{"record":{"id":"943474d79593b325","repo":"openai/codex","slug":"aws-sdk-config-did-not-resolve-a-credentials-provi","errorCode":null,"errorMessage":"AWS SDK config did not resolve a credentials provider","messagePattern":"AWS SDK config did not resolve a credentials provider","errorType":"exception","errorClass":"AwsAuthError","httpStatus":null,"severity":"error","filePath":"codex-rs/aws-auth/src/lib.rs","lineNumber":49,"sourceCode":"    pub headers: HeaderMap,\n    pub body: Bytes,\n}\n\n/// Signed request parts returned to the caller.\n#[derive(Debug, Clone, PartialEq, Eq)]\npub struct AwsSignedRequest {\n    pub url: String,\n    pub headers: HeaderMap,\n}\n\n/// Errors returned by credential loading or SigV4 signing.\n#[derive(Debug, Error)]\npub enum AwsAuthError {\n    #[error(\"AWS service name must not be empty\")]\n    EmptyService,\n    #[error(\"AWS profile must be configured\")]\n    MissingProfile,\n    #[error(\"AWS SDK config did not resolve a credentials provider\")]\n    MissingCredentialsProvider,\n    #[error(\"AWS SDK config did not resolve a region\")]\n    MissingRegion,\n    #[error(\"failed to load AWS profiles: {0}\")]\n    ProfileLoad(#[from] aws_config::profile::ProfileFileLoadError),\n    #[error(\"failed to load AWS credentials: {0}\")]\n    Credentials(#[from] aws_credential_types::provider::error::CredentialsError),\n    #[error(\"request URL is not a valid URI: {0}\")]\n    InvalidUri(#[source] http::uri::InvalidUri),\n    #[error(\"failed to construct HTTP request for signing: {0}\")]\n    BuildHttpRequest(#[source] http::Error),\n    #[error(\"request contains a non-UTF8 header value: {0}\")]\n    InvalidHeaderValue(#[source] http::header::ToStrError),\n    #[error(\"failed to build signable request: {0}\")]\n    SigningRequest(#[source] aws_sigv4::http_request::SigningError),\n    #[error(\"failed to build SigV4 signing params: {0}\")]\n    SigningParams(String),\n    #[error(\"SigV4 signing failed: {0}\")]","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/aws-auth/src/lib.rs#L31-L67","documentation":"After the aws_config default chain loads, AwsAuthContext::load requires the resulting SdkConfig to expose a credentials_provider; when credentials_provider() returns None, config.rs maps it to this error. It means the SDK found no credential source at all: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars, no ~/.aws/credentials, no usable named profile, and no container/IMDS endpoint. Non-retryable per is_retryable().","triggerScenarios":"Calling AwsAuthContext::load on a host with no AWS credentials configured anywhere: env vars unset, shared credentials file absent or lacking the named profile, AWS_PROFILE pointing at a profile with no creds, no AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, and IMDS (169.254.169.254) unreachable.","commonSituations":"Fresh dev machine or CI runner that never ran aws configure; minimal container images with no secrets mounted; AWS_PROFILE typo resolving to a nonexistent profile; networks blocking the EC2 metadata endpoint.","solutions":["Configure credentials: run aws configure, or export AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (plus AWS_SESSION_TOKEN for roles)","Verify the profile: aws configure list, and check ~/.aws/credentials contains the profile named in AwsAuthConfig.profile or AWS_PROFILE","On ECS/EC2, ensure the container/IMDS credential endpoints are reachable and instance metadata is enabled","For CI, inject credentials via secrets instead of relying on ambient discovery"],"exampleFix":"# before: nothing configured\n$ codex-aws-call # -> MissingCredentialsProvider\n\n# after\n$ aws configure # writes ~/.aws/credentials\n$ export AWS_PROFILE=default\n$ codex-aws-call","handlingStrategy":"try-catch","validationCode":"fn has_ambient_aws_creds() -> bool {\n    std::env::var_os(\"AWS_ACCESS_KEY_ID\").is_some()\n        || std::env::var_os(\"HOME\")\n            .map(|h| std::path::Path::new(&h).join(\".aws/credentials\").exists())\n            .unwrap_or(false)\n        || std::env::var_os(\"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI\").is_some()\n}","typeGuard":"fn is_missing_credentials_provider(e: &AwsAuthError) -> bool {\n    matches!(e, AwsAuthError::MissingCredentialsProvider)\n}","tryCatchPattern":"match AwsAuthContext::load(config).await {\n    Err(e) if matches!(e, AwsAuthError::MissingCredentialsProvider) => {\n        // no credential source at all: surface setup instructions, do not retry (is_retryable() == false)\n    }\n    Err(AwsAuthError::Credentials(c)) => /* provider exists but failed: transient or expired */ (),\n    other => other?,\n}","preventionTips":["Run aws configure or inject AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY in CI before exercising signing","Distinguish MissingCredentialsProvider (nothing configured) from Credentials (provider failed) - remedies differ","Verify AWS_PROFILE exists in ~/.aws/credentials before relying on it"],"tags":["rust","aws","credentials","authentication"],"backgroundTag":"aws-credentials-not-found","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}