{"record":{"id":"3d646d067cc35d50","repo":"BerriAI/litellm","slug":"no-aws-credentials-found-for-bedrock-realtime-set","errorCode":null,"errorMessage":"No AWS credentials found for Bedrock realtime. Set aws_* params in litellm_params or configure credentials in the environment","messagePattern":"No AWS credentials found for Bedrock realtime\\. Set aws_\\* params in litellm_params or configure credentials in the environment","errorType":"http","errorClass":"BedrockError","httpStatus":401,"severity":"error","filePath":"litellm/llms/bedrock/realtime/handler.py","lineNumber":101,"sourceCode":"        else:\n            endpoint_uri = f\"https://bedrock-runtime.{aws_region_name}.amazonaws.com\"\n\n        verbose_proxy_logger.debug(\"Bedrock Realtime: Connecting to %s with model %s\", endpoint_uri, model)\n\n        credentials: Final = self.get_credentials(\n            aws_access_key_id=aws_access_key_id,\n            aws_secret_access_key=aws_secret_access_key,\n            aws_session_token=aws_session_token,\n            aws_region_name=aws_region_name,\n            aws_session_name=aws_session_name,\n            aws_profile_name=aws_profile_name,\n            aws_role_name=aws_role_name,\n            aws_web_identity_token=aws_web_identity_token,\n            aws_sts_endpoint=aws_sts_endpoint,\n            aws_external_id=aws_external_id,\n        )\n        if credentials is None:\n            raise BedrockError(\n                status_code=401,\n                message=(\n                    \"No AWS credentials found for Bedrock realtime. Set aws_* params in litellm_params \"\n                    \"or configure credentials in the environment\"\n                ),\n            )\n        frozen_credentials: Final = credentials.get_frozen_credentials()\n\n        # Initialize Bedrock client with aws_sdk_bedrock_runtime\n        config: Final = Config(\n            endpoint_uri=endpoint_uri,\n            region=aws_region_name,\n            aws_access_key_id=frozen_credentials.access_key,\n            aws_secret_access_key=frozen_credentials.secret_key,\n            aws_session_token=frozen_credentials.token,\n            aws_credentials_identity_resolver=StaticCredentialsResolver(),\n        )\n        bedrock_client: Final = BedrockRuntimeClient(config=config)","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/llms/bedrock/realtime/handler.py#L83-L119","documentation":"Before opening a Bedrock realtime session the handler resolves AWS credentials via the standard chain (access keys, profile, role, web identity). If get_bedrock_credentials returns None, LiteLLM raises BedrockError 401 instructing you to set aws_* params in litellm_params or configure environment credentials. No attempt to connect is made after this.","triggerScenarios":"litellm.realtime(..., model='bedrock/<realtime-model>') in an environment with no resolvable AWS credentials: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, no ~/.aws/credentials, no attached IAM role, and no aws_* litellm_params on the deployment.","commonSituations":"Local development without AWS login, containers without roles or mounted credentials, expired SSO tokens, AWS_PROFILE pointing at a profile that no longer exists.","solutions":["Verify the chain resolves: aws sts get-caller-identity (or aws sso login first)","Set AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (plus AWS_SESSION_TOKEN for temporary creds), or pass aws_access_key_id/aws_secret_access_key in litellm_params","For containerized workloads, attach an IAM role (IRSA on EKS, task role on ECS) so the chain resolves implicitly"],"exampleFix":"# before\nlitellm.realtime(model=\"bedrock/amazon.nova-sonic-v1:0\", ...)\n\n# after\nos.environ[\"AWS_ACCESS_KEY_ID\"] = \"...\"\nos.environ[\"AWS_SECRET_ACCESS_KEY\"] = \"...\"\nlitellm.realtime(model=\"bedrock/amazon.nova-sonic-v1:0\", ...)","handlingStrategy":"validation","validationCode":"import botocore.session\n\ncreds = botocore.session.get_session().get_credentials()\nif creds is None:\n    raise SystemExit(\n        \"no AWS credentials for bedrock realtime; set AWS_* env vars, a profile, or attach an IAM role\"\n    )","typeGuard":"def aws_credentials_resolvable() -> bool:\n    \"\"\"True when the default botocore chain yields credentials.\"\"\"\n    return botocore.session.get_session().get_credentials() is not None","tryCatchPattern":"from litellm.llms.bedrock.common_utils import BedrockError\n\ntry:\n    session = litellm.realtime(model=model, ...)\nexcept BedrockError as e:\n    if e.status_code == 401:\n        # credential chain empty: surface an auth-setup error, do not retry\n        raise AuthConfigError(\"configure AWS credentials for bedrock realtime\") from e\n    raise","preventionTips":["Validate credential resolution with botocore at process startup for realtime workers","Run aws sts get-caller-identity in deployment pipelines before enabling realtime models","Prefer attached IAM roles over static keys in containerized environments"],"tags":["bedrock","realtime","authentication","aws-credentials"],"backgroundTag":"missing-credentials","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}