{"record":{"id":"0c86008897464240","repo":"vercel/ai","slug":"aws-sigv4-authentication-requires-aws-credentials","errorCode":null,"errorMessage":"AWS SigV4 authentication requires AWS credentials. Please provide either:\n1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n2. Provide accessKeyId and secretAccessKey in options\n3. Use a credentialProvider function\n4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\nOriginal error: ${errorMessage}","messagePattern":"AWS SigV4 authentication requires AWS credentials\\. Please provide either:\n1\\. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n2\\. Provide accessKeyId and secretAccessKey in options\n3\\. Use a credentialProvider function\n4\\. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\nOriginal error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/amazon-bedrock/src/amazon-bedrock-provider.ts","lineNumber":259,"sourceCode":"              description: 'AWS secret access key',\n            }),\n            sessionToken:\n              options.accessKeyId != null && options.secretAccessKey != null\n                ? options.sessionToken\n                : loadOptionalSetting({\n                    settingValue: options.sessionToken,\n                    environmentVariableName: 'AWS_SESSION_TOKEN',\n                  }),\n          };\n        } catch (error) {\n          // Provide helpful error message for missing AWS credentials\n          const errorMessage =\n            error instanceof Error ? error.message : String(error);\n          if (\n            errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n            errorMessage.includes('accessKeyId')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                '3. Use a credentialProvider function\\n' +\n                '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }\n          if (\n            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n            errorMessage.includes('secretAccessKey')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                'Please ensure both credentials are provided.\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/amazon-bedrock/src/amazon-bedrock-provider.ts#L241-L277","documentation":"createAmazonBedrock wraps low-level credential resolution failures into this descriptive error. When the AWS SigV4 signing path cannot find credentials (its message mentions AWS_ACCESS_KEY_ID or accessKeyId), the provider rethrows with a checklist of all four supported authentication methods. It exists so developers see every valid way to supply Bedrock credentials instead of a cryptic SDK error.","triggerScenarios":"Calling createAmazonBedrock()/bedrock(modelId) without any credentials: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars, no accessKeyId/secretAccessKey options, no credentialProvider option, and no apiKey/AWS_BEARER_TOKEN_BEDROCK — while the underlying credential loader throws a message containing 'AWS_ACCESS_KEY_ID' or 'accessKeyId'.","commonSituations":"Running locally without AWS env vars configured; CI environments missing AWS secrets; constructing the provider in code that assumes ambient AWS SDK credential chain resolution; accidentally destructuring/omitting the credentials option.","solutions":["Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables.","Pass accessKeyId/secretAccessKey explicitly in createAmazonBedrock options.","Supply a credentialProvider function returning valid AWS credentials.","Alternatively use API key auth via AWS_BEARER_TOKEN_BEDROCK env var or the apiKey option."],"exampleFix":"// before\nconst bedrock = createAmazonBedrock();\nconst model = bedrock('anthropic.claude-3-sonnet-20240229-v1:0');\n// after (option A: env)\nprocess.env.AWS_ACCESS_KEY_ID = '...';\nprocess.env.AWS_SECRET_ACCESS_KEY = '...';\nconst bedrock = createAmazonBedrock({ region: 'us-east-1' });\n// after (option B: explicit)\nconst bedrock = createAmazonBedrock({\n  region: 'us-east-1',\n  accessKeyId: '...',\n  secretAccessKey: '...',\n});","handlingStrategy":"validation","validationCode":"function assertBedrockCredentials(opts) {\n  const hasEnv = !!process.env.AWS_ACCESS_KEY_ID && !!process.env.AWS_SECRET_ACCESS_KEY;\n  const hasOpts = !!opts?.accessKeyId && !!opts?.secretAccessKey;\n  const hasProvider = typeof opts?.credentialProvider === 'function';\n  const hasApiKey = !!opts?.apiKey || !!process.env.AWS_BEARER_TOKEN_BEDROCK;\n  if (!hasEnv && !hasOpts && !hasProvider && !hasApiKey) {\n    throw new Error('No Bedrock credentials: set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, pass accessKeyId/secretAccessKey, credentialProvider, or apiKey.');\n  }\n}","typeGuard":"function hasAwsCredentials(o): o is { accessKeyId: string; secretAccessKey: string } {\n  return !!o && typeof (o as any).accessKeyId === 'string' && typeof (o as any).secretAccessKey === 'string';\n}","tryCatchPattern":"try {\n  const model = bedrock(modelId);\n} catch (error) {\n  if (error instanceof Error && error.message.includes('SigV4 authentication')) {\n    // prompt user / load credentials from secret manager, then retry\n  } else {\n    throw error;\n  }\n}","preventionTips":["Load credentials in one bootstrap module and validate them at startup before creating models.","Check env vars in CI with an early fail-fast step.","Prefer explicit options or credentialProvider over implicit ambient resolution.","Never commit credentials; inject via environment/secrets manager."],"tags":["aws","authentication","bedrock","missing-credentials"],"backgroundTag":"missing-aws-credentials","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}