fix(aws): keep the default chain outside workload identity and cover ses

getAwsCredentials returned explicit static keys when present, which dropped
AWS_SESSION_TOKEN for clients that used to reach it through the default chain
(Bedrock, CloudWatch). It now returns the workload-identity provider or
undefined, so every non-Trigger path resolves exactly as before. The SES email
client reads it too, so worker email keeps working once static keys leave
Trigger.dev. The release-age comment records why the exclusions are bare names.

Author: waleedlatif1

apps/sim/lib/core/config/aws.ts

@@ -4,11 +4,6 @@ import { env } from '@/lib/core/config/env'
 
 const logger = createLogger('AwsCredentials')
 
-interface StaticAwsCredentials {
-  accessKeyId: string
-  secretAccessKey: string
-}
-
 type AwsCredentialsProvider = () => Promise<AWSCredentials>
 
 /**
@@ -76,27 +71,20 @@ function resolveWorkloadCredentials(
 }
 
 /**
- * Credentials for Sim's own AWS clients: file storage (S3), AppConfig, hosted-key metrics and
- * hosted Bedrock. Never for a user's integration, which brings its own keys.
+ * Credentials for Sim's own AWS clients: file storage (S3), AppConfig, email (SES), hosted-key
+ * metrics and hosted Bedrock. Never for a user's integration, which brings its own keys.
  *
- * - `TRIGGER_AWS_ROLE_ARN` set (deployed Trigger.dev runs): temporary credentials for that role,
- *   exchanged for the run's Trigger.dev workload-identity token. Takes precedence over static
- *   keys, so a failed exchange surfaces instead of silently falling back to a stored key.
- * - `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` set: those keys (self-hosted deployments).
- * - Neither: `undefined`, deferring to the AWS default provider chain (the ECS task role).
+ * With `TRIGGER_AWS_ROLE_ARN` set (deployed Trigger.dev runs), temporary credentials for that
+ * role, exchanged for the run's Trigger.dev workload-identity token. It takes precedence over any
+ * static keys in the environment, so a failed exchange surfaces instead of silently falling back
+ * to a stored key. Otherwise `undefined`: the AWS SDK's default chain, which reads
+ * `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` and `AWS_SESSION_TOKEN`, then shared profiles, then
+ * the ECS task role.
  */
-export function getAwsCredentials(): StaticAwsCredentials | AwsCredentialsProvider | undefined {
+export function getAwsCredentials(): AwsCredentialsProvider | undefined {
   const roleArn = env.TRIGGER_AWS_ROLE_ARN
-  if (roleArn) {
-    return () => resolveWorkloadCredentials(roleArn, REFRESH_BEFORE_EXPIRY_MS)
-  }
-  if (env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) {
-    return {
-      accessKeyId: env.AWS_ACCESS_KEY_ID,
-      secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
-    }
-  }
-  return undefined
+  if (!roleArn) return undefined
+  return () => resolveWorkloadCredentials(roleArn, REFRESH_BEFORE_EXPIRY_MS)
 }
 
 /** Whether Sim's own AWS clients have credentials of their own rather than the default chain. */

apps/sim/lib/messaging/email/providers/ses.ts

@@ -1,20 +1,22 @@
 import { SESv2Client, SendEmailCommand } from '@aws-sdk/client-sesv2'
 import nodemailer from 'nodemailer'
 import type SESTransport from 'nodemailer/lib/ses-transport'
+import { getAwsCredentials } from '@/lib/core/config/aws'
 import { env } from '@/lib/core/config/env'
 import { sendViaNodemailer } from '@/lib/messaging/email/providers/send-via-nodemailer'
 import type { MailProvider } from '@/lib/messaging/email/types'
 
 /**
  * AWS SES via nodemailer's SES transport using the AWS SDK v3 client.
- * Credentials resolve through the SDK's default provider chain (env vars,
- * shared config, ECS/EKS task role, EC2 instance profile, SSO).
+ * Credentials come from `getAwsCredentials()`: workload identity in Trigger.dev
+ * runs, otherwise the SDK's default provider chain (env vars, shared config,
+ * ECS/EKS task role, EC2 instance profile, SSO).
  */
 export function createSesProvider(): MailProvider | null {
   const region = env.AWS_SES_REGION
   if (!region) return null
 
-  const sesClient = new SESv2Client({ region })
+  const sesClient = new SESv2Client({ region, credentials: getAwsCredentials() })
   const sesOptions: SESTransport.Options = {
     SES: { sesClient, SendEmailCommand },
   }

bunfig.toml

@@ -4,10 +4,18 @@ exact = true
 # (blocks freshly published, potentially compromised releases).
 minimumReleaseAge = 604800
 # Explicit framework pins must install before their release reaches the age threshold: a
-# security release of Next.js is pinned exactly the day it ships. The Trigger.dev packages are
-# excluded only until 4.8.3 (published 2026-10-30, the first release with workload identity)
-# clears the threshold on 2026-11-06; drop them then.
-minimumReleaseAgeExcludes = ["next", "@next/env", "@trigger.dev/sdk", "@trigger.dev/core", "@trigger.dev/build", "trigger.dev"]
+# security release of Next.js is pinned exactly the day it ships. Trigger.dev 4.8.3 (published
+# 2026-10-30, the first release with workload identity) is exempted until it clears the threshold
+# on 2026-11-06; drop the four Trigger.dev entries then. They are bare names because Bun 1.4 ignores
+# version-pinned exclusions; `exact = true` and the lockfile still hold the packages at 4.8.3.
+minimumReleaseAgeExcludes = [
+  "next",
+  "@next/env",
+  "@trigger.dev/sdk",
+  "@trigger.dev/core",
+  "@trigger.dev/build",
+  "trigger.dev",
+]
 
 [run]
 env = { NEXT_PUBLIC_APP_URL = "http://localhost:3000" }