anomalyco/sst · error · Error

No AWS credentials found

Error message

No AWS credentials found

What it means

`client()` builds an aws4fetch AwsClient for signing AWS requests. It resolves credentials in order: explicit `aws` options, then AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars, then the ECS container credentials endpoint (AWS_CONTAINER_CREDENTIALS_RELATIVE_URI). If none are present, it throws "No AWS credentials found".

Source

Thrown at sdk/js/src/aws/client.ts:71

      sessionToken: process.env.AWS_SESSION_TOKEN,
      region: process.env.AWS_REGION,
    });
  }

  if (process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
    const credentials = await getCredentials(
      "http://169.254.170.2" +
        process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,
    );
    return new AwsClient({
      accessKeyId: credentials.AccessKeyId,
      secretAccessKey: credentials.SecretAccessKey,
      sessionToken: credentials.Token,
      region: process.env.AWS_REGION,
    });
  }

  throw new Error("No AWS credentials found");
}

export async function awsFetch(
  service: string,
  path: string,
  init: Omit<AwsFetchOptions, "aws">,
  options?: { aws?: AwsOptions },
) {
  const c = await client(options?.aws);
  const region = options?.aws?.region ?? c.region;
  return c.fetch(`https://${service}.${region}.amazonaws.com${path}`, {
    ...init,
    aws: options?.aws,
  });
}

View on GitHub (pinned to a0bd20f762)

Solutions

1. Run under `sst dev` / `sst shell` locally so AWS credentials from your AWS profile are injected.
2. Export AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN, AWS_REGION) in your local environment.
3. Pass explicit credentials via the `aws` option: `{ aws: { accessKeyId, secretAccessKey, region } }`.
4. If running in AWS (Lambda/ECS), verify the runtime provides AWS_CONTAINER_CREDENTIALS_RELATIVE_URI and AWS_REGION.

Example fix

// before (no creds locally)
await bus.publish(Resource.MyBus, event);
// after
await bus.publish(Resource.MyBus, event, {
  aws: {
    accessKeyId: process.env.MY_AWS_KEY_ID!,
    secretAccessKey: process.env.MY_AWS_SECRET!,
    region: "us-east-1",
  },
});

if (!process.env.AWS_ACCESS_KEY_ID && !process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
  throw new Error("Run via `sst dev`/`sst shell` or set AWS credentials before calling AWS-backed SDK functions");
}

function hasAwsCredentials(): boolean {
  return Boolean(
    process.env.AWS_ACCESS_KEY_ID ||
    process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,
  );
}

try {
  const c = await client();
} catch (e) {
  if (e instanceof Error && e.message === "No AWS credentials found") {
    console.error("Provide credentials: sst shell, env vars, or the `aws` option");
  }
  throw e;
}

When it happens

Trigger: Calling any awsFetch-backed SDK function (bus.publish, task.run/describe/stop) with no `aws` option, no AWS_* key env vars, and no AWS_CONTAINER_CREDENTIALS_RELATIVE_URI — i.e. running outside AWS without static credentials.

Common situations: Running code locally (unit tests, scripts) outside `sst dev`/`sst shell` without credentials; Lambda functions missing the container credentials env var; env vars stripped by the deploy target; typos in AWS_ACCESS_KEY_ID naming.

Related errors

• no aws provider found
• Proxy is not enabled. Enable it with "proxy: true".
• Cannot access `nodes.loadBalancer` when no public ports are
• You must provide the ports to expose via "loadBalancer.rules
• You must provide a container name in "loadBalancer.rules" wh

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/b575750eed878ca2. Report an issue: GitHub.