[keyuchen21]

Summary

Design-only draft for Amazon Bedrock with IAM Identity Center, as asked in #6072. It defines the contract for review before any implementation (docs/architecture/amazon-bedrock-sso-auth-design.md):

• Separate entries per auth method. amazon-bedrock (IAM Identity Center → SigV4) sits next to amazon-bedrock-api-key from feat(providers): add Azure Foundry and Bedrock API-key connections #6032. Each providerType keeps exactly one authKind; existing API-key connections coexist with no migration.
• Runtime Host owns the device flow, refresh, and short-lived role credentials. Role credentials stay in Host memory and never cross the protocol. Desktop and the CLI show only the user code and verification URL, which also covers a remote (SSH) Host.
• Contract: a cloud_identity auth kind, a cloud_identity_session vault kind that configuration.credentials.export rejects, one cloud_identity.* operation family with exact/bounded projections, and an epoch raise in the first code slice.
• Invariants I1–I13 carry every review finding from feat(provider): add Amazon Bedrock IAM Identity Center SSO #3370 (admission lease, attempt-wide abort, identity-bound commit, shutdown-tracked commit, durable-outcome-first with activation poisoning, ambient-credential suppression, export denial, canonical re-authorization, bounded refresh), each mapped to a required regression test.
• Delivery slices S1–S3. Scope rules from the feat(provider): add Amazon Bedrock IAM Identity Center SSO #3370 review are kept: no unrelated Claude subscription surface, one SECURITY.md description, metadata through the existing sync:model-metadata authority, ASF headers, and screenshots for the Settings flow.

Azure AI Foundry with Entra ID (azure-foundry-entra) is out of scope. §10 notes how a later entry can reuse the same auth kind, vault kind, and operation family. Open questions are in §11 (Host credential chain, operation family name).

Refs #6072, #3370, #6032.

Verification

• npm run check:asf-headers passes.
• Documentation only; no code, tests, or behavior change.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code helped draft the design document from the #6072 discussion and the #3370 review history; I reviewed the content.

Checklist

• Tests cover the change and fail without it — n/a, documentation only
• Lint, format, typecheck and the affected suites pass locally — ASF header check only

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

🤖 Generated with Claude Code