{"record":{"id":"26dc161f3215ff31","repo":"vercel/ai","slug":"aws-sigv4-authentication-requires-aws-credentials-26dc16","errorCode":null,"errorMessage":"AWS SigV4 authentication requires AWS credentials. Please provide either:\n1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n2. Provide accessKeyId and secretAccessKey in options\n3. Use a credentialProvider function\n4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\nOriginal error: ${errorMessage}","messagePattern":"AWS SigV4 authentication requires AWS credentials\\. Please provide either:\n1\\. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n2\\. Provide accessKeyId and secretAccessKey in options\n3\\. Use a credentialProvider function\n4\\. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\nOriginal error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/amazon-bedrock/src/anthropic/amazon-bedrock-anthropic-provider.ts","lineNumber":215,"sourceCode":"            secretAccessKey: loadSetting({\n              settingValue: options.secretAccessKey,\n              settingName: 'secretAccessKey',\n              environmentVariableName: 'AWS_SECRET_ACCESS_KEY',\n              description: 'AWS secret access key',\n            }),\n            sessionToken: loadOptionalSetting({\n              settingValue: options.sessionToken,\n              environmentVariableName: 'AWS_SESSION_TOKEN',\n            }),\n          };\n        } catch (error) {\n          const errorMessage =\n            error instanceof Error ? error.message : String(error);\n          if (\n            errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n            errorMessage.includes('accessKeyId')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                '3. Use a credentialProvider function\\n' +\n                '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }\n          if (\n            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n            errorMessage.includes('secretAccessKey')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                'Please ensure both credentials are provided.\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/amazon-bedrock/src/anthropic/amazon-bedrock-anthropic-provider.ts#L197-L233","documentation":"Identical to error 120 but in createAmazonBedrockAnthropic: the wrapped credential failure mentions AWS_ACCESS_KEY_ID or accessKeyId, so the provider rethrows the full list of the four supported authentication methods. No credentials at all were found for the Bedrock Anthropic provider.","triggerScenarios":"Calling createAmazonBedrockAnthropic()/amazonBedrockAnthropic(modelId) with none of: AWS env vars, accessKeyId/secretAccessKey options, credentialProvider, apiKey/AWS_BEARER_TOKEN_BEDROCK — and the underlying error message matching 'AWS_ACCESS_KEY_ID' or 'accessKeyId'.","commonSituations":"Deploying to an environment without AWS credentials; switching from the main bedrock provider to the anthropic sub-provider and forgetting to copy credential options; missing env vars in serverless functions.","solutions":["Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables.","Pass accessKeyId and secretAccessKey in createAmazonBedrockAnthropic options.","Supply a credentialProvider function returning valid credentials.","Or use API key auth via AWS_BEARER_TOKEN_BEDROCK env var or the apiKey option."],"exampleFix":"// before\nconst anthropic = createAmazonBedrockAnthropic();\n// after\nconst anthropic = createAmazonBedrockAnthropic({\n  region: 'us-east-1',\n  accessKeyId: process.env.AWS_ACCESS_KEY_ID!,\n  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,\n});","handlingStrategy":"validation","validationCode":"function assertAnthropicBedrockAuth(opts) {\n  const hasEnv = !!process.env.AWS_ACCESS_KEY_ID && !!process.env.AWS_SECRET_ACCESS_KEY;\n  const hasOpts = !!opts?.accessKeyId && !!opts?.secretAccessKey;\n  const hasProvider = typeof opts?.credentialProvider === 'function';\n  const hasApiKey = !!opts?.apiKey || !!process.env.AWS_BEARER_TOKEN_BEDROCK;\n  if (!hasEnv && !hasOpts && !hasProvider && !hasApiKey) {\n    throw new Error('createAmazonBedrockAnthropic: no auth method configured.');\n  }\n}","typeGuard":"function hasAuth(o: unknown): boolean {\n  const c = o as any;\n  return !!(c?.accessKeyId && c?.secretAccessKey) || typeof c?.credentialProvider === 'function' || !!c?.apiKey;\n}","tryCatchPattern":"try {\n  const anthropic = createAmazonBedrockAnthropic(options);\n} catch (error) {\n  if (error instanceof Error && error.message.includes('SigV4 authentication requires')) {\n    // configure credentials and retry once\n  } else {\n    throw error;\n  }\n}","preventionTips":["Centralize Bedrock auth configuration in a shared factory reused by both provider variants.","Validate auth options at app startup, not lazily at first model call.","Document required env vars for deployments using the anthropic sub-provider."],"tags":["aws","authentication","bedrock","anthropic","missing-credentials"],"backgroundTag":"missing-aws-credentials","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}