Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

gateway install --force regenerates the systemd service file and drops user-added Environment entries (e.g. AWS_PROFILE=default), breaking AWS SDK credential discovery on EC2 instances using IAM instance roles for Bedrock access.

Steps to reproduce

1. Deploy OpenClaw on EC2/ECS/Agent Core/Lambda with IAM instance/services role granting Bedrock access
2. Configure amazon-bedrock provider with "auth": "aws-sdk" in openclaw.json
3. Manually add Environment=AWS_PROFILE=default to the systemd service file to make credential chain work
4. Run openclaw gateway install --force (or upgrade triggers reinstall)
5. Gateway restarts via systemd
6. Main agent works, but pi-coding-agent subagent fails

Expected behavior

1. gateway install --force should preserve user-added Environment= entries in the systemd service file, or provide a documented override mechanism (e.g. systemd drop-in directory or config-level env block)
2. pi-coding-agent should inherit the parent gateway's amazon-bedrock provider config including "auth": "aws-sdk", not require a separate API key
3. AWS SDK credential chain (Instance Role → IMDS) should work out of the box in systemd environments on EC2

Actual behavior

1. gateway install --force regenerates the entire systemd service file, dropping any manually added Environment= entries (e.g. AWS_PROFILE=default)
2. pi-coding-agent fails with: No API key found for amazon-bedrock
3. Adding AWS_PROFILE=default to the service file fixes it, but gets overwritten on next gateway install --force
4. Error log:

⚠️ Agent failed before reply: No API key found for amazon-bedrock.
Use /login or set an API key environment variable.

OpenClaw version

2026.4.5 (3e72c03)

Operating system

Ubuntu 24.04 (arm64) on AWS EC2

Install method

npm global

Model

amazon-bedrock/global.anthropic.claude-opus-4-6-v1

Provider / routing chain

openclaw -> amazon-bedrock (Bedrock Converse Stream API)

Additional provider/model setup details

EC2 Instance Role with Bedrock access policy.
Provider config uses "auth": "aws-sdk" in openclaw.json.
No API keys — relies on IMDS credential chain.

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

Workaround

Add AWS_PROFILE=default to ~/.openclaw/.env:

AWS_PROFILE=default

This file is not overwritten by gateway install --force and is loaded by the gateway at startup.

Related Issues

• [Bug]: Stale OPENCLAW_GATEWAY_TOKEN in systemd service causes persistent device token mismatch after upgrade #17226 — Stale OPENCLAW_GATEWAY_TOKEN in systemd service after upgrade
• [Bug] --profile flag does not override inherited OPENCLAW_* environment variables during gateway install #28236 — --profile flag does not override inherited env vars during gateway install
• openclaw gateway status fails on EC2/headless servers due to missing user-level systemd #11805 — Gateway status fails on EC2/headless servers due to missing user-level systemd