                                                                                                                                                  
          chat:
            options:
              model: eu.anthropic.claude-opus-4-6-v1                                                                                                                                                                                   
      vectorstore:                                                                                                                                                                                                                     
        bedrock-knowledge-base:                                                                                                                                                                                                        
          knowledge-base-id: <id>                                                                                                                                                                                                      
          region: eu-central-2             
  1. Use both ChatClient (Bedrock Converse) and VectorStore (Bedrock Knowledge Base) in the same application.
  2. Do not set AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY environment variables or any other SDK-level credential source
  3. Call an endpoint that triggers a Knowledge Base similarity search.

Expected behavior

The Knowledge Base vector store should use the same AwsCredentialsProvider bean as the Converse chat model, since both are Bedrock integrations within the same application context.

Minimal Complete Reproducible example

  @Configuration                                                                                                                                                                                                                       
  public class AiConfiguration {                                                                                                                                                                                                   

      @Bean
      public ChatClient chatClient(ChatClient.Builder builder, VectorStore vectorStore) {
          return builder
                  // if you comment this, it's working fine
                  .defaultAdvisors(
                          QuestionAnswerAdvisor.builder(vectorStore)
                                  .searchRequest(SearchRequest.builder().topK(5).build())                                                                                                                                              
                                  .build()                                                                                                                                                                                             
                  )                                                                                                                                                                                                                    
                  .build();                                                                                                                                                                                                            
      }                                                                                                                                                                                                                            
  }
                                                                                                                                                                                                                                       
  @RestController                                                                                                                                                                                                                      
  public class ChatController {                                                                                                                                                                                                        
                                                                                                                                                                                                                                       
      private final ChatClient chatClient;                                                                                                                                                                                         

      @PostMapping("/chat")
      public String chat(@RequestBody String message) {                                                                                                                                                                                
          // This fails with SdkClientException on the Knowledge Base similarity search                                                                                                                                                
          // even though the Converse chat model credentials work fine                                                                                                                                                                 
          return chatClient.prompt().user(message).call().content();                                                                                                                                                                   
      }                                                                                                                                                                                                                                
  }        

Workaround

Define a custom BedrockAgentRuntimeClient bean that injects the existing AwsCredentialsProvider:

  @Bean                                                                                                                                                                                                                                
  public BedrockAgentRuntimeClient bedrockAgentRuntimeClient(AwsCredentialsProvider credentialsProvider) {                                                                                                                         
      return BedrockAgentRuntimeClient.builder()                                                                                                                                                                                       
              .region(Region.EU_CENTRAL_2)                                                                                                                                                                                             
              .credentialsProvider(credentialsProvider)                                                                                                                                                                                
              .build();                                                                                                                                                                                                                
  }

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with BedrockKnowledgeBaseVectorStoreAutoConfiguration and compare how it creates BedrockAgentRuntimeClient with the credential setup used by the Bedrock Converse chat model. Reproduce the failure using the Spring Cloud AWS credentials configuration and verify that Knowledge Base similarity search uses the existing AwsCredentialsProvider bean without environment credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java, spring, spring-boot
Domain
backend, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.