BerriAI/litellm · error · BedrockError

No AWS credentials found for Bedrock realtime. Set aws_* par

Error message

No AWS credentials found for Bedrock realtime. Set aws_* params in litellm_params or configure credentials in the environment

What it means

Before opening a Bedrock realtime session the handler resolves AWS credentials via the standard chain (access keys, profile, role, web identity). If get_bedrock_credentials returns None, LiteLLM raises BedrockError 401 instructing you to set aws_* params in litellm_params or configure environment credentials. No attempt to connect is made after this.

Source

Thrown at litellm/llms/bedrock/realtime/handler.py:101

        else:
            endpoint_uri = f"https://bedrock-runtime.{aws_region_name}.amazonaws.com"

        verbose_proxy_logger.debug("Bedrock Realtime: Connecting to %s with model %s", endpoint_uri, model)

        credentials: Final = self.get_credentials(
            aws_access_key_id=aws_access_key_id,
            aws_secret_access_key=aws_secret_access_key,
            aws_session_token=aws_session_token,
            aws_region_name=aws_region_name,
            aws_session_name=aws_session_name,
            aws_profile_name=aws_profile_name,
            aws_role_name=aws_role_name,
            aws_web_identity_token=aws_web_identity_token,
            aws_sts_endpoint=aws_sts_endpoint,
            aws_external_id=aws_external_id,
        )
        if credentials is None:
            raise BedrockError(
                status_code=401,
                message=(
                    "No AWS credentials found for Bedrock realtime. Set aws_* params in litellm_params "
                    "or configure credentials in the environment"
                ),
            )
        frozen_credentials: Final = credentials.get_frozen_credentials()

        # Initialize Bedrock client with aws_sdk_bedrock_runtime
        config: Final = Config(
            endpoint_uri=endpoint_uri,
            region=aws_region_name,
            aws_access_key_id=frozen_credentials.access_key,
            aws_secret_access_key=frozen_credentials.secret_key,
            aws_session_token=frozen_credentials.token,
            aws_credentials_identity_resolver=StaticCredentialsResolver(),
        )
        bedrock_client: Final = BedrockRuntimeClient(config=config)

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Verify the chain resolves: aws sts get-caller-identity (or aws sso login first)
2. Set AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (plus AWS_SESSION_TOKEN for temporary creds), or pass aws_access_key_id/aws_secret_access_key in litellm_params
3. For containerized workloads, attach an IAM role (IRSA on EKS, task role on ECS) so the chain resolves implicitly

Example fix

# before
litellm.realtime(model="bedrock/amazon.nova-sonic-v1:0", ...)

# after
os.environ["AWS_ACCESS_KEY_ID"] = "..."
os.environ["AWS_SECRET_ACCESS_KEY"] = "..."
litellm.realtime(model="bedrock/amazon.nova-sonic-v1:0", ...)

import botocore.session

creds = botocore.session.get_session().get_credentials()
if creds is None:
    raise SystemExit(
        "no AWS credentials for bedrock realtime; set AWS_* env vars, a profile, or attach an IAM role"
    )

def aws_credentials_resolvable() -> bool:
    """True when the default botocore chain yields credentials."""
    return botocore.session.get_session().get_credentials() is not None

from litellm.llms.bedrock.common_utils import BedrockError

try:
    session = litellm.realtime(model=model, ...)
except BedrockError as e:
    if e.status_code == 401:
        # credential chain empty: surface an auth-setup error, do not retry
        raise AuthConfigError("configure AWS credentials for bedrock realtime") from e
    raise

When it happens

Trigger: litellm.realtime(..., model='bedrock/<realtime-model>') in an environment with no resolvable AWS credentials: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, no ~/.aws/credentials, no attached IAM role, and no aws_* litellm_params on the deployment.

Common situations: Local development without AWS login, containers without roles or mounted credentials, expired SSO tokens, AWS_PROFILE pointing at a profile that no longer exists.

Related errors

• BedrockException Invalid Authentication - {error_str}
• Missing aws_sdk_bedrock_runtime. Install with: pip install a
• Bedrock Mantle auth failed: no Bearer token and no usable AW
• GCP IAM authentication failed
• Azure AD authentication failed for Redis

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/3d646d067cc35d50. Report an issue: GitHub.