{"record":{"id":"475e35ba29af72e4","repo":"headroomlabs-ai/headroom","slug":"bedrock-with-temporary-credentials-aws-session-to","errorCode":null,"errorMessage":"Bedrock with temporary credentials (AWS_SESSION_TOKEN) requires botocore, which is not installed. Install the bedrock extra: pip install 'headroom-ai[bedrock]' (or pip install botocore).","messagePattern":"Bedrock with temporary credentials \\(AWS_SESSION_TOKEN\\) requires botocore, which is not installed\\. Install the bedrock extra: pip install 'headroom-ai\\[bedrock\\]' \\(or pip install botocore\\)\\.","errorType":"exception","errorClass":"ImportError","httpStatus":null,"severity":"error","filePath":"headroom/backends/litellm.py","lineNumber":636,"sourceCode":"        self.provider = provider\n        self.region = region\n        self.profile_name = profile_name\n        self.kwargs = kwargs\n\n        # Get provider config from registry\n        self._config = get_provider_config(provider)\n\n        # For Bedrock, fetch model map dynamically from AWS API\n        if provider == \"bedrock\":\n            # litellm takes the botocore-backed `_auth_with_aws_session_token`\n            # path as soon as temporary credentials (AWS_SESSION_TOKEN) are\n            # present. botocore is an optional dependency (the `bedrock`\n            # extra); when it is absent — as in the slim default Docker image —\n            # the failure only surfaces at request time as a misleading\n            # `authentication_error: No module named 'botocore'` (#1551). Fail\n            # fast at startup with an actionable message instead.\n            if os.environ.get(\"AWS_SESSION_TOKEN\") and importlib.util.find_spec(\"botocore\") is None:\n                raise ImportError(\n                    \"Bedrock with temporary credentials (AWS_SESSION_TOKEN) requires \"\n                    \"botocore, which is not installed. Install the bedrock extra: \"\n                    \"pip install 'headroom-ai[bedrock]' (or pip install botocore).\"\n                )\n            self._model_map = _fetch_bedrock_inference_profiles(region, profile_name=profile_name)\n            litellm.set_verbose = False  # Reduce noise\n        else:\n            self._model_map = self._config.model_map\n\n        # Operator override map (all providers; only meaningful for Bedrock\n        # today). Lets you pin a plain model name to a specific target the\n        # AWS discovery can't disambiguate — e.g. a per-user application\n        # inference profile ARN for cost attribution. See\n        # `_parse_bedrock_model_overrides`.\n        self._model_overrides = _parse_bedrock_model_overrides(\n            os.environ.get(\"HEADROOM_BEDROCK_MODEL_MAP\")\n        )\n        if self._model_overrides:","sourceCodeStart":618,"sourceCodeEnd":654,"githubUrl":"https://github.com/headroomlabs-ai/headroom/blob/322425c43bffde1ed0b64fecf3cf5951565dd82b/headroom/backends/litellm.py#L618-L654","documentation":"LiteLLMBackend raises ImportError at startup when provider='bedrock', AWS_SESSION_TOKEN is set in the environment, and botocore is not installed. litellm routes through a botocore-backed auth path as soon as temporary credentials are present; without botocore that failure would only appear at request time as a misleading 'authentication_error: No module named botocore' (issue #1551), so the check fails fast with an actionable message.","triggerScenarios":"provider='bedrock' + AWS_SESSION_TOKEN in env (SSO role, assumed role, ECS/GitHub Actions task role) + slim image without the bedrock extra.","commonSituations":"Running the slim Docker image inside AWS (ECS/Fargate task roles inject AWS_SESSION_TOKEN), CI with OIDC-assumed roles, or aws sso login --profile wrappers; works locally with long-lived keys, breaks in temp-credential environments.","solutions":["Install the extra: pip install 'headroom-ai[bedrock]' (or pip install botocore) and rebuild the image.","Alternatively use persistent credentials (long-lived access keys) so the botocore path is not required.","If the session token is stale/leftover from another account, unset AWS_SESSION_TOKEN and authenticate properly for the target account."],"exampleFix":"# before (Dockerfile, slim image)\nRUN pip install headroom-ai\n# at runtime: AWS_SESSION_TOKEN=... -> ImportError\n\n# after\nRUN pip install 'headroom-ai[bedrock]'","handlingStrategy":"validation","validationCode":"import importlib.util, os\n\ndef bedrock_ready_for_env() -> bool:\n    if os.environ.get(\"HEADROOM_PROVIDER\", \"\") != \"bedrock\":\n        return True\n    if not os.environ.get(\"AWS_SESSION_TOKEN\"):\n        return True  # long-lived creds: botocore path not required\n    return importlib.util.find_spec(\"botocore\") is not None\n\nif not bedrock_ready_for_env():\n    raise SystemExit(\"temp AWS creds need botocore: pip install 'headroom-ai[bedrock]'\")","typeGuard":null,"tryCatchPattern":"try:\n    backend = LiteLLMBackend(provider=\"bedrock\")\nexcept ImportError as e:\n    if \"botocore\" in str(e):\n        raise SystemExit(\"install the bedrock extra in this image\") from e\n    raise","preventionTips":["Assume task-role environments always inject AWS_SESSION_TOKEN; ship the bedrock extra in any AWS-hosted image.","Add a startup preflight that mirrors this exact condition (token present + no botocore).","Track which image flavor (slim vs full) each deployment uses so optional deps are not a surprise."],"tags":["python","aws","bedrock","optional-dependency","credentials","fail-fast"],"backgroundTag":null,"analyzedSha":"322425c43bffde1ed0b64fecf3cf5951565dd82b","analyzedAt":"2026-08-15T01:03:05.481Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}