{"record":{"id":"96bdc4f63e7ff263","repo":"remotion-dev/remotion","slug":"secret-key-must-be-provided-when-access-key-is","errorCode":null,"errorMessage":"'secret_key' must be provided when 'access_key' is specified","messagePattern":"'secret_key' must be provided when 'access_key' is specified","errorType":"validation","errorClass":"RemotionInvalidArgumentException","httpStatus":null,"severity":"error","filePath":"packages/lambda-python/remotion_lambda/remotionclient.py","lineNumber":192,"sourceCode":"        # Check for conflicting authentication methods\n        if session and (access_key or secret_key):\n            raise RemotionInvalidArgumentException(\n                \"Cannot specify both 'session' and explicit credentials \"\n                \"('access_key'/'secret_key'). Please use only 'session'.\"\n            )\n\n        # Handle deprecated credential parameters\n        if access_key is not None or secret_key is not None:\n            warnings.warn(\n                \"Parameters 'access_key' and 'secret_key' are deprecated \"\n                \"as of version 4.0.376 and will be removed in version 5.0.0. \"\n                \"Please migrate to using 'session' for improved security. \",\n                DeprecationWarning,\n                stacklevel=2,\n            )\n            # Validate both keys are provided together\n            if access_key and not secret_key:\n                raise RemotionInvalidArgumentException(\"'secret_key' must be provided when 'access_key' is specified\")\n            if secret_key and not access_key:\n                raise RemotionInvalidArgumentException(\"'access_key' must be provided when 'secret_key' is specified\")\n\n            # Create session from deprecated credentials\n            self.session = Session(\n                aws_access_key_id=access_key,\n                aws_secret_access_key=secret_key,\n                region_name=region,\n            )\n        elif session:\n            # Use provided session\n            self.session = session\n        else:\n            # Create default session (uses credential chain)\n            self.session = Session(region_name=region)\n\n        # Store configuration\n        self.region = region.strip()","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda-python/remotion_lambda/remotionclient.py#L174-L210","documentation":"Raised (with a deprecation warning) when the caller provides access_key but no secret_key to the Python RemotionClient. AWS access keys are always paired with secret keys, so passing only one is treated as a configuration mistake rather than forwarded to boto3.","triggerScenarios":"Calling RemotionClient(access_key='AKIA...', secret_key=None) or omitting secret_key while setting access_key. The check is `if access_key and not secret_key`.","commonSituations":"Reading AWS_ACCESS_KEY_ID from env but the AWS_SECRET_ACCESS_KEY variable is unset; copy-pasting only one half of a credential pair; secret_key mistakenly passed as a different kwarg name; using a profile via session while also leaking a stale access_key.","solutions":["Provide BOTH access_key and secret_key together, or migrate to the session= argument (preferred).","Verify env vars are set: assert os.environ.get('AWS_SECRET_ACCESS_KEY'), 'missing secret'.","Use a boto3 Session from an AWS profile to avoid handling raw credentials at all."],"exampleFix":"// before\nclient = RemotionClient(\n    region=region,\n    serve_url=serve_url,\n    function_name=fn,\n    access_key=os.environ['AWS_ACCESS_KEY_ID'],\n)\n\n# after - preferred\nsession = boto3.Session(profile_name='remotion')\nclient = RemotionClient(\n    region=region,\n    serve_url=serve_url,\n    function_name=fn,\n    session=session,\n)","handlingStrategy":"validation","validationCode":"def validate_paired_credentials(access_key, secret_key):\n    if access_key and not secret_key:\n        raise ValueError('access_key provided without secret_key')\n    return True","typeGuard":"def credentials_are_paired(access_key, secret_key) -> bool:\\n    return bool(access_key) == bool(secret_key)","tryCatchPattern":"try:\\n    client = RemotionClient(region=region, serve_url=serve_url, function_name=fn,\\n                           access_key=ak, secret_key=sk)\\nexcept RemotionInvalidArgumentException as e:\\n    raise SystemExit(f'Credentials incomplete: {e}')","preventionTips":["Always pass access_key and secret_key together or neither.","Prefer boto3.Session from an AWS profile over raw credentials.","Assert both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars are set before launch."],"tags":["python","validation","authentication","aws-credentials","deprecated"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}