BerriAI/litellm · critical · BedrockError

OIDC token could not be retrieved from secret manager.

Error message

OIDC token could not be retrieved from secret manager.

What it means

Raised during Bedrock client initialization when IRSA/web-identity auth is requested (aws_web_identity_token, aws_role_name, and aws_session_name all provided) but get_secret(aws_web_identity_token) returns None - the OIDC token file/env reference could not be resolved. It is a BedrockError 401 because the STS AssumeRoleWithWebIdentity flow cannot proceed without the token.

Source

Thrown at litellm/llms/bedrock/common_utils.py:474

        endpoint_url = env_aws_bedrock_runtime_endpoint
    else:
        endpoint_url = f"https://bedrock-runtime.{region_name}.amazonaws.com"

    import boto3

    if isinstance(timeout, float):
        config = boto3.session.Config(connect_timeout=timeout, read_timeout=timeout)
    elif isinstance(timeout, httpx.Timeout):
        config = boto3.session.Config(connect_timeout=timeout.connect, read_timeout=timeout.read)
    else:
        config = boto3.session.Config()

    ### CHECK STS ###
    if aws_web_identity_token is not None and aws_role_name is not None and aws_session_name is not None:
        oidc_token: Final = get_secret(aws_web_identity_token)

        if oidc_token is None:
            raise BedrockError(
                message="OIDC token could not be retrieved from secret manager.",
                status_code=401,
            )

        sts_client = boto3.client("sts", verify=ssl_verify)

        # https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html
        # https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sts/client/assume_role_with_web_identity.html
        sts_response = sts_client.assume_role_with_web_identity(
            RoleArn=aws_role_name,
            RoleSessionName=aws_session_name,
            WebIdentityToken=oidc_token,
            DurationSeconds=3600,
        )

        client = boto3.client(
            service_name="bedrock-runtime",
            aws_access_key_id=sts_response["Credentials"]["AccessKeyId"],

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Verify the token source resolves: check the file path or env var referenced by aws_web_identity_token exists and is readable in the container.
2. For EKS IRSA, mount the projected service account token and point aws_web_identity_token at its path (e.g. /var/run/secrets/tokens/oidc-token).
3. Confirm all three params are consistent - an unset role name or session name skips this flow entirely, producing different auth errors.
4. If secrets are managed via litellm's secret manager, ensure the key is registered there.

Example fix

# before
litellm.completion(
    model="bedrock/anthropic.claude-3-sonnet-20240229-v1:0", messages=msgs,
    aws_role_name="arn:aws:iam::123:role/bedrock-role",
    aws_session_name="litellm",
    aws_web_identity_token="OIDC_TOKEN",  # env/file not present -> None
)

# after
import os
os.environ["OIDC_TOKEN"] = open("/var/run/secrets/tokens/oidc-token").read()
litellm.completion(
    model="bedrock/anthropic.claude-3-sonnet-20240229-v1:0", messages=msgs,
    aws_role_name="arn:aws:iam::123:role/bedrock-role",
    aws_session_name="litellm",
    aws_web_identity_token="OIDC_TOKEN",
)

import os
from litellm import get_secret
if aws_web_identity_token and aws_role_name and aws_session_name:
    token = get_secret(aws_web_identity_token)
    if token is None or not token.strip():
        raise RuntimeError(
            f"OIDC token at '{aws_web_identity_token}' is empty/missing - "
            "check the mounted projected token or env var"
        )

from litellm.exceptions import BedrockError
try:
    litellm.completion(model="bedrock/<model>", messages=msgs,
                       aws_web_identity_token=TOKEN_REF, aws_role_name=ROLE, aws_session_name=SESSION)
except BedrockError as e:
    if e.status_code == 401 and "OIDC token" in str(e):
        raise RuntimeError("Service account token not mounted - fix IRSA config") from e
    raise

When it happens

Trigger: Configuring bedrock credentials via EKS IRSA-style params where the aws_web_identity_token value is an empty/incorrect secret name, the referenced file does not exist, or the token env var is unset in the container.

Common situations: Kubernetes deployments where the projected service-account token path changed or is not mounted, typos in the secret reference, or helm charts that forget to pass the token value through.

Related errors

• BedrockException Invalid Authentication - {error_str}
• Model needs to be set for bedrock
• BedrockException: Context Window Error - {error_str}
• BedrockException PermissionDeniedError - {error_str}
• BedrockException: Rate Limit Error - {error_str}

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/4bba3a0460c57ac4. Report an issue: GitHub.