{"record":{"id":"4172ca0c22404c3e","repo":"vercel/ai","slug":"aws-sigv4-authentication-requires-both-aws-access-4172ca","errorCode":null,"errorMessage":"AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Please ensure both credentials are provided.\nOriginal error: ${errorMessage}","messagePattern":"AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY\\. Please ensure both credentials are provided\\.\nOriginal error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/anthropic-aws/src/anthropic-aws-provider.ts","lineNumber":200,"sourceCode":"            error instanceof Error ? error.message : String(error);\n          if (\n            errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n            errorMessage.includes('accessKeyId')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                '3. Use a credentialProvider function\\n' +\n                '4. Use API key authentication with ANTHROPIC_AWS_API_KEY or apiKey option\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }\n          if (\n            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n            errorMessage.includes('secretAccessKey')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                'Please ensure both credentials are provided.\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }\n          throw error;\n        }\n      }, options.fetch);\n\n  const getBaseURL = (): string =>\n    withoutTrailingSlash(options.baseURL) ??\n    `https://aws-external-anthropic.${loadSetting({\n      settingValue: options.region,\n      settingName: 'region',\n      environmentVariableName: 'AWS_REGION',\n      description: 'AWS region',\n    })}.api.aws/v1`;\n","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/anthropic-aws/src/anthropic-aws-provider.ts#L182-L218","documentation":"If SigV4 signing fails specifically because the AWS secret access key is missing (underlying message mentions AWS_SECRET_ACCESS_KEY or secretAccessKey), the library throws this error indicating BOTH an access key ID and secret access key are required. The original error message is appended.","triggerScenarios":"Credentials resolution finds an accessKeyId but no secretAccessKey — e.g., only AWS_ACCESS_KEY_ID set in the environment, or an options/provider result containing only one of the pair.","commonSituations":"Half-configured env (secret var unset or misspelled like AWS_SECRET_ACCESSKEY); credentials object constructed with only accessKeyId; secrets manager returning a partial record.","solutions":["Set AWS_SECRET_ACCESS_KEY alongside AWS_ACCESS_KEY_ID in the environment.","If passing credentials in options, include both accessKeyId and secretAccessKey.","If using credentialProvider, ensure the returned object includes secretAccessKey.","Verify the env var name spelling and that your process actually receives it (dotenv load, container secrets mount)."],"exampleFix":"// before\ncreateAnthropicAws({ accessKeyId: 'AKIA...' }); // secret missing\n// after\ncreateAnthropicAws({\n  accessKeyId: process.env.AWS_ACCESS_KEY_ID,\n  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,\n  region: 'us-east-1',\n});","handlingStrategy":"validation","validationCode":"if (!process.env.AWS_SECRET_ACCESS_KEY) {\n  throw new Error('AWS_SECRET_ACCESS_KEY is required for SigV4 authentication');\n}","typeGuard":"function isCompleteAwsCreds(v: unknown): v is { accessKeyId: string; secretAccessKey: string } {\n  return !!v && typeof v === 'object' && 'accessKeyId' in v && 'secretAccessKey' in v && typeof (v as any).secretAccessKey === 'string';\n}","tryCatchPattern":"try {\n  const anthropic = createAnthropicAws(opts);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY')) {\n    // add the missing secret access key\n  }\n  throw e;\n}","preventionTips":["Always set the secret key alongside the access key ID.","Check for env var name typos (AWS_SECRET_ACCESSKEY etc.).","Validate both credentials at config-load time.","When loading from a secrets manager, assert the full credential pair."],"tags":["aws","authentication","sigv4","credentials","env"],"backgroundTag":"aws-credentials-missing","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}