{"record":{"id":"05b97220abff88a0","repo":"BerriAI/litellm","slug":"invalid-web-identity-token-reference","errorCode":null,"errorMessage":"Invalid web identity token reference.","messagePattern":"Invalid web identity token reference\\.","errorType":"exception","errorClass":"AwsAuthError","httpStatus":400,"severity":"error","filePath":"litellm/llms/bedrock/base_aws_llm.py","lineNumber":824,"sourceCode":"        \"\"\"\n        Authenticate with AWS Web Identity Token\n        \"\"\"\n        import boto3\n\n        verbose_logger.debug(\n            \"IN Web Identity Token: %s | Role Name: %s | Session Name: %s\",\n            aws_web_identity_token,\n            aws_role_name,\n            aws_session_name,\n        )\n\n        # get_secret() expands environment-variable references (an os.environ/<VAR>\n        # prefix, or a bare name matching an environment variable). Config-sourced\n        # references are expanded at load time, so such a reference reaching here is\n        # caller-supplied input; reject it rather than expanding a process-environment\n        # value for use as the token.\n        if aws_web_identity_token.startswith(\"os.environ/\") or aws_web_identity_token in os.environ:\n            raise AwsAuthError(\n                message=\"Invalid web identity token reference.\",\n                status_code=400,\n            )\n\n        oidc_token: Final = get_secret(aws_web_identity_token)\n\n        if oidc_token is None:\n            raise AwsAuthError(\n                message=\"OIDC token could not be retrieved from secret manager.\",\n                status_code=401,\n            )\n\n        sts_client_kwargs: Final = self._build_sts_client_kwargs(\n            aws_sts_endpoint=aws_sts_endpoint,\n            ssl_verify=ssl_verify,\n        )\n\n        with tracer.trace(\"boto3.client(sts)\"):","sourceCodeStart":806,"sourceCodeEnd":842,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/llms/bedrock/base_aws_llm.py#L806-L842","documentation":"Error \"Invalid web identity token reference.\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/llms/bedrock/base_aws_llm.py:824 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the web identity token reference (env var or file path) used for AWS authentication."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}