{"record":{"id":"3a6ff241b46eb026","repo":"JuliusBrussee/caveman","slug":"cache-replay-bedrock-bearer-token-or-aws-access-c","errorCode":null,"errorMessage":"cache-replay: Bedrock bearer token or AWS access credentials unavailable","messagePattern":"cache-replay: Bedrock bearer token or AWS access credentials unavailable","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cacheengine/cmd/cache-replay/main.go","lineNumber":389,"sourceCode":"\t\tproviders[record.Provider] = true\n\t}\n\tfor provider := range providers {\n\t\tswitch provider {\n\t\tcase \"openai\":\n\t\t\tif os.Getenv(\"OPENAI_API_KEY\") == \"\" {\n\t\t\t\treturn errors.New(\"cache-replay: OPENAI_API_KEY unavailable\")\n\t\t\t}\n\t\tcase \"anthropic\":\n\t\t\tif os.Getenv(\"ANTHROPIC_API_KEY\") == \"\" {\n\t\t\t\treturn errors.New(\"cache-replay: ANTHROPIC_API_KEY unavailable\")\n\t\t\t}\n\t\tcase \"gemini\":\n\t\t\tif os.Getenv(\"GEMINI_API_KEY\") == \"\" {\n\t\t\t\treturn errors.New(\"cache-replay: GEMINI_API_KEY unavailable\")\n\t\t\t}\n\t\tcase \"bedrock\":\n\t\t\tif os.Getenv(\"AWS_BEARER_TOKEN_BEDROCK\") == \"\" && (os.Getenv(\"AWS_ACCESS_KEY_ID\") == \"\" || os.Getenv(\"AWS_SECRET_ACCESS_KEY\") == \"\") {\n\t\t\t\treturn errors.New(\"cache-replay: Bedrock bearer token or AWS access credentials unavailable\")\n\t\t\t}\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"cache-replay: unsupported provider %q\", provider)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc verifierEnvironment(extra []string) ([]string, error) {\n\tallowed := map[string]bool{\"PATH\": true, \"LANG\": true, \"LC_ALL\": true, \"TMPDIR\": true}\n\tblocked := map[string]bool{\n\t\t\"OPENAI_API_KEY\": true, \"ANTHROPIC_API_KEY\": true, \"GEMINI_API_KEY\": true,\n\t\t\"AWS_BEARER_TOKEN_BEDROCK\": true, \"AWS_ACCESS_KEY_ID\": true, \"AWS_SECRET_ACCESS_KEY\": true, \"AWS_SESSION_TOKEN\": true,\n\t}\n\tfor _, name := range extra {\n\t\tname = strings.TrimSpace(name)\n\t\tif !validEnvironmentName(name) || blocked[name] {\n\t\t\treturn nil, fmt.Errorf(\"cache-replay: verifier environment variable %q is invalid or credential-bearing\", name)","sourceCodeStart":371,"sourceCodeEnd":407,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/cacheengine/cmd/cache-replay/main.go#L371-L407","documentation":"Returned by validateProviderCredentials for bedrock traces: neither AWS_BEARER_TOKEN_BEDROCK is set nor the classic AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY pair is complete (both must be non-empty). Bedrock accepts either a bearer token or long-lived access keys, and the check fails only when neither path is fully satisfied.","triggerScenarios":"Trace with provider \"bedrock\" records where AWS_BEARER_TOKEN_BEDROCK is unset AND at least one of AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY is empty. Setting only the access key ID without the secret also triggers it.","commonSituations":"Relying on an AWS profile file or SSO session instead of env vars (the tool only inspects env); bearer token named differently; key rotation script updated one of the two env vars; CI masking one variable due to a name collision.","solutions":["Export AWS_BEARER_TOKEN_BEDROCK (preferred) OR both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY","If credentials live in an AWS profile/session, materialize them into the env for the cache-replay process (e.g. via aws configure export-credentials or your SSO tooling)","Check for half-written pairs: one of the two classic vars missing still fails"],"exampleFix":"# before\n# only AWS_ACCESS_KEY_ID exported\ncache-replay -execute ...\n\n# after\nexport AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=...\n# or: export AWS_BEARER_TOKEN_BEDROCK=...\ncache-replay -execute ...","handlingStrategy":"validation","validationCode":"if providers[\"bedrock\"] {\n\tbearer := os.Getenv(\"AWS_BEARER_TOKEN_BEDROCK\") != \"\"\n\tclassic := os.Getenv(\"AWS_ACCESS_KEY_ID\") != \"\" && os.Getenv(\"AWS_SECRET_ACCESS_KEY\") != \"\"\n\tif !bearer && !classic {\n\t\treturn errors.New(\"provide AWS_BEARER_TOKEN_BEDROCK or both AWS access env vars\")\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Materialize AWS SSO/profile credentials into env vars for the replay process — the tool reads env only","Ensure both halves of the classic pair are exported; a lone access key ID still fails"],"tags":["go","credentials","environment","aws","cli"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}