{"record":{"id":"78386a952eea7530","repo":"openai/openai-python","slug":"bedrock-authentication-is-ambiguous-configure-exa-78386a","errorCode":null,"errorMessage":"Bedrock authentication is ambiguous. Configure exactly one explicit AWS mode: static credentials, profile, or credential provider.","messagePattern":"Bedrock authentication is ambiguous\\. Configure exactly one explicit AWS mode: static credentials, profile, or credential provider\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":455,"sourceCode":"    if session_token is not None and not session_token.strip():\n        raise OpenAIError(\"A static AWS `session_token` must not be empty when provided.\")\n\n    explicit_api_key = not isinstance(api_key, NotGiven) and api_key is not None\n    if explicit_api_key and (not isinstance(api_key, str) or not api_key.strip()):\n        raise OpenAIError(\"The Bedrock bearer credential must not be empty.\")\n    if explicit_api_key and token_provider is not None:\n        raise OpenAIError(\"The `api_key` and `token_provider` options are mutually exclusive. Configure only one.\")\n\n    explicit_bearer = explicit_api_key or token_provider is not None\n    aws_modes = sum(\n        (\n            access_key_id is not None,\n            normalized_profile is not None,\n            credential_provider is not None,\n        )\n    )\n    if aws_modes > 1:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit AWS mode: static credentials, \"\n            \"profile, or credential provider.\"\n        )\n    if explicit_bearer and aws_modes:\n        raise OpenAIError(\n            \"Bedrock authentication is ambiguous. Configure exactly one explicit mode: bearer credential, \"\n            \"static AWS credentials, profile, or credential provider.\"\n        )\n\n    skip_environment_bearer = not isinstance(api_key, NotGiven) and api_key is None\n    use_environment_bearer = (\n        not explicit_bearer\n        and not aws_modes\n        and not skip_environment_bearer\n        and bool(os.environ.get(\"AWS_BEARER_TOKEN_BEDROCK\"))\n    )\n\n    if normalized_region is None and (configured_base_url is None or not (explicit_bearer or use_environment_bearer)):","sourceCodeStart":437,"sourceCodeEnd":473,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L437-L473","documentation":"Multiple explicit AWS SigV4 authentication modes were configured at once: static credentials (access_key_id/secret_access_key), a named `profile`, and/or a `credential_provider`. The SDK cannot pick between them, so it raises this OpenAIError asking for exactly one.","triggerScenarios":"bedrock(access_key_id=..., secret_access_key=..., profile='prod') or profile plus credential_provider, or all three.","commonSituations":"A base config sets a profile while deployment code injects static keys (or vice versa); env-var plumbing sets AWS_PROFILE while code also passes explicit keys.","solutions":["Keep exactly one AWS mode: either static keys, profile, or credential_provider","Centralize credential choice in one config layer and remove the duplicates","If keys come from env, pass profile=None explicitly to suppress config-file resolution"],"exampleFix":"# before\nbedrock(access_key_id=ak, secret_access_key=sk, profile='prod')\n# after\nbedrock(access_key_id=ak, secret_access_key=sk)","handlingStrategy":"validation","validationCode":"aws_modes = [bool(access_key_id), bool(profile), credential_provider is not None]\nif sum(aws_modes) > 1:\n    raise ValueError('multiple AWS auth modes configured')","typeGuard":"def single_aws_mode(ak, profile, cp) -> bool:\n    return sum([ak is not None, profile is not None, cp is not None]) <= 1","tryCatchPattern":null,"preventionTips":["Pick one credential strategy per environment","Document which layer owns credential config"],"tags":["bedrock","aws-credentials","ambiguous-auth","validation"],"backgroundTag":"conflicting-auth-options","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}