{"record":{"id":"5b11a329d8b80915","repo":"can1357/oh-my-pi","slug":"unable-to-resolve-aws-credentials-configure-stati","errorCode":null,"errorMessage":"Unable to resolve AWS credentials. Configure static environment keys, web identity, an AWS profile, ECS credentials, or an EC2 instance role.","messagePattern":"Unable to resolve AWS credentials\\. Configure static environment keys, web identity, an AWS profile, ECS credentials, or an EC2 instance role\\.","errorType":"exception","errorClass":"AwsCredentialsError","httpStatus":null,"severity":"error","filePath":"packages/ai/src/providers/aws-credentials.ts","lineNumber":156,"sourceCode":"\t// 2. Web identity.\n\tconst webIdentityCreds = await readWebIdentityCredentials(region, signal, fetchImpl);\n\tif (webIdentityCreds) return webIdentityCreds;\n\n\t// 3. Profile (static, SSO, or credential_process).\n\tconst profileCreds = await readProfileCredentials(profile, region, loadSharedConfig, signal, fetchImpl);\n\tif (profileCreds) return profileCreds;\n\n\t// 4. ECS/container credentials.\n\tconst containerCreds = await readContainerCredentials(signal, fetchImpl);\n\tif (containerCreds) return containerCreds;\n\n\t// 5. EC2 IMDSv2.\n\tif ($env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== \"true\") {\n\t\tconst imdsCreds = await readImdsCredentials(signal, fetchImpl);\n\t\tif (imdsCreds) return imdsCreds;\n\t}\n\n\tthrow new AIError.AwsCredentialsError(\n\t\t`Unable to resolve AWS credentials. Configure static environment keys, web identity, ` +\n\t\t\t`an AWS profile, ECS credentials, or an EC2 instance role.`,\n\t\t\"resolution\",\n\t);\n}\n\nfunction readEnvCredentials(): ResolvedCredentials | undefined {\n\tconst ak = $env.AWS_ACCESS_KEY_ID;\n\tconst sk = $env.AWS_SECRET_ACCESS_KEY;\n\tif (!ak || !sk) return undefined;\n\tconst token = $env.AWS_SESSION_TOKEN;\n\treturn token\n\t\t? { accessKeyId: ak, secretAccessKey: sk, sessionToken: token }\n\t\t: { accessKeyId: ak, secretAccessKey: sk };\n}\n\nasync function readIniFile(p: string): Promise<AwsIniFile | undefined> {\n\ttry {","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/ai/src/providers/aws-credentials.ts#L138-L174","documentation":"AIError.AwsCredentialsError (kind 'resolution') thrown by resolveFresh in packages/ai/src/providers/aws-credentials.ts after exhausting the entire credential resolution chain: static env keys, web identity (OIDC/IRSA), AWS profile (shared credentials/config files), ECS container credentials, and finally EC2 IMDSv2 instance role. It means the library could not construct any usable AWS credentials in the current environment.","triggerScenarios":"Calling any AWS-backed model (e.g. Bedrock provider) when: AWS_ACCESS_KEY_ID/SECRET are unset, no AWS_WEB_IDENTITY_TOKEN_FILE, no matching ~/.aws/credentials or ~/.aws/config profile, AWS_CONTAINER_CREDENTIALS_* unset/unreachable, and either AWS_EC2_METADATA_DISABLED=true or the code is not on an EC2 instance (IMDS unreachable), all inside resolveFresh.","commonSituations":"Running locally without ever configuring AWS credentials; CI container with no role and metadata service blocked; ECS/EC2 task where IMDS is disabled or the hop limit blocks IMDSv2 tokens; wrong AWS_PROFILE name pointing at a nonexistent profile; running on-prem where none of the five sources exist.","solutions":["Set static credentials in the environment: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_REGION/AWS_SESSION_TOKEN if applicable","Configure a named profile: run `aws configure` or create ~/.aws/credentials, and set AWS_PROFILE to it","If in ECS/EKS, ensure AWS_CONTAINER_CREDENTIALS_RELATIVE_URI or web identity (IRSA) is set up for the task/service account","If on EC2, ensure the instance has an IAM instance profile attached and AWS_EC2_METADATA_DISABLED is not 'true' (and IMDSv2 hop limit allows containers)","Verify which source you intended to use is actually reachable (e.g. curl the ECS metadata endpoint or IMDS) to find why it was skipped"],"exampleFix":"// before: no credentials in env\nspawnProcess({ env: minimalEnv })\n// after: export credentials before running\nAWS_ACCESS_KEY_ID=AKIA... AWS_SECRET_ACCESS_KEY=... AWS_REGION=us-east-1 omp","handlingStrategy":"validation","validationCode":"function canResolveAwsCredentials(): boolean {\n  const env = process.env;\n  if (env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) return true;\n  if (env.AWS_WEB_IDENTITY_TOKEN_FILE) return true;\n  if (env.AWS_PROFILE || env.AWS_DEFAULT_PROFILE) return true;\n  if (env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || env.AWS_CONTAINER_CREDENTIALS_FULL_URI) return true;\n  if (env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== \"true\") return true; // IMDS may work\n  return false;\n}\nif (!canResolveAwsCredentials()) throw new Error(\"No AWS credential source configured\");","typeGuard":null,"tryCatchPattern":"try {\n  const result = await session.prompt(bedrockModel, messages);\n} catch (err) {\n  if (err instanceof AIError.AwsCredentialsError && err.message.startsWith(\"Unable to resolve AWS credentials\")) {\n    console.error(\"Configure AWS credentials: AWS_ACCESS_KEY_ID/SECRET, AWS_PROFILE, or an instance role.\");\n    process.exitCode = 1;\n    return;\n  }\n  throw err;\n}","preventionTips":["Always set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or AWS_PROFILE before running workloads that use Bedrock","In CI, provision credentials via OIDC/web identity or static secrets in the environment","Do not set AWS_EC2_METADATA_DISABLED=true unless another credential source exists","Verify the intended source works with `aws sts get-caller-identity` before running the app"],"tags":["aws","credentials","configuration","environment","bedrock"],"backgroundTag":"unable-to-resolve-aws-credentials","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}