{"record":{"id":"61eab73d8ac52f21","repo":"alibaba/open-code-review","slug":"bedrock-could-not-load-aws-configuration-w-be","errorCode":null,"errorMessage":"bedrock: could not load AWS configuration: %w\n  bedrock uses the standard AWS credential chain — set AWS_PROFILE, or run `aws sso login%s`","messagePattern":"bedrock: could not load AWS configuration: %w\n  bedrock uses the standard AWS credential chain — set AWS_PROFILE, or run `aws sso login(.+?)`","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/llm/client.go","lineNumber":1006,"sourceCode":"\n\t// Load the AWS config here rather than calling bedrock.WithLoadDefaultConfig,\n\t// which panics on failure.\n\tvar loadOpts []func(*awsconfig.LoadOptions) error\n\tif cfg.AWSProfile != \"\" {\n\t\tloadOpts = append(loadOpts, awsconfig.WithSharedConfigProfile(cfg.AWSProfile))\n\t}\n\tif cfg.AWSRegion != \"\" {\n\t\tloadOpts = append(loadOpts, awsconfig.WithRegion(cfg.AWSRegion))\n\t}\n\tloadCtx, cancel := context.WithTimeout(context.Background(), bedrockConfigLoadTimeout)\n\tdefer cancel()\n\tawsCfg, err := awsconfig.LoadDefaultConfig(loadCtx, loadOpts...)\n\tif err != nil {\n\t\treturn &AnthropicClient{\n\t\t\tcfg:        cfg,\n\t\t\tbedrock:    true,\n\t\t\tawsProfile: cfg.AWSProfile,\n\t\t\tinitErr: fmt.Errorf(\"bedrock: could not load AWS configuration: %w\\n\"+\n\t\t\t\t\"  bedrock uses the standard AWS credential chain — set AWS_PROFILE, or run `aws sso login%s`\", err, ssoLoginProfileArg(cfg.AWSProfile)),\n\t\t}\n\t}\n\tif awsCfg.Region == \"\" {\n\t\treturn &AnthropicClient{\n\t\t\tcfg:        cfg,\n\t\t\tbedrock:    true,\n\t\t\tawsProfile: cfg.AWSProfile,\n\t\t\tinitErr: fmt.Errorf(\"bedrock: no AWS region resolved\\n\" +\n\t\t\t\t\"  set AWS_REGION, or give the active profile a region — the region decides which bedrock-runtime host is used\"),\n\t\t}\n\t}\n\n\t// Drop the credential-chain bearer token, always.\n\t//\n\t// bedrock.WithConfig prefers bearer auth over SigV4 whenever\n\t// cfg.BearerAuthTokenProvider is non-nil, and LoadDefaultConfig populates\n\t// that provider from the SSO token cache — the OIDC access token, which is","sourceCodeStart":988,"sourceCodeEnd":1024,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/internal/llm/client.go#L988-L1024","documentation":"When creating a Bedrock-backed AnthropicClient (internal/llm/client.go:1006), the AWS SDK's config.LoadDefaultConfig fails to assemble a credential chain / config. The client is still returned but with initErr set, so the first API call surfaces this error explaining that Bedrock uses the standard AWS credential chain. It is thrown because the SDK found no usable credentials, profile, or config source.","triggerScenarios":"Constructing a client with ProtocolAnthropicBedrock when: no credentials exist anywhere in the chain (env vars, shared credentials/config files, IMDS, SSO), an AWS_PROFILE names a profile that does not exist, or the config file itself is malformed so LoadDefaultConfig errors.","commonSituations":"Fresh container/CI machine with no AWS setup; SSO session expired and never re-logged-in; typo'd AWS_PROFILE; running locally without ~/.aws/credentials; assume-role source profile missing.","solutions":["Run `aws sso login` (add `--profile <name>` if cfg.AWSProfile is set) to refresh SSO credentials","Export static credentials: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, optionally AWS_SESSION_TOKEN","Verify AWS_PROFILE matches a section in ~/.aws/config or ~/.aws/credentials","Check AWS_SHARED_CREDENTIALS_FILE / AWS_CONFIG_FILE point at real files and are parseable"],"exampleFix":"// before\nexport AWS_PROFILE=nope-profile\nocr review ...\n// after\nexport AWS_PROFILE=work\naws sso login --profile work\nocr review ...","handlingStrategy":"validation","validationCode":"if _, err := exec.LookPath(\"aws\"); err == nil {\n    out, err := exec.Command(\"aws\", \"sts\", \"get-caller-identity\").CombinedOutput()\n    if err != nil {\n        return fmt.Errorf(\"AWS credentials not resolvable (run `aws sso login`): %v: %s\", err, out)\n    }\n}","typeGuard":null,"tryCatchPattern":"cl := NewAnthropicBedrockClient(cfg)\nif _, _, err := cl.Call(ctx, messages); err != nil {\n    if strings.Contains(err.Error(), \"could not load AWS configuration\") {\n        return fmt.Errorf(\"fix AWS credentials first: %w\", err)\n    }\n    return err\n}","preventionTips":["Run `aws sso login` at the start of a work session and in CI setup steps","Verify with `aws sts get-caller-identity` before long-running jobs","Double-check AWS_PROFILE spelling against ~/.aws/config sections","Keep ~/.aws/credentials and ~/.aws/config present and well-formed in containers"],"tags":["aws","bedrock","credentials","configuration"],"backgroundTag":"aws-credentials-not-found","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}