opencode-bedrock-sso

OpenCode plugin that checks AWS credentials before Amazon Bedrock requests and runs aws sso login when the current AWS SSO session has expired.

Why

Without this plugin, the annoying flow is:

1. Send an OpenCode message.
2. Wait for Bedrock to fail because the AWS session expired.
3. Leave OpenCode and run aws sso login.
4. Restart or resume OpenCode.

This plugin moves the check before the Bedrock request.

Install

Add the plugin to opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "amazon-bedrock": {
      "options": {
        "profile": "bedrock",
        "region": "us-east-1"
      }
    }
  },
  "plugin": [
    ["opencode-bedrock-sso@latest", { "profile": "bedrock", "region": "us-east-1" }]
  ]
}

Restart OpenCode after changing plugin config.

Requirements

• OpenCode with Amazon Bedrock configured as a provider.
• AWS CLI v2 available on PATH as aws, unless awsCommand is configured.
• An AWS SSO profile configured in ~/.aws/config.

Options

type Options = {
  providerID?: string
  profile?: string
  region?: string
  awsCommand?: string
  checkCommand?: string[]
  loginCommand?: string[]
  loginTimeoutMs?: number
  checkTimeoutMs?: number
  minCheckIntervalMs?: number
  loginStdio?: "pipe" | "inherit"
  force?: boolean
}

Defaults:

• providerID: amazon-bedrock
• awsCommand: aws
• region: us-east-1
• checkCommand: sts get-caller-identity --profile <profile> --output json
• loginCommand: sso login --profile <profile>
• loginStdio: pipe
• checkTimeoutMs: 30000
• loginTimeoutMs: 600000
• minCheckIntervalMs: 300000

Profile resolution order:

1. Plugin option profile
2. provider.amazon-bedrock.options.profile
3. AWS_PROFILE

Region resolution order:

1. Plugin option region
2. provider.amazon-bedrock.options.region
3. AWS_REGION
4. us-east-1

Behavior

For each Bedrock chat request, the plugin runs aws sts get-caller-identity unless the same profile/region already passed a check within minCheckIntervalMs. Concurrent requests for the same profile/region share one in-flight check or login attempt.

When the check fails, it runs aws sso login with piped output so AWS CLI messages do not corrupt the OpenCode TUI. After login, it verifies credentials again before allowing the Bedrock request through.

If your environment does not open the browser automatically and you need to see AWS CLI's device-code URL in the terminal, opt into inherited output:

{
  "plugin": [
    ["opencode-bedrock-sso@latest", { "profile": "bedrock", "loginStdio": "inherit" }]
  ]
}

The plugin shows temporary OpenCode TUI toasts for login state changes:

• AWS session expired and login is starting. This toast lasts for loginTimeoutMs so the waiting state stays visible.
• Bedrock request is paused while waiting for AWS SSO login to complete. This toast also lasts for loginTimeoutMs.
• AWS session refreshed and the Bedrock request is continuing
• Login/check failed

Healthy preflight checks stay silent.

The plugin intentionally no-ops when these non-SSO credential sources are present:

• AWS_BEARER_TOKEN_BEDROCK
• AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
• ECS container credential environment variables
• Web identity environment variables

Limitations

• aws sso login runs inside the OpenCode process. By default its output is captured to avoid disturbing the TUI.
• A profile is required for the default login command. Set plugin option profile, Bedrock provider option profile, or AWS_PROFILE.
• This is a preflight plugin, not a provider retry plugin. If Bedrock fails for non-auth reasons, OpenCode still surfaces the provider error.

Local Development

Build the plugin locally:

npm install
npm run build

Then load the local build from opencode.json:

{
  "plugin": [
    ["/path/to/opencode-bedrock-sso/dist/index.js", { "profile": "bedrock" }]
  ]
}