feat: Update AWS KB retrieval server with improved credential handling

The commit message captures the key changes made to the AWS Knowledge Base retrieval server:

1. Enhanced credential handling by supporting multiple authentication methods:
   - Explicit AWS access key and secret key
   - AWS profile credentials
   - AWS provider chain (e.g., EC2 IAM roles)

2. Added more robust error logging for credential loading
3. Configured longer timeouts for network requests
4. Updated dependencies to support new credential providers

The changes improve the flexibility and reliability of AWS credential management in the server.

Author: zxkane

src/aws-kb-retrieval-server/README.md

@@ -55,8 +55,9 @@ Add this to your `claude_desktop_config.json`:
         "@modelcontextprotocol/server-aws-kb-retrieval"
       ],
       "env": {
-        "AWS_ACCESS_KEY_ID": "YOUR_ACCESS_KEY_HERE",
-        "AWS_SECRET_ACCESS_KEY": "YOUR_SECRET_ACCESS_KEY_HERE",
+        "AWS_ACCESS_KEY_ID": "YOUR_ACCESS_KEY_HERE", // optional, if using AWS_PROFILE or run it on EC2 with IAM role
+        "AWS_SECRET_ACCESS_KEY": "YOUR_SECRET_ACCESS_KEY_HERE", // optional, if using AWS_PROFILE or run it on EC2 with IAM role
+        "AWS_PROFILE": "YOUR_AWS_PROFILE_HERE",  // optional, if running it on EC2 with IAM role
         "AWS_REGION": "YOUR_AWS_REGION_HERE"
       }
     }

src/aws-kb-retrieval-server/index.ts

@@ -11,14 +11,39 @@ import {
   RetrieveCommand,
   RetrieveCommandInput,
 } from "@aws-sdk/client-bedrock-agent-runtime";
+import { NodeHttpHandler } from "@smithy/node-http-handler";
+import { fromNodeProviderChain, fromIni } from "@aws-sdk/credential-providers";
 
+const AWS_REGION = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
+const AWS_PROFILE = process.env.AWS_PROFILE || 'default';
 // AWS client initialization
 const bedrockClient = new BedrockAgentRuntimeClient({
-  region: process.env.AWS_REGION,
-  credentials: {
-    accessKeyId: process.env.AWS_ACCESS_KEY_ID!,
-    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,
+  region: AWS_REGION,
+  maxAttempts: 3,
+  // Try explicit profile credentials first, then fall back to provider chain
+  credentials: async () => {
+    try {
+      // First try loading from profile
+      const profileCreds = await fromIni({ profile: AWS_PROFILE })();
+      console.error('Successfully loaded credentials from profile');
+      return profileCreds;
+    } catch (error) {
+      console.error('Failed to load profile credentials, falling back to provider chain:', error);
+      try {
+        // Fall back to provider chain
+        const chainCreds = await fromNodeProviderChain()();
+        console.error('Successfully loaded credentials from provider chain');
+        return chainCreds;
+      } catch (error) {
+        console.error('Failed to load credentials from provider chain:', error);
+        throw error;
+      }
+    }
   },
+  requestHandler: new NodeHttpHandler({
+    connectionTimeout: 10000, // 10 seconds connection timeout
+    requestTimeout: 300000, // 5 minutes request timeout
+  })
 });
 
 interface RAGSource {

src/aws-kb-retrieval-server/package.json

@@ -19,12 +19,13 @@
     "watch": "tsc --watch"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "0.5.0",
-    "@aws-sdk/client-bedrock-agent-runtime": "^3.0.0"
+    "@aws-sdk/client-bedrock-agent-runtime": "^3.0.0",
+    "@aws-sdk/credential-providers": "^3.750.0",
+    "@modelcontextprotocol/sdk": "0.5.0"
   },
   "devDependencies": {
     "@types/node": "^22",
     "shx": "^0.3.4",
     "typescript": "^5.6.2"
   }
-}
+}