{"record":{"id":"5b0ec7049ade57a8","repo":"vercel/ai","slug":"aws-sigv4-authentication-requires-both-aws-access-5b0ec7","errorCode":null,"errorMessage":"AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Please ensure both credentials are provided.\nOriginal error: ${errorMessage}","messagePattern":"AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY\\. Please ensure both credentials are provided\\.\nOriginal error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/amazon-bedrock/src/mantle/bedrock-mantle-provider.ts","lineNumber":205,"sourceCode":"              error instanceof Error ? error.message : String(error);\n            if (\n              errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n              errorMessage.includes('accessKeyId')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                  '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                  '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                  '3. Use a credentialProvider function\\n' +\n                  '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }\n            if (\n              errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n              errorMessage.includes('secretAccessKey')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                  'Please ensure both credentials are provided.\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }\n            throw error;\n          }\n        },\n        options.fetch,\n        'bedrock-mantle',\n      );\n\n  const getBaseURL = (): string =>\n    withoutTrailingSlash(\n      options.baseURL ??\n        `https://bedrock-mantle.${loadSetting({\n          settingValue: options.region,\n          settingName: 'region',","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/amazon-bedrock/src/mantle/bedrock-mantle-provider.ts#L187-L223","documentation":"When the SigV4 signing error message references AWS_SECRET_ACCESS_KEY or secretAccessKey, createBedrockMantle rethrows an Error stating that BOTH AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are required. This catches the partial-credential case where only one of the pair is present.","triggerScenarios":"Only AWS_SECRET_ACCESS_KEY (or only its option counterpart) is provided while AWS_ACCESS_KEY_ID is missing, so the signer complains about incomplete credentials.","commonSituations":"Secrets managers injecting only the secret key; a typo like AWS_ACCESS_KEY or AWS_ACCESS_KEYID; one variable overwritten in a .env file; partial secrets in CI configuration.","solutions":["Verify both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set — print their presence (not values) at startup.","Fix variable-name typos in .env / CI secret configuration.","Pass both accessKeyId and secretAccessKey explicitly in createBedrockMantle options.","Use a credentialProvider (e.g. fromNodeProviderChain) to resolve the full pair atomically.","Check .env loading — ensure the file is actually read and not shadowed by an incomplete environment."],"exampleFix":"// before (.env)\nAWS_SECRET_ACCESS_KEY=xxxx\n// after (.env)\nAWS_ACCESS_KEY_ID=AKIA...\nAWS_SECRET_ACCESS_KEY=xxxx\nAWS_REGION=us-east-1","handlingStrategy":"validation","validationCode":"function assertBothAwsKeysPresent() {\n  const hasId = !!process.env.AWS_ACCESS_KEY_ID;\n  const hasSecret = !!process.env.AWS_SECRET_ACCESS_KEY;\n  if (hasSecret !== hasId) {\n    throw new Error(`Partial AWS credentials: AWS_ACCESS_KEY_ID=${hasId}, AWS_SECRET_ACCESS_KEY=${hasSecret}. Both are required.`);\n  }\n}","typeGuard":"function hasCompleteStaticAwsCredentials(c) {\n  return typeof c?.accessKeyId === 'string' && c.accessKeyId.length > 0 && typeof c?.secretAccessKey === 'string' && c.secretAccessKey.length > 0;\n}","tryCatchPattern":"try {\n  return await generateText({ model: mantle(modelId), prompt });\n} catch (error) {\n  if (error instanceof Error && error.message.includes('requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY')) {\n    console.error('Only one of the AWS credential pair is set; check env vars and secret injection.');\n  }\n  throw error;\n}","preventionTips":["Check the credential pair (not just one variable) during startup health checks.","Beware variable-name typos: AWS_ACCESS_KEY_ID, not AWS_ACCESS_KEY or AWS_ACCESS_KEYID.","Inject both secrets together from your secrets manager.","Prefer a credentialProvider that resolves the full credential object atomically."],"tags":["aws","sigv4","credentials","env-var","bedrock"],"backgroundTag":"aws-credentials-not-found","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}