{"record":{"id":"7fddb8c18da540aa","repo":"BerriAI/litellm","slug":"litellm-badrequesterror-sagemakerexception-err","errorCode":null,"errorMessage":"litellm.BadRequestError: SagemakerException - {error_str}","messagePattern":"litellm\\.BadRequestError: SagemakerException - (.+?)","errorType":"exception","errorClass":"BadRequestError","httpStatus":400,"severity":"critical","filePath":"litellm/litellm_core_utils/exception_mapping_utils.py","lineNumber":978,"sourceCode":"                model=model,\n                llm_provider=custom_llm_provider,\n                litellm_debug_info=extra_information,\n                exception_status_code=original_exception.status_code,\n            )\n\n\ndef _map_sagemaker_exception(\n    *,\n    model: str,\n    original_exception: _ProviderHTTPException,\n    custom_llm_provider: str,\n    error_str: str,\n    exception_type: str,\n    exception_provider: str,\n    extra_information: str,\n) -> None:\n    if \"Unable to locate credentials\" in error_str:\n        raise BadRequestError(\n            message=f\"litellm.BadRequestError: SagemakerException - {error_str}\",\n            model=model,\n            llm_provider=\"sagemaker\",\n            response=getattr(original_exception, \"response\", None),\n        )\n    elif \"Input validation error: `best_of` must be > 0 and <= 2\" in error_str:\n        raise BadRequestError(\n            message=\"SagemakerException - the value of 'n' must be > 0 and <= 2 for sagemaker endpoints\",\n            model=model,\n            llm_provider=\"sagemaker\",\n            response=getattr(original_exception, \"response\", None),\n        )\n    elif (\n        \"`inputs` tokens + `max_new_tokens` must be <=\" in error_str\n        or \"instance type with more CPU capacity or memory\" in error_str\n    ):\n        raise ContextWindowExceededError(\n            message=f\"SagemakerException - {error_str}\",","sourceCodeStart":960,"sourceCodeEnd":996,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/litellm_core_utils/exception_mapping_utils.py#L960-L996","documentation":"In _map_sagemaker_exception, litellm checks the SageMaker error string for 'Unable to locate credentials' and raises litellm.BadRequestError with 'litellm.BadRequestError: SagemakerException - <error>'. This is botocore's NoCredentialsError text: no AWS credentials could be resolved at all for the SageMaker endpoint call. litellm surfaces it as a 400-class error on the sagemaker provider.","triggerScenarios":"Calling a 'sagemaker/' model (HuggingFace/Sagemaker endpoints) with no resolvable AWS credential chain: no env vars, no ~/.aws/credentials, no role on the host, and no aws_access_key_id passed to the call. The string match happens before any status_code branch, so it fires even when the exception lacks a status code.","commonSituations":"Local scripts run without AWS_PROFILE set up; Docker containers missing the credentials mount; schedulers (Airflow/cron) with stripped environments; EC2 tasks without an instance role attached.","solutions":["Export credentials or a profile: AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_SESSION_TOKEN, or AWS_PROFILE=<name>","Pass keys explicitly: litellm.completion(..., aws_access_key_id=..., aws_secret_access_key=..., aws_region_name=...)","On EC2/ECS/EKS, attach an execution/instance role that can invoke the SageMaker runtime","Sanity-check the chain with aws sts get-caller-identity in the same shell/env the app runs in"],"exampleFix":"# before\nresp = litellm.completion(model=\"sagemaker/my-hf-endpoint\", messages=msgs)\n\n# after\nresp = litellm.completion(\n  model=\"sagemaker/my-hf-endpoint\",\n  messages=msgs,\n  aws_access_key_id=os.environ[\"AWS_ACCESS_KEY_ID\"],\n  aws_secret_access_key=os.environ[\"AWS_SECRET_ACCESS_KEY\"],\n  aws_region_name=\"us-east-1\",\n)","handlingStrategy":"validation","validationCode":"import os, boto3\n\ndef sagemaker_creds_resolvable() -> bool:\n    try:\n        boto3.client(\"sts\").get_caller_identity()\n        return True\n    except Exception:\n        return False\n\nif not sagemaker_creds_resolvable():\n    raise RuntimeError(\"configure AWS credentials before calling sagemaker/\")","typeGuard":"import litellm\n\ndef is_missing_credentials(e: Exception) -> bool:\n    return isinstance(e, litellm.BadRequestError) and \"Unable to locate credentials\" in str(e)","tryCatchPattern":"import litellm\ntry:\n    resp = litellm.completion(model=\"sagemaker/ep\", messages=msgs)\nexcept litellm.BadRequestError as e:\n    if \"Unable to locate credentials\" in str(e):\n        raise RuntimeError(\"no AWS credential chain for sagemaker runtime\") from e\n    raise","preventionTips":["Fail fast at startup on missing credentials rather than per-request","Inject credentials explicitly in containers/schedulers instead of relying on ambient env","Attach instance/task roles on EC2/ECS/EKS so no keys are needed at all"],"tags":["sagemaker","aws","credentials","bad-request","authentication"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}