bedrock: could not load AWS configuration: %w bedrock uses

Error message

bedrock: could not load AWS configuration: %w
  bedrock uses the standard AWS credential chain — set AWS_PROFILE, or run `aws sso login%s`

What it means

When creating a Bedrock-backed AnthropicClient (internal/llm/client.go:1006), the AWS SDK's config.LoadDefaultConfig fails to assemble a credential chain / config. The client is still returned but with initErr set, so the first API call surfaces this error explaining that Bedrock uses the standard AWS credential chain. It is thrown because the SDK found no usable credentials, profile, or config source.

Source

Thrown at internal/llm/client.go:1006

	// Load the AWS config here rather than calling bedrock.WithLoadDefaultConfig,
	// which panics on failure.
	var loadOpts []func(*awsconfig.LoadOptions) error
	if cfg.AWSProfile != "" {
		loadOpts = append(loadOpts, awsconfig.WithSharedConfigProfile(cfg.AWSProfile))
	}
	if cfg.AWSRegion != "" {
		loadOpts = append(loadOpts, awsconfig.WithRegion(cfg.AWSRegion))
	}
	loadCtx, cancel := context.WithTimeout(context.Background(), bedrockConfigLoadTimeout)
	defer cancel()
	awsCfg, err := awsconfig.LoadDefaultConfig(loadCtx, loadOpts...)
	if err != nil {
		return &AnthropicClient{
			cfg:        cfg,
			bedrock:    true,
			awsProfile: cfg.AWSProfile,
			initErr: fmt.Errorf("bedrock: could not load AWS configuration: %w\n"+
				"  bedrock uses the standard AWS credential chain — set AWS_PROFILE, or run `aws sso login%s`", err, ssoLoginProfileArg(cfg.AWSProfile)),
		}
	}
	if awsCfg.Region == "" {
		return &AnthropicClient{
			cfg:        cfg,
			bedrock:    true,
			awsProfile: cfg.AWSProfile,
			initErr: fmt.Errorf("bedrock: no AWS region resolved\n" +
				"  set AWS_REGION, or give the active profile a region — the region decides which bedrock-runtime host is used"),
		}
	}

	// Drop the credential-chain bearer token, always.
	//
	// bedrock.WithConfig prefers bearer auth over SigV4 whenever
	// cfg.BearerAuthTokenProvider is non-nil, and LoadDefaultConfig populates
	// that provider from the SSO token cache — the OIDC access token, which is

View on GitHub (pinned to 5cf97d0d15)

Solutions

Run `aws sso login` (add `--profile <name>` if cfg.AWSProfile is set) to refresh SSO credentials
Export static credentials: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, optionally AWS_SESSION_TOKEN
Verify AWS_PROFILE matches a section in ~/.aws/config or ~/.aws/credentials
Check AWS_SHARED_CREDENTIALS_FILE / AWS_CONFIG_FILE point at real files and are parseable

Example fix

// before
export AWS_PROFILE=nope-profile
ocr review ...
// after
export AWS_PROFILE=work
aws sso login --profile work
ocr review ...

Defensive patterns

Strategy: validation

Validate before calling

if _, err := exec.LookPath("aws"); err == nil {
    out, err := exec.Command("aws", "sts", "get-caller-identity").CombinedOutput()
    if err != nil {
        return fmt.Errorf("AWS credentials not resolvable (run `aws sso login`): %v: %s", err, out)
    }
}

Try / catch

cl := NewAnthropicBedrockClient(cfg)
if _, _, err := cl.Call(ctx, messages); err != nil {
    if strings.Contains(err.Error(), "could not load AWS configuration") {
        return fmt.Errorf("fix AWS credentials first: %w", err)
    }
    return err
}

Prevention

Run `aws sso login` at the start of a work session and in CI setup steps
Verify with `aws sts get-caller-identity` before long-running jobs
Double-check AWS_PROFILE spelling against ~/.aws/config sections
Keep ~/.aws/credentials and ~/.aws/config present and well-formed in containers

When it happens

Trigger: Constructing a client with ProtocolAnthropicBedrock when: no credentials exist anywhere in the chain (env vars, shared credentials/config files, IMDS, SSO), an AWS_PROFILE names a profile that does not exist, or the config file itself is malformed so LoadDefaultConfig errors.

Common situations: Fresh container/CI machine with no AWS setup; SSO session expired and never re-logged-in; typo'd AWS_PROFILE; running locally without ~/.aws/credentials; assume-role source profile missing.

Related errors

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/61eab73d8ac52f21. Report an issue: GitHub.