BerriAI/litellm · error · ValueError

No AWS credentials found. Provide aws_access_key_id and aws_

Error message

No AWS credentials found. Provide aws_access_key_id and aws_secret_access_key, or configure default credentials (env vars, ~/.aws/credentials, instance profile).

What it means

When no explicit AWS keys are supplied, the MCP client falls back to the default botocore credential chain (env vars, ~/.aws/credentials, EC2/ECS instance profiles). If that chain yields no credentials at all, session.get_credentials() returns None and this ValueError is raised because SigV4 signing is impossible without credentials.

Source

Thrown at litellm/experimental_mcp_client/client.py:150

                aws_access_key_id=aws_access_key_id,
                aws_secret_access_key=aws_secret_access_key,
                aws_session_token=aws_session_token,
                aws_region_name=self.region_name,
            )
        elif aws_access_key_id and aws_secret_access_key:
            self.credentials = Credentials(
                access_key=aws_access_key_id,
                secret_key=aws_secret_access_key,
                token=aws_session_token,
            )
        else:
            # Fall back to default boto3 credential chain
            import botocore.session

            session: Final = botocore.session.get_session()
            self.credentials = session.get_credentials()
            if self.credentials is None:
                raise ValueError(
                    "No AWS credentials found. Provide aws_access_key_id and "
                    "aws_secret_access_key, or configure default credentials "
                    "(env vars, ~/.aws/credentials, instance profile)."
                )

    @staticmethod
    def _assume_role(
        aws_role_name: str,
        aws_session_name: str | None,
        aws_access_key_id: str | None,
        aws_secret_access_key: str | None,
        aws_session_token: str | None,
        aws_region_name: str,
    ):
        """Call STS AssumeRole and return temporary credentials."""
        import boto3
        from botocore.credentials import Credentials

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars (plus AWS_SESSION_TOKEN if using temporary creds) in the process running litellm
2. Pass aws_access_key_id / aws_secret_access_key directly in the MCP server's auth config so no chain lookup happens
3. Create a valid ~/.aws/credentials with a [default] profile, or run `aws configure`
4. On EC2/ECS/EKS, attach an instance role / task role so the instance-profile chain resolves

Example fix

# before
export AWS_ACCESS_KEY_ID=...   # secret key forgotten

# after
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...
# or in MCP server config:
# aws_sigv4_auth: {aws_access_key_id: ..., aws_secret_access_key: ..., aws_region_name: us-east-1}

import os

def aws_creds_available() -> bool:
    if os.getenv("AWS_ACCESS_KEY_ID") and os.getenv("AWS_SECRET_ACCESS_KEY"):
        return True
    try:
        import botocore.session
        return botocore.session.get_session().get_credentials() is not None
    except Exception:
        return False

assert aws_creds_available(), "configure AWS credentials before SigV4 MCP auth"

When it happens

Trigger: Configuring an MCP server with aws_sigv4_auth but omitting aws_access_key_id/aws_secret_access_key AND running where AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars are unset, no ~/.aws/credentials file exists, and no instance/role profile is available (laptop, non-AWS CI runner).

Common situations: Local development where credentials live only in a named profile (not 'default'); CI runners without AWS auth configured; containers that dropped the mounted ~/.aws volume; expired or misspelled env var names (e.g. AWS_SECRET_ACCESS_KEY missing while AWS_ACCESS_KEY_ID is set).

Related errors

• Missing botocore to use AWS SigV4 authentication. Run 'pip i
• stdio_config is required for stdio transport
• BedrockException Invalid Authentication - {error_str}
• litellm.BadRequestError: SagemakerException - {error_str}
• Azure OpenAI client is not initialized. Make sure api_key is

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/3e4c973f7cf81a3e. Report an issue: GitHub.