{"record":{"id":"411db54fccf9d036","repo":"warpdotdev/warp","slug":"bedrock-access-key-secrets-require-access-key-id","errorCode":null,"errorMessage":"Bedrock access key secrets require --access-key-id, --secret-access-key, and --region in non-interactive mode","messagePattern":"Bedrock access key secrets require --access-key-id, --secret-access-key, and --region in non-interactive mode","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"app/src/ai/agent_sdk/secret.rs","lineNumber":741,"sourceCode":"///\n/// `session_token` is optional: if the user passes an empty `--session-token`\n/// value or hits Enter at the interactive prompt, no session token is stored.\n/// This supports persistent IAM credentials, which do not require a session token.\nfn read_bedrock_access_key_secret_value(\n    access_key_id: Option<String>,\n    secret_access_key: Option<String>,\n    session_token: Option<String>,\n    region: Option<String>,\n) -> Result<Option<ManagedSecretValue>> {\n    // Error message used for all three required fields when running non-interactively.\n    // --session-token is intentionally omitted because it is optional.\n    const NON_INTERACTIVE_REQUIRED_MSG: &str = \"Bedrock access key secrets require --access-key-id, --secret-access-key, and --region in non-interactive mode\";\n\n    let access_key_id = match access_key_id {\n        Some(v) if !v.is_empty() => v,\n        _ => {\n            if !io::stdin().is_terminal() {\n                return Err(anyhow::anyhow!(NON_INTERACTIVE_REQUIRED_MSG));\n            }\n            match inquire::Text::new(\"AWS Access Key ID:\").prompt() {\n                Ok(value) if !value.is_empty() => value,\n                Ok(_) => return Ok(None),\n                Err(InquireError::OperationCanceled | InquireError::OperationInterrupted) => {\n                    return Ok(None);\n                }\n                Err(err) => return Err(err.into()),\n            }\n        }\n    };\n\n    let secret_access_key = match secret_access_key {\n        Some(v) if !v.is_empty() => v,\n        _ => {\n            if !io::stdin().is_terminal() {\n                return Err(anyhow::anyhow!(NON_INTERACTIVE_REQUIRED_MSG));\n            }","sourceCodeStart":723,"sourceCodeEnd":759,"githubUrl":"https://github.com/warpdotdev/warp/blob/e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc/app/src/ai/agent_sdk/secret.rs#L723-L759","documentation":"The access-key-id leg of read_bedrock_access_key_secret_value: for Bedrock access-key secrets the three required fields are prompted interactively when flags are missing, but in non-interactive mode (stdin not a terminal) a missing/empty --access-key-id aborts with NON_INTERACTIVE_REQUIRED_MSG. The shared message names all three required flags; --session-token is intentionally omitted because it is optional.","triggerScenarios":"Creating a Bedrock access-key secret in CI/pipe without a non-empty --access-key-id (regardless of the other flags).","commonSituations":"CI provisioning with one of three env vars unset; empty-string flag values; migrating from a raw secret where only --value was needed.","solutions":["Pass all three required flags non-empty: --access-key-id, --secret-access-key, and --region (plus optional --session-token)","Run interactively to be prompted field by field","Fail fast in scripts when any of the three env vars is unset or empty"],"exampleFix":"# before\noz secret create aws --secret-access-key \"$SK\" --region us-east-1\n# Error: Bedrock access key secrets require --access-key-id, --secret-access-key, and --region in non-interactive mode\n\n# after\noz secret create aws --access-key-id \"$AKID\" --secret-access-key \"$SK\" --region us-east-1","handlingStrategy":"validation","validationCode":"let need = [access_key_id.as_deref(), secret_access_key.as_deref(), region.as_deref()]\n    .iter()\n    .any(|v| v.map_or(true, |s| s.is_empty()));\nif need && !std::io::stdin().is_terminal() {\n    anyhow::bail!(\"non-interactive Bedrock access-key create requires --access-key-id, --secret-access-key, --region\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-flight all three required env vars as non-empty in CI","Remember --session-token is optional; the other three are not","Keep the triple together in one secret-provisioning template"],"tags":["agent-sdk","secrets","bedrock","non-interactive","validation"],"backgroundTag":null,"analyzedSha":"e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc","analyzedAt":"2026-08-16T08:27:25.381Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}