{"record":{"id":"3e4c973f7cf81a3e","repo":"BerriAI/litellm","slug":"no-aws-credentials-found-provide-aws-access-key-i","errorCode":null,"errorMessage":"No AWS credentials found. Provide aws_access_key_id and aws_secret_access_key, or configure default credentials (env vars, ~/.aws/credentials, instance profile).","messagePattern":"No AWS credentials found\\. Provide aws_access_key_id and aws_secret_access_key, or configure default credentials \\(env vars, ~/\\.aws/credentials, instance profile\\)\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/experimental_mcp_client/client.py","lineNumber":150,"sourceCode":"                aws_access_key_id=aws_access_key_id,\n                aws_secret_access_key=aws_secret_access_key,\n                aws_session_token=aws_session_token,\n                aws_region_name=self.region_name,\n            )\n        elif aws_access_key_id and aws_secret_access_key:\n            self.credentials = Credentials(\n                access_key=aws_access_key_id,\n                secret_key=aws_secret_access_key,\n                token=aws_session_token,\n            )\n        else:\n            # Fall back to default boto3 credential chain\n            import botocore.session\n\n            session: Final = botocore.session.get_session()\n            self.credentials = session.get_credentials()\n            if self.credentials is None:\n                raise ValueError(\n                    \"No AWS credentials found. Provide aws_access_key_id and \"\n                    \"aws_secret_access_key, or configure default credentials \"\n                    \"(env vars, ~/.aws/credentials, instance profile).\"\n                )\n\n    @staticmethod\n    def _assume_role(\n        aws_role_name: str,\n        aws_session_name: str | None,\n        aws_access_key_id: str | None,\n        aws_secret_access_key: str | None,\n        aws_session_token: str | None,\n        aws_region_name: str,\n    ):\n        \"\"\"Call STS AssumeRole and return temporary credentials.\"\"\"\n        import boto3\n        from botocore.credentials import Credentials\n","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/experimental_mcp_client/client.py#L132-L168","documentation":"When no explicit AWS keys are supplied, the MCP client falls back to the default botocore credential chain (env vars, ~/.aws/credentials, EC2/ECS instance profiles). If that chain yields no credentials at all, session.get_credentials() returns None and this ValueError is raised because SigV4 signing is impossible without credentials.","triggerScenarios":"Configuring an MCP server with aws_sigv4_auth but omitting aws_access_key_id/aws_secret_access_key AND running where AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars are unset, no ~/.aws/credentials file exists, and no instance/role profile is available (laptop, non-AWS CI runner).","commonSituations":"Local development where credentials live only in a named profile (not 'default'); CI runners without AWS auth configured; containers that dropped the mounted ~/.aws volume; expired or misspelled env var names (e.g. AWS_SECRET_ACCESS_KEY missing while AWS_ACCESS_KEY_ID is set).","solutions":["Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars (plus AWS_SESSION_TOKEN if using temporary creds) in the process running litellm","Pass aws_access_key_id / aws_secret_access_key directly in the MCP server's auth config so no chain lookup happens","Create a valid ~/.aws/credentials with a [default] profile, or run `aws configure`","On EC2/ECS/EKS, attach an instance role / task role so the instance-profile chain resolves"],"exampleFix":"# before\nexport AWS_ACCESS_KEY_ID=...   # secret key forgotten\n\n# after\nexport AWS_ACCESS_KEY_ID=AKIA...\nexport AWS_SECRET_ACCESS_KEY=...\n# or in MCP server config:\n# aws_sigv4_auth: {aws_access_key_id: ..., aws_secret_access_key: ..., aws_region_name: us-east-1}","handlingStrategy":"validation","validationCode":"import os\n\ndef aws_creds_available() -> bool:\n    if os.getenv(\"AWS_ACCESS_KEY_ID\") and os.getenv(\"AWS_SECRET_ACCESS_KEY\"):\n        return True\n    try:\n        import botocore.session\n        return botocore.session.get_session().get_credentials() is not None\n    except Exception:\n        return False\n\nassert aws_creds_available(), \"configure AWS credentials before SigV4 MCP auth\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["aws sts get-command-caller-identity as a preflight in deploy scripts","Pass keys explicitly in config when running outside AWS","Ensure [default] profile exists in ~/.aws/credentials"],"tags":["mcp","aws","credentials","configuration"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}