{"record":{"id":"55d76e5adb8a3986","repo":"mem0ai/mem0","slug":"aws-bedrock-requires-both-awsaccesskeyid-and-awsse","errorCode":null,"errorMessage":"AWS Bedrock requires both awsAccessKeyId and awsSecretAccessKey when any explicit credential is configured. Omit all credential fields to use the AWS default credential chain.","messagePattern":"AWS Bedrock requires both awsAccessKeyId and awsSecretAccessKey when any explicit credential is configured\\. Omit all credential fields to use the AWS default credential chain\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"mem0-ts/src/oss/src/embeddings/aws_bedrock.ts","lineNumber":100,"sourceCode":"\n  constructor(config: EmbeddingConfig) {\n    this.model = config.model || DEFAULT_MODEL;\n    this.region = config.awsRegion || process.env.AWS_REGION || DEFAULT_REGION;\n    this.embeddingDims = config.embeddingDims;\n\n    const hasKeyPair = Boolean(\n      config.awsAccessKeyId && config.awsSecretAccessKey,\n    );\n    const hasAnyCredential = Boolean(\n      config.awsAccessKeyId ||\n      config.awsSecretAccessKey ||\n      config.awsSessionToken,\n    );\n\n    // Partially configured credentials would silently fall back to the default\n    // chain, embedding under an identity the caller never chose.\n    if (hasAnyCredential && !hasKeyPair) {\n      throw new Error(\n        \"AWS Bedrock requires both awsAccessKeyId and awsSecretAccessKey when any explicit credential is configured. \" +\n          \"Omit all credential fields to use the AWS default credential chain.\",\n      );\n    }\n\n    // Leaving `credentials` unset lets the AWS SDK resolve them from its\n    // default chain: environment, shared config, SSO, or the instance role.\n    if (hasKeyPair) {\n      this.credentials = {\n        accessKeyId: config.awsAccessKeyId!,\n        secretAccessKey: config.awsSecretAccessKey!,\n        ...(config.awsSessionToken && { sessionToken: config.awsSessionToken }),\n      };\n    }\n  }\n\n  private async loadSdk(): Promise<BedrockRuntimeModule> {\n    try {","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/mem0ai/mem0/blob/001c235229be8795e3834520467bd0d661ed8f34/mem0-ts/src/oss/src/embeddings/aws_bedrock.ts#L82-L118","documentation":"Thrown by the AWS Bedrock embedder constructor when credential config is partially filled in. The SDK refuses a mix like accessKeyId without secretAccessKey because the AWS client would silently fall back to the default credential chain, embedding data under an identity the caller never chose — a fail-fast security guard. Either provide BOTH awsAccessKeyId and awsSecretAccessKey (plus optional awsSessionToken), or provide none of them.","triggerScenarios":"EmbeddingConfig with awsAccessKeyId set but awsSecretAccessKey missing/typo'd; awsSessionToken supplied alone (temporary-STS pattern copied incompletely); key names mistyped so one lands undefined (e.g. awsAccessKeyId vs aws_access_key_id).","commonSituations":"Rotating from static keys to IAM roles and deleting only one field; copying IAM env-var names (AWS_ACCESS_KEY_ID) into config expecting them to map; using STS temp credentials and forgetting the session token alone is not an identity.","solutions":["Supply the full pair: { awsAccessKeyId, awsSecretAccessKey, ...(token && { awsSessionToken: token }) }","Or remove ALL credential fields from the embedder config to use the AWS default chain (env vars, shared config/SSO, instance role) — often the right choice on EC2/ECS/EKS","Check for typos/falsy values: an empty string still counts as 'not configured', so ensure both values are real strings"],"exampleFix":"// before\nnew Memory({\n  embedder: { provider: 'aws_bedrock', config: { model: 'cohere.embed-english-v3', awsAccessKeyId, } },\n});\n\n// after - explicit static keys\nnew Memory({\n  embedder: {\n    provider: 'aws_bedrock',\n    config: { model: 'cohere.embed-english-v3', awsAccessKeyId, awsSecretAccessKey },\n  },\n});\n// or: omit all three fields and rely on the default credential chain","handlingStrategy":"validation","validationCode":"const cfg: BedrockConfig = { model: 'cohere.embed-english-v3', region };\nif (cfg.awsAccessKeyId || cfg.awsSecretAccessKey || cfg.awsSessionToken) {\n  if (!(cfg.awsAccessKeyId && cfg.awsSecretAccessKey)) {\n    throw new Error('Provide BOTH awsAccessKeyId and awsSecretAccessKey, or none');\n  }\n}\n// safe to construct the Memory/embedder now","typeGuard":"type FullAwsCreds = { awsAccessKeyId: string; awsSecretAccessKey: string; awsSessionToken?: string };\nconst hasFullAwsCreds = (c: Partial<FullAwsCreds> = {}): c is FullAwsCreds =>\n  typeof c.awsAccessKeyId === 'string' && c.awsAccessKeyId.length > 0 &&\n  typeof c.awsSecretAccessKey === 'string' && c.awsSecretAccessKey.length > 0;","tryCatchPattern":"try {\n  new Memory({ embedder: { provider: 'aws_bedrock', config: bedrockConfig } });\n} catch (e) {\n  if (e instanceof Error && e.message.includes('awsAccessKeyId and awsSecretAccessKey')) {\n    // deterministic config error — complete the pair or drop all credential fields\n    delete bedrockConfig.awsSessionToken; // etc., then rebuild config deliberately\n    throw e;\n  }\n  throw e;\n}","preventionTips":["On EC2/ECS/EKS leave all credential fields out and let the instance role resolve — it is both safer and immune to this error","Build the credential object in one place and pass it whole, never field-by-field","Add a unit test asserting your config either has the full pair or no credential keys"],"tags":["aws","bedrock","embeddings","credentials","validation","security"],"backgroundTag":null,"analyzedSha":"001c235229be8795e3834520467bd0d661ed8f34","analyzedAt":"2026-08-15T01:55:42.685Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}