BerriAI/litellm · critical · BadRequestError

litellm.BadRequestError: SagemakerException - {error_str}

Error message

litellm.BadRequestError: SagemakerException - {error_str}

What it means

In _map_sagemaker_exception, litellm checks the SageMaker error string for 'Unable to locate credentials' and raises litellm.BadRequestError with 'litellm.BadRequestError: SagemakerException - <error>'. This is botocore's NoCredentialsError text: no AWS credentials could be resolved at all for the SageMaker endpoint call. litellm surfaces it as a 400-class error on the sagemaker provider.

Source

Thrown at litellm/litellm_core_utils/exception_mapping_utils.py:978

                model=model,
                llm_provider=custom_llm_provider,
                litellm_debug_info=extra_information,
                exception_status_code=original_exception.status_code,
            )


def _map_sagemaker_exception(
    *,
    model: str,
    original_exception: _ProviderHTTPException,
    custom_llm_provider: str,
    error_str: str,
    exception_type: str,
    exception_provider: str,
    extra_information: str,
) -> None:
    if "Unable to locate credentials" in error_str:
        raise BadRequestError(
            message=f"litellm.BadRequestError: SagemakerException - {error_str}",
            model=model,
            llm_provider="sagemaker",
            response=getattr(original_exception, "response", None),
        )
    elif "Input validation error: `best_of` must be > 0 and <= 2" in error_str:
        raise BadRequestError(
            message="SagemakerException - the value of 'n' must be > 0 and <= 2 for sagemaker endpoints",
            model=model,
            llm_provider="sagemaker",
            response=getattr(original_exception, "response", None),
        )
    elif (
        "`inputs` tokens + `max_new_tokens` must be <=" in error_str
        or "instance type with more CPU capacity or memory" in error_str
    ):
        raise ContextWindowExceededError(
            message=f"SagemakerException - {error_str}",

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Export credentials or a profile: AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_SESSION_TOKEN, or AWS_PROFILE=<name>
2. Pass keys explicitly: litellm.completion(..., aws_access_key_id=..., aws_secret_access_key=..., aws_region_name=...)
3. On EC2/ECS/EKS, attach an execution/instance role that can invoke the SageMaker runtime
4. Sanity-check the chain with aws sts get-caller-identity in the same shell/env the app runs in

Example fix

# before
resp = litellm.completion(model="sagemaker/my-hf-endpoint", messages=msgs)

# after
resp = litellm.completion(
  model="sagemaker/my-hf-endpoint",
  messages=msgs,
  aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"],
  aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"],
  aws_region_name="us-east-1",
)

import os, boto3

def sagemaker_creds_resolvable() -> bool:
    try:
        boto3.client("sts").get_caller_identity()
        return True
    except Exception:
        return False

if not sagemaker_creds_resolvable():
    raise RuntimeError("configure AWS credentials before calling sagemaker/")

import litellm

def is_missing_credentials(e: Exception) -> bool:
    return isinstance(e, litellm.BadRequestError) and "Unable to locate credentials" in str(e)

import litellm
try:
    resp = litellm.completion(model="sagemaker/ep", messages=msgs)
except litellm.BadRequestError as e:
    if "Unable to locate credentials" in str(e):
        raise RuntimeError("no AWS credential chain for sagemaker runtime") from e
    raise

When it happens

Trigger: Calling a 'sagemaker/' model (HuggingFace/Sagemaker endpoints) with no resolvable AWS credential chain: no env vars, no ~/.aws/credentials, no role on the host, and no aws_access_key_id passed to the call. The string match happens before any status_code branch, so it fires even when the exception lacks a status code.

Common situations: Local scripts run without AWS_PROFILE set up; Docker containers missing the credentials mount; schedulers (Airflow/cron) with stripped environments; EC2 tasks without an instance role attached.

Related errors

• BedrockException Invalid Authentication - {error_str}
• SagemakerException - the value of 'n' must be > 0 and <= 2 f
• SagemakerException - {error_str}
• No AWS credentials found. Provide aws_access_key_id and aws_
• Authentication failed. Check your BitBucket access token and

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/7fddb8c18da540aa. Report an issue: GitHub.