BerriAI/litellm · error · AwsAuthError

OIDC token could not be retrieved from secret manager.

Error message

OIDC token could not be retrieved from secret manager.

What it means

Error "OIDC token could not be retrieved from secret manager." thrown in BerriAI/litellm.

Source

Thrown at litellm/llms/bedrock/base_aws_llm.py:832

            aws_role_name,
            aws_session_name,
        )

        # get_secret() expands environment-variable references (an os.environ/<VAR>
        # prefix, or a bare name matching an environment variable). Config-sourced
        # references are expanded at load time, so such a reference reaching here is
        # caller-supplied input; reject it rather than expanding a process-environment
        # value for use as the token.
        if aws_web_identity_token.startswith("os.environ/") or aws_web_identity_token in os.environ:
            raise AwsAuthError(
                message="Invalid web identity token reference.",
                status_code=400,
            )

        oidc_token: Final = get_secret(aws_web_identity_token)

        if oidc_token is None:
            raise AwsAuthError(
                message="OIDC token could not be retrieved from secret manager.",
                status_code=401,
            )

        sts_client_kwargs: Final = self._build_sts_client_kwargs(
            aws_sts_endpoint=aws_sts_endpoint,
            ssl_verify=ssl_verify,
        )

        with tracer.trace("boto3.client(sts)"):
            sts_client: Final = boto3.client("sts", **sts_client_kwargs)

        # The session policy is an IAM PERMISSION CEILING — effective
        # permissions are the intersection of the role's identity policies
        # and this policy. Any action not listed here is silently denied
        # even when the IAM role grants it. So every Bedrock route we
        # support needs a matching action statement, or it 403s on OIDC
        # auth only (static creds + IRSA take other code paths).

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Check the secret manager configuration so the OIDC token can be retrieved.

When it happens

Trigger: Thrown at litellm/llms/bedrock/base_aws_llm.py:832 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/f6ca2a0e598ba9ce. Report an issue: GitHub.