{"record":{"id":"4bba3a0460c57ac4","repo":"BerriAI/litellm","slug":"oidc-token-could-not-be-retrieved-from-secret-mana-4bba3a","errorCode":null,"errorMessage":"OIDC token could not be retrieved from secret manager.","messagePattern":"OIDC token could not be retrieved from secret manager\\.","errorType":"http","errorClass":"BedrockError","httpStatus":401,"severity":"critical","filePath":"litellm/llms/bedrock/common_utils.py","lineNumber":474,"sourceCode":"        endpoint_url = env_aws_bedrock_runtime_endpoint\n    else:\n        endpoint_url = f\"https://bedrock-runtime.{region_name}.amazonaws.com\"\n\n    import boto3\n\n    if isinstance(timeout, float):\n        config = boto3.session.Config(connect_timeout=timeout, read_timeout=timeout)\n    elif isinstance(timeout, httpx.Timeout):\n        config = boto3.session.Config(connect_timeout=timeout.connect, read_timeout=timeout.read)\n    else:\n        config = boto3.session.Config()\n\n    ### CHECK STS ###\n    if aws_web_identity_token is not None and aws_role_name is not None and aws_session_name is not None:\n        oidc_token: Final = get_secret(aws_web_identity_token)\n\n        if oidc_token is None:\n            raise BedrockError(\n                message=\"OIDC token could not be retrieved from secret manager.\",\n                status_code=401,\n            )\n\n        sts_client = boto3.client(\"sts\", verify=ssl_verify)\n\n        # https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html\n        # https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sts/client/assume_role_with_web_identity.html\n        sts_response = sts_client.assume_role_with_web_identity(\n            RoleArn=aws_role_name,\n            RoleSessionName=aws_session_name,\n            WebIdentityToken=oidc_token,\n            DurationSeconds=3600,\n        )\n\n        client = boto3.client(\n            service_name=\"bedrock-runtime\",\n            aws_access_key_id=sts_response[\"Credentials\"][\"AccessKeyId\"],","sourceCodeStart":456,"sourceCodeEnd":492,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/llms/bedrock/common_utils.py#L456-L492","documentation":"Raised during Bedrock client initialization when IRSA/web-identity auth is requested (aws_web_identity_token, aws_role_name, and aws_session_name all provided) but get_secret(aws_web_identity_token) returns None - the OIDC token file/env reference could not be resolved. It is a BedrockError 401 because the STS AssumeRoleWithWebIdentity flow cannot proceed without the token.","triggerScenarios":"Configuring bedrock credentials via EKS IRSA-style params where the aws_web_identity_token value is an empty/incorrect secret name, the referenced file does not exist, or the token env var is unset in the container.","commonSituations":"Kubernetes deployments where the projected service-account token path changed or is not mounted, typos in the secret reference, or helm charts that forget to pass the token value through.","solutions":["Verify the token source resolves: check the file path or env var referenced by aws_web_identity_token exists and is readable in the container.","For EKS IRSA, mount the projected service account token and point aws_web_identity_token at its path (e.g. /var/run/secrets/tokens/oidc-token).","Confirm all three params are consistent - an unset role name or session name skips this flow entirely, producing different auth errors.","If secrets are managed via litellm's secret manager, ensure the key is registered there."],"exampleFix":"# before\nlitellm.completion(\n    model=\"bedrock/anthropic.claude-3-sonnet-20240229-v1:0\", messages=msgs,\n    aws_role_name=\"arn:aws:iam::123:role/bedrock-role\",\n    aws_session_name=\"litellm\",\n    aws_web_identity_token=\"OIDC_TOKEN\",  # env/file not present -> None\n)\n\n# after\nimport os\nos.environ[\"OIDC_TOKEN\"] = open(\"/var/run/secrets/tokens/oidc-token\").read()\nlitellm.completion(\n    model=\"bedrock/anthropic.claude-3-sonnet-20240229-v1:0\", messages=msgs,\n    aws_role_name=\"arn:aws:iam::123:role/bedrock-role\",\n    aws_session_name=\"litellm\",\n    aws_web_identity_token=\"OIDC_TOKEN\",\n)","handlingStrategy":"validation","validationCode":"import os\nfrom litellm import get_secret\nif aws_web_identity_token and aws_role_name and aws_session_name:\n    token = get_secret(aws_web_identity_token)\n    if token is None or not token.strip():\n        raise RuntimeError(\n            f\"OIDC token at '{aws_web_identity_token}' is empty/missing - \"\n            \"check the mounted projected token or env var\"\n        )","typeGuard":null,"tryCatchPattern":"from litellm.exceptions import BedrockError\ntry:\n    litellm.completion(model=\"bedrock/<model>\", messages=msgs,\n                       aws_web_identity_token=TOKEN_REF, aws_role_name=ROLE, aws_session_name=SESSION)\nexcept BedrockError as e:\n    if e.status_code == 401 and \"OIDC token\" in str(e):\n        raise RuntimeError(\"Service account token not mounted - fix IRSA config\") from e\n    raise","preventionTips":["Mount the Kubernetes projected service-account token and reference its path explicitly.","Add a readiness probe that reads the token file and asserts non-empty content.","Rotate-aware: tokens refresh; read from the file path rather than copying the value into env at build time."],"tags":["aws","bedrock","oidc","irsa","kubernetes","authentication"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}