{"record":{"id":"01472670ba82c03e","repo":"vercel/ai","slug":"aws-credential-provider-failed-errormessage-p-014726","errorCode":null,"errorMessage":"AWS credential provider failed: ${errorMessage}. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties.","messagePattern":"AWS credential provider failed: (.+?)\\. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/amazon-bedrock/src/mantle/bedrock-mantle-provider.ts","lineNumber":157,"sourceCode":"        async () => {\n          const region = loadSetting({\n            settingValue: options.region,\n            settingName: 'region',\n            environmentVariableName: 'AWS_REGION',\n            description: 'AWS region',\n          });\n\n          // If a credential provider is provided, use it to get the credentials.\n          if (options.credentialProvider) {\n            try {\n              return {\n                ...(await options.credentialProvider()),\n                region,\n              };\n            } catch (error) {\n              const errorMessage =\n                error instanceof Error ? error.message : String(error);\n              throw new Error(\n                `AWS credential provider failed: ${errorMessage}. ` +\n                  'Please ensure your credential provider returns valid AWS credentials ' +\n                  'with accessKeyId and secretAccessKey properties.',\n              );\n            }\n          }\n\n          try {\n            return {\n              region,\n              accessKeyId: loadSetting({\n                settingValue: options.accessKeyId,\n                settingName: 'accessKeyId',\n                environmentVariableName: 'AWS_ACCESS_KEY_ID',\n                description: 'AWS access key ID',\n              }),\n              secretAccessKey: loadSetting({\n                settingValue: options.secretAccessKey,","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/amazon-bedrock/src/mantle/bedrock-mantle-provider.ts#L139-L175","documentation":"createBedrockMantle wraps any exception thrown while awaiting options.credentialProvider() in a descriptive Error explaining that the provider must return valid AWS credentials with accessKeyId and secretAccessKey. The original error message is embedded, so a failing STS call, network timeout, or misconfigured custom provider surfaces here.","triggerScenarios":"A custom credentialProvider function passed to createBedrockMantle (via bedrockMantle) throws or rejects — e.g. the async provider's underlying token fetch fails, or it returns an object missing the credential properties and downstream code rejects.","commonSituations":"Custom credential providers hitting IMDS/STS in environments without network access; a provider returning undefined credentials; typos in the returned object's property names.","solutions":["Inspect the embedded 'Original error' message for the root cause (network, permissions, shape).","Ensure your credentialProvider resolves to { accessKeyId, secretAccessKey, sessionToken? }.","Await the provider correctly and add your own try/catch with logging around it before passing it in.","Fall back to the default credential chain (omit credentialProvider) if a custom one is unnecessary."],"exampleFix":"// before\ncreateBedrockMantle({ credentialProvider: () => sts.getCredentials() })\n// after\ncreateBedrockMantle({\n  credentialProvider: async () => {\n    const c = await sts.getCredentials();\n    if (!c?.accessKeyId || !c?.secretAccessKey) throw new Error('incomplete creds');\n    return { accessKeyId: c.accessKeyId, secretAccessKey: c.secretAccessKey, sessionToken: c.sessionToken };\n  },\n})","handlingStrategy":"try-catch","validationCode":"async function safeCredentialProvider() {\n  const creds = await myCredentialProvider();\n  if (!creds?.accessKeyId || !creds?.secretAccessKey) {\n    throw new Error('credentialProvider returned incomplete AWS credentials');\n  }\n  return creds;\n}","typeGuard":"function isAwsCredentialShape(c) {\n  return !!c && typeof c === 'object' && typeof c.accessKeyId === 'string' && typeof c.secretAccessKey === 'string';\n}","tryCatchPattern":"try {\n  const mantle = createBedrockMantle({ credentialProvider: safeCredentialProvider });\n} catch (error) {\n  if (error instanceof Error && error.message.startsWith('AWS credential provider failed')) {\n    console.error('Credential provider threw:', error.message);\n    // fall back to default chain or surface config error\n  } else throw error;\n}","preventionTips":["Test your credentialProvider in isolation before wiring it into the provider.","Verify resolved credentials include accessKeyId and secretAccessKey.","Add timeouts/retries inside the provider for IMDS/STS calls.","Prefer maintained providers from @aws-sdk/credential-providers over hand-rolled ones."],"tags":["aws","credentials","authentication","bedrock"],"backgroundTag":"aws-credentials-not-found","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}