alibaba/open-code-review · error

%s does not apply to provider %q: aws_region and aws_profile

Error message

%s does not apply to provider %q: aws_region and aws_profile are only used by providers that authenticate from the AWS credential chain (protocol %s)

What it means

This error rejects aws_region or aws_profile set on a provider that does not authenticate through the AWS credential chain. providerAcceptsAWSSettings checks the provider's protocol; only AWS-backed protocols (protocol anthropic-bedrock) make these fields meaningful, and storing them elsewhere would be silently dead configuration.

Source

Thrown at cmd/opencodereview/config_cmd.go:680

			return fmt.Errorf("invalid extra headers for %s: %w", key, err)
		}
		entry.ExtraHeaders = parsed
	case "retry_codes":
		codes, warnings, err := llm.ParseRetryCodes(value)
		if err != nil {
			return fmt.Errorf("invalid retry codes for %s: %w", key, err)
		}
		for _, w := range warnings {
			fmt.Fprintf(os.Stderr, "[ocr] WARNING: %s\n", w)
		}
		entry.RetryCodes = codes
	case "aws_region", "aws_profile":
		normalized, err := normalizeAWSSetting(field, key, value)
		if err != nil {
			return err
		}
		if !providerAcceptsAWSSettings(providerName, entry) {
			return fmt.Errorf("%s does not apply to provider %q: aws_region and aws_profile are only used by providers that authenticate from the AWS credential chain (protocol %s)", field, providerName, llm.ProtocolAnthropicBedrock)
		}
		if field == "aws_region" {
			entry.AWSRegion = normalized
		} else {
			entry.AWSProfile = normalized
		}
	default:
		return fmt.Errorf("unknown provider field %q: supported fields are api_key, api_key_cmd, url, protocol, model, models, auth_header, extra_body, extra_headers, retry_codes, aws_region, aws_profile", field)
	}
	return nil
}

// providerAcceptsAWSSettings reports whether aws_region / aws_profile mean
// anything for this provider. Storing them anywhere else would be dead config
// that reads as applied, so it is rejected instead.
//
// The entry's own protocol decides whenever it sets one: a preset's protocol can
// be overridden per entry (see tryProviderConfig), so `protocol: openai` on the

View on GitHub (pinned to 5cf97d0d15)

Solutions

1. Set the provider's protocol to anthropic-bedrock before setting aws_region/aws_profile
2. Remove the aws_region/aws_profile setting if the provider genuinely is not Bedrock-backed
3. Use a provider entry (or custom provider) whose protocol is llm.ProtocolAnthropicBedrock

Example fix

// before
ocr config set custom_providers.foo.protocol openai
ocr config set custom_providers.foo.aws_region us-east-1
// after
ocr config set custom_providers.foo.protocol anthropic-bedrock
ocr config set custom_providers.foo.aws_region us-east-1

protocol=$(ocr config get providers.foo.protocol)
[[ "$protocol" == "anthropic-bedrock" ]] || echo "aws_region/aws_profile only apply to anthropic-bedrock providers"

When it happens

Trigger: `ocr config set providers.<name>.aws_region us-east-1` (or aws_profile) where the provider entry's protocol is not anthropic-bedrock — e.g. a preset openai/anthropic provider or a custom provider with protocol openai.

Common situations: Copying a Bedrock-focused config snippet to a non-Bedrock provider; switching a provider's protocol away from bedrock and forgetting the old aws_* fields are now invalid to (re)set; typos in the protocol field.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• llm.protocol cannot be %q: bedrock derives its host from aws
• invalid %s for %s: %q contains whitespace
• load config: %w
• unset supports provider, max_tokens, effort, custom_provider
• MCP server %q not found

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/e67b994e2d81fe34. Report an issue: GitHub.