[AI GATEWAY] Add AWS Bedrock multi-provider support

[Aakashwije]

Purpose

AWS Bedrock support is required so AI Gateway users can invoke Bedrock models using Amazon Bedrock API keys and expose them through OpenAI-compatible LLM proxies.

This change addresses the following issues:

• The Bedrock provider metadata did not describe Bearer-token authentication.
• Bedrock model identifiers are carried in the request path, but analytics did not support extracting models from pathParam.
• The existing Bedrock model regex used lookbehind, which is unsupported by Go's RE2 regular-expression engine.
• Additional-provider loopback contexts such as /bedrock were embedded in named upstream URLs. Named upstream URLs are host-only, so the context was dropped and multi-provider requests returned HTTP 404.
• Sample configurations were needed for deploying a native Bedrock provider and an OpenAI-to-Bedrock proxy.

Related issue: N/A — no issue link was provided.

Goals

• Support AWS Bedrock API-key authentication using Authorization: Bearer <key>.
• Enable Bedrock model extraction from request paths for analytics.
• Preserve additional-provider contexts during multi-provider routing.
• Support real Bedrock requests through native, single-provider, and multi-provider proxy paths.
• Support OpenAI-compatible non-streaming and streaming Bedrock responses.
• Provide reusable Bedrock provider and proxy samples.
• Add regression coverage for Bedrock analytics and multi-provider base-path handling.

Approach

• Added Bedrock authentication metadata to the platform provider template.

• Replaced the unsupported lookbehind regex with the following RE2-compatible capture-group expression:

  model/([A-Za-z0-9.:-]+)/
  

• Added pathParam analytics extraction using a cached compiled regular expression.

• Passed the request path through buffered and streaming analytics extraction.

• Updated LLM proxy transformation so named additional-provider upstreams:

  • Use a host-only loopback URL.
  • Preserve the provider context in upstreamDefinitions[].basePath.

• Added unit tests covering Bedrock model/token analytics and additional-provider base-path preservation.

• Added sample YAML configurations for:

  • A native AWS Bedrock provider.
  • An OpenAI-to-Bedrock proxy.

No UI changes are included, so no screenshot or animated GIF is required.

User stories

• As a gateway administrator, I can configure an AWS Bedrock provider using a Bedrock API key and a regional runtime endpoint.
• As an API consumer, I can invoke Bedrock through an OpenAI-compatible chat-completions endpoint.
• As an API consumer, I can select Bedrock through the multi-provider x-provider routing header.
• As an API consumer, I can use both non-streaming and streaming Bedrock responses.
• As an operator, I can observe the Bedrock model and token usage in analytics.
• As an operator, I can configure additional providers with non-root contexts without internal loopback routing returning HTTP 404.

Documentation

N/A — no published product-documentation pages are changed.

The PR includes the following configuration samples:

• gateway/examples/bedrock-provider.yaml
• gateway/examples/bedrock-openai-proxy.yaml

Automation tests

Unit tests

The following tests were executed successfully:

cd gateway/gateway-controller

go test ./pkg/utils \
  -run 'TestLLMProviderTransformer_TransformProxy_AdditionalProvider' \
  -count=1

cd gateway/system-policies/analytics

go test ./...

Coverage was added for:

• Bedrock request-model extraction from path parameters.
• Bedrock response-model extraction.
• Bedrock prompt, completion, and total-token extraction.
• Invalid and non-matching path-parameter expressions.
• Additional-provider loopback URL and base-path preservation.

A numerical coverage percentage was not collected.

Integration tests

No new automated integration-test feature was added in this PR.

Manual E2E testing was completed against real provider accounts:

• Direct AWS Bedrock Runtime invocation.
• Native Bedrock provider invocation through the gateway.
• OpenAI-to-Bedrock non-streaming proxy request.
• OpenAI-to-Bedrock streaming proxy request.
• Multi-provider routing using x-provider: bedrock.
• Multi-provider switching between real Anthropic and AWS Bedrock providers.
• Missing consumer API key returned HTTP 401.
• Bedrock streaming produced OpenAI-compatible SSE chunks.
• Bedrock streaming terminated with data: [DONE].
• Streaming responses included model and token-usage information.

Models tested:

• AWS Bedrock: us.amazon.nova-lite-v1:0
• Anthropic routing verification: claude-sonnet-4-5-20250929

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? Yes
• Ran FindSecurityBugs plugin and verified report? No — not applicable because this PR contains no Java changes
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? Yes

The committed sample files contain placeholders only. Real AWS, Anthropic, gateway loopback, and consumer API keys were not committed.

Samples

Native Bedrock provider

File:

gateway/examples/bedrock-provider.yaml

Demonstrates:

• A region-specific Bedrock Runtime endpoint.
• Bearer-token upstream authentication.
• Native /model/{model}/converse and streaming access.
• Gateway consumer API-key authentication.

OpenAI-to-Bedrock proxy

File:

gateway/examples/bedrock-openai-proxy.yaml

Demonstrates:

• An OpenAI-compatible /chat/completions endpoint.
• Proxy-to-provider loopback authentication.
• OpenAI request conversion to Bedrock Converse format.
• Bedrock responses converted into OpenAI-compatible responses.

Related PRs

• Multi-provider routing base branch: wso2/api-platform:multi-provider-routing
• Bedrock transformer policy module: Add the related policy-repository PR link here.
• No other related PRs are currently available.

Test environment

• Operating system: macOS 15.7.7, amd64
• Container runtime: Rancher Desktop
• Docker client: 29.1.4-rd
• Docker context: rancher-desktop
• Gateway version: 1.2.0-M2-SNAPSHOT
• Go version: go1.26.5 darwin/amd64
• Database: Gateway controller default embedded SQLite storage
• JDK: N/A — no Java changes; no JDK installed
• Browser: N/A — API and gateway runtime changes only
• AWS environment: Real AWS account with Amazon Bedrock Runtime access
• AWS model: us.amazon.nova-lite-v1:0
• Additional provider: Real Anthropic API account
• Anthropic model: claude-sonnet-4-5-20250929
• Client tools: curl, jq, and Docker Compose

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: bdaa953e-f6fc-4b89-b7d6-a58ef21b582a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}