fix(bedrock): prefer HTTP bearer auth when a bearer token is configured (#11562)

Cargo.lock

@@ -5196,6 +5196,7 @@ dependencies = [
  "aws-lc-rs",
  "aws-sdk-bedrockruntime",
  "aws-sdk-sagemakerruntime",
+ "aws-smithy-runtime-api",
  "aws-smithy-types",
  "axum",
  "axum-server",

crates/goose/Cargo.toml

@@ -34,6 +34,7 @@ aws-providers = [
     "dep:aws-config",
     "dep:aws-smithy-types",
     "dep:aws-sdk-bedrockruntime",
+    "dep:aws-smithy-runtime-api",
     "dep:aws-sdk-sagemakerruntime",
     "dep:smithy-transport-reqwest",
 ]
@@ -157,6 +158,7 @@ sqlx = { version = "0.9.0", default-features = false, features = [
 aws-config = { version = "1.8", default-features = false, features = ["credentials-process", "rt-tokio", "sso", "behavior-version-latest"], optional = true }
 aws-smithy-types = { version = "1.3.4", default-features = false, features = ["rt-tokio"], optional = true }
 aws-sdk-bedrockruntime = { version = "1.132", default-features = false, features = ["rt-tokio"], optional = true }
+aws-smithy-runtime-api = { version = "1.13", default-features = false, features = ["client"], optional = true }
 smithy-transport-reqwest = { version = "0.1", default-features = false, features = ["http2", "system-proxy"], optional = true }
 
 # For SageMaker TGI provider (optional, behind "aws-providers" feature)

crates/goose/src/providers/bedrock.rs

@@ -284,6 +284,9 @@ impl BedrockProvider {
                     token.clone(),
                     None,
                 ))
+                .auth_scheme_preference([
+                    aws_smithy_runtime_api::client::auth::http::HTTP_BEARER_AUTH_SCHEME_ID,
+                ])
                 .build();
 
             Client::from_conf(bedrock_config)