{"version":"2.1.318","anchor":"bedrock-style-assume-rolebearer-token-check-extended-to-ma","canonical_anchor":"bedrock-style-assume-rolebearer-token-check-extended-to-ma","heading":"Gateway assume_role checks now cover the mantle provider","tier":"notice","area":"Bedrock","scope":"org","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318\/e\/bedrock-style-assume-rolebearer-token-check-extended-to-ma","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318","markdown":"### Gateway assume_role checks now cover the mantle provider\n\nConfiguration checks on assume_role now cover mantle as well as bedrock providers, and the session_name mismatch warning works in both directions\n\n**What**\n\nA gateway sits between Claude Code and the model provider, and each provider it forwards requests to is called an upstream. Two configuration checks on its upstreams changed. `assume_role` is the setting that tells an upstream which AWS role to sign in as.\n\n- The check that rejects `assume_role` combined with `aws_bearer_token` used to apply only to providers named `bedrock`. It now applies to providers named `mantle` too, and it now checks each entry's own provider.\n\n- The warning for a mantle and bedrock upstream pair now works both ways. Before, it fired only when the mantle upstream was paired with a bedrock upstream that set `assume_role.session_name`. It now fires whenever one of the pair sets `assume_role.session_name` and the other sets none.\n\n- The reworded message tells you to set `assume_role` (`role_arn` and `session_name`) on the other upstream too.\n\n**Why**\n\nIf you run a gateway with mantle or bedrock upstreams, mismatched or conflicting authentication settings are now caught in more cases. The new warning also tells you exactly what to add.\n\n- Area: Bedrock\n- Names: `assume_role`, `aws_bearer_token`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 3\/5\n- Scope: org\n- Heads-up: yes"}