fix: support AWS IAM credentials for Bedrock models without LLM_API_KEY

[ixchio]

Hey! 👋

So this PR fixes the issue where you couldn't use AWS Bedrock with the CLI using IAM credentials.

What was happening?

When running openhands --override-with-envs with a Bedrock model, the CLI would complain about missing LLM_API_KEY - but Bedrock doesn't use API keys! It uses AWS IAM credentials instead.

The fix

Now the CLI is smart enough to detect when you're using a Bedrock (or SageMaker) model and won't ask for an API key. It'll use your AWS credentials instead, which can come from:

• Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION_NAME)
• Your ~/.aws/credentials file
• IAM roles if you're on EC2/ECS/Lambda

How to use it

Just set your model and go:

export LLM_MODEL="bedrock/anthropic.claude-3-sonnet"
openhands --override-with-envs

Or with the full ARN like in the issue:

export LLM_MODEL="bedrock/arn:aws-us-gov:bedrock:us-gov-west-1:123456:inference-profile/us-gov.anthropic.claude-sonnet-4-5-20250929-v1:0"
openhands --override-with-envs

No need to set a fake API key or anything like that anymore!

Testing

• All 1275 existing tests pass ✅
• Added 15 new tests for the AWS auth path
• Manually verified with the exact model from the issue

Fixes #611

[enyst]

Thank you for the PR!

I'm a bit curious, do we need to use --override-with-envs for AWS at all?

I believe the SDK has now LLM class attributes for Bedrock, maybe we could use those?

[ixchio]

Thank you for the PR!

I'm a bit curious, do we need to use --override-with-envs for AWS at all?

I believe the SDK has now LLM class attributes for Bedrock, maybe we could use those?

Thanks @enyst, you're right! I checked and the SDK (openhands-sdk v1.16.1) already has native AWS/Bedrock support built into the LLM class:

8 dedicated AWS fields: aws_access_key_id, aws_secret_access_key, aws_session_token, aws_region_name, aws_profile_name, aws_role_name, aws_session_name, aws_bedrock_runtime_endpoint
LLM.load_from_env(prefix="LLM_") auto-reads them from LLM_AWS_* env vars (e.g., LLM_AWS_ACCESS_KEY_ID, LLM_AWS_REGION_NAME)
The LLM constructor already works fine without api_key for bedrock models

So this PR could be simplified significantly. The only thing the CLI really needs to fix is:

Don't require LLM_API_KEY when the model has a bedrock/ or sagemaker/ prefix
Let the SDK handle the rest — users can set LLM_AWS_ACCESS_KEY_ID, LLM_AWS_REGION_NAME, etc., and LLM.load_from_env() picks them up, or boto3's default credential chain handles ~/.aws/credentials / IAM roles automatically

I'll simplify the PR to remove the custom AWS credential plumbing from LLMEnvOverrides and just lean on the SDK's existing support. Want me to go that route?