BerriAI/litellm · critical · AuthenticationError

BedrockException Invalid Authentication - {error_str}

Error message

BedrockException Invalid Authentication - {error_str}

What it means

Bedrock-specific: AuthenticationError raised when the AWS error text contains 'Unable to locate credentials' or 'The security token included in the request is invalid'. LiteLLM failed at the AWS layer — either no credentials were discoverable at all, or the discovered credentials (access key / session token) were rejected.

Source

Thrown at litellm/litellm_core_utils/exception_mapping_utils.py:862

    elif "Malformed input request" in error_str:
        raise BadRequestError(
            message=f"BedrockException - {error_str}",
            model=model,
            llm_provider="bedrock",
            response=getattr(original_exception, "response", None),
        )
    elif "A conversation must start with a user message." in error_str:
        raise BadRequestError(
            message=f"BedrockException - {error_str}\n. Pass in default user message via `completion(..,user_continue_message=)` or enable `litellm.modify_params=True`.\nFor Proxy: do via `litellm_settings::modify_params: True` or user_continue_message under `litellm_params`",
            model=model,
            llm_provider="bedrock",
            response=getattr(original_exception, "response", None),
        )
    elif (
        "Unable to locate credentials" in error_str
        or "The security token included in the request is invalid" in error_str
    ):
        raise AuthenticationError(
            message=f"BedrockException Invalid Authentication - {error_str}",
            model=model,
            llm_provider="bedrock",
            response=getattr(original_exception, "response", None),
        )
    elif "AccessDeniedException" in error_str:
        raise PermissionDeniedError(
            message=f"BedrockException PermissionDeniedError - {error_str}",
            model=model,
            llm_provider="bedrock",
            response=getattr(original_exception, "response", None),
        )
    elif "throttlingException" in error_str or "ThrottlingException" in error_str:
        raise RateLimitError(
            message=f"BedrockException: Rate Limit Error - {error_str}",
            model=model,
            llm_provider="bedrock",
            response=getattr(original_exception, "response", None),

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Provide credentials: run 'aws configure'/'aws sso login', export AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY(/AWS_SESSION_TOKEN), or attach an IAM role to the compute.
2. If using a session, refresh it — expired AWS_SESSION_TOKEN is a common cause.
3. Verify with a quick boto3 call (sts.get_caller_identity) before running litellm.
4. Check system clock (SigV4 is time-sensitive) and AWS_REGION is set.

Example fix

# before
resp = litellm.completion(model="bedrock/anthropic.claude-3-5-sonnet-20240620-v1:0", messages=msgs)  # no creds in env

# after
import boto3
boto3.client("sts").get_caller_identity()  # fail fast if credentials are missing/invalid
resp = litellm.completion(model="bedrock/anthropic.claude-3-5-sonnet-20240620-v1:0", messages=msgs)

import boto3

def aws_credentials_available() -> bool:
    try:
        boto3.client("sts").get_caller_identity()
        return True
    except Exception:
        return False

import litellm

def is_bedrock_auth_error(e: BaseException) -> bool:
    return isinstance(e, litellm.AuthenticationError) and getattr(e, "llm_provider", "") == "bedrock"

try:
    resp = litellm.completion(model="bedrock/...", messages=msgs)
except litellm.AuthenticationError as e:
    raise RuntimeError("AWS credentials missing/invalid — run aws sso login / configure, or attach a role") from e

When it happens

Trigger: No AWS_* environment variables, no ~/.aws/credentials, and no instance/task role available (local laptop without aws login); or stale/expired AWS_SESSION_TOKEN / AWS_SECRET_ACCESS_KEY after key rotation or MFA session expiry.

Common situations: Running locally without 'aws sso login' / 'aws configure', expired SSO sessions, CI runners missing credential env vars, containers without the task role, or clock skew invalidating SigV4 signatures.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• BedrockException: Context Window Error - {error_str}
• BedrockException PermissionDeniedError - {error_str}
• BedrockException: Rate Limit Error - {error_str}
• BedrockException: Timeout Error - {error_str}
• litellm.BadRequestError: SagemakerException - {error_str}

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/b394d64d1f935685. Report an issue: GitHub.