chore: pass bedrock_client with UNSIGNED to prevent IMDS timeout from langchain_aws (#693)

Author: cosmin-staicu

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "uipath-langchain"
-version = "0.8.23"
+version = "0.8.24"
 description = "Python SDK that enables developers to build and deploy LangGraph agents to the UiPath Cloud Platform"
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.11"

src/uipath_langchain/chat/bedrock.py

@@ -95,20 +95,26 @@ def _capture_response_headers(self, parsed, model, **kwargs):
             if self.header_capture:
                 self.header_capture.set(dict(headers))
 
-    def get_client(self):
-        session = boto3.Session(
+    def _build_session(self):
+        return boto3.Session(
             aws_access_key_id="none",
             aws_secret_access_key="none",
             region_name="none",
         )
+
+    def _unsigned_config(self, **overrides):
+        return botocore.config.Config(
+            signature_version=botocore.UNSIGNED,
+            **overrides,
+        )
+
+    def get_client(self):
+        session = self._build_session()
         client = session.client(
             "bedrock-runtime",
-            config=botocore.config.Config(
-                retries={
-                    "total_max_attempts": 1,
-                },
+            config=self._unsigned_config(
+                retries={"total_max_attempts": 1},
                 read_timeout=300,
-                signature_version=botocore.UNSIGNED,
             ),
         )
         client.meta.events.register(
@@ -119,6 +125,13 @@ def get_client(self):
         )
         return client
 
+    def get_bedrock_client(self):
+        session = self._build_session()
+        return session.client(
+            "bedrock",
+            config=self._unsigned_config(),
+        )
+
     def _modify_request(self, request, **kwargs):
         """Intercept boto3 request and redirect to LLM Gateway."""
         # Detect streaming based on URL suffix:
@@ -186,8 +199,8 @@ def __init__(
             byo_connection_id=byo_connection_id,
         )
 
-        client = passthrough_client.get_client()
-        kwargs["client"] = client
+        kwargs["client"] = passthrough_client.get_client()
+        kwargs["bedrock_client"] = passthrough_client.get_bedrock_client()
         kwargs["model"] = model_name
         super().__init__(**kwargs)
         self.model = model_name
@@ -251,8 +264,8 @@ def __init__(
             header_capture=header_capture,
         )
 
-        client = passthrough_client.get_client()
-        kwargs["client"] = client
+        kwargs["client"] = passthrough_client.get_client()
+        kwargs["bedrock_client"] = passthrough_client.get_bedrock_client()
         kwargs["model"] = model_name
         kwargs["header_capture"] = header_capture
         super().__init__(**kwargs)

tests/chat/test_bedrock.py

@@ -11,11 +11,22 @@
 from uipath_langchain.chat.bedrock import (
     AwsBedrockCompletionsPassthroughClient,
     UiPathChatBedrock,
+    UiPathChatBedrockConverse,
 )
 
 
 class TestGetClientSkipsImds:
-    def test_client_creation_does_not_trigger_credential_resolution(self, caplog):
+    def _assert_no_credential_resolution(self, caplog, client):
+        assert caplog.records
+        credential_log_records = [
+            r for r in caplog.records if r.name.startswith("botocore.credentials")
+        ]
+        assert not credential_log_records, (
+            f"Unexpected credential resolution: {[r.getMessage() for r in credential_log_records]}"
+        )
+        assert client._request_signer._signature_version == botocore.UNSIGNED
+
+    def test_get_client_does_not_trigger_credential_resolution(self, caplog):
         passthrough = AwsBedrockCompletionsPassthroughClient(
             model="anthropic.claude-haiku-4-5-20251001",
             token="test-token",
@@ -25,14 +36,65 @@ def test_client_creation_does_not_trigger_credential_resolution(self, caplog):
         with caplog.at_level(logging.DEBUG, logger="botocore"):
             client = passthrough.get_client()
 
+        self._assert_no_credential_resolution(caplog, client)
+
+    def test_get_bedrock_client_does_not_trigger_credential_resolution(self, caplog):
+        passthrough = AwsBedrockCompletionsPassthroughClient(
+            model="anthropic.claude-haiku-4-5-20251001",
+            token="test-token",
+            api_flavor="converse",
+        )
+
+        with caplog.at_level(logging.DEBUG, logger="botocore"):
+            client = passthrough.get_bedrock_client()
+
+        self._assert_no_credential_resolution(caplog, client)
+
+    @patch.dict(
+        os.environ,
+        {
+            "UIPATH_URL": "https://example.com",
+            "UIPATH_ORGANIZATION_ID": "org",
+            "UIPATH_TENANT_ID": "tenant",
+            "UIPATH_ACCESS_TOKEN": "token",
+        },
+    )
+    def test_uipath_chat_bedrock_converse_init_does_not_trigger_credential_resolution(
+        self, caplog
+    ):
+        with caplog.at_level(logging.DEBUG, logger="botocore"):
+            UiPathChatBedrockConverse()
+
+        assert caplog.records
+        credential_log_records = [
+            r for r in caplog.records if r.name.startswith("botocore.credentials")
+        ]
+        assert not credential_log_records, (
+            f"Unexpected credential resolution: {[r.getMessage() for r in credential_log_records]}"
+        )
+
+    @patch.dict(
+        os.environ,
+        {
+            "UIPATH_URL": "https://example.com",
+            "UIPATH_ORGANIZATION_ID": "org",
+            "UIPATH_TENANT_ID": "tenant",
+            "UIPATH_ACCESS_TOKEN": "token",
+        },
+    )
+    def test_uipath_chat_bedrock_init_does_not_trigger_credential_resolution(
+        self, caplog
+    ):
+        with caplog.at_level(logging.DEBUG, logger="botocore"):
+            UiPathChatBedrock()
+
         assert caplog.records
         credential_log_records = [
             r for r in caplog.records if r.name.startswith("botocore.credentials")
         ]
         assert not credential_log_records, (
             f"Unexpected credential resolution: {[r.getMessage() for r in credential_log_records]}"
         )
-        assert client._request_signer._signature_version == botocore.UNSIGNED
 
 
 class TestConvertFileBlocksToAnthropicDocuments: