{"record":{"id":"a257c048ed554309","repo":"remotion-dev/remotion","slug":"access-key-must-be-provided-when-secret-key-is","errorCode":null,"errorMessage":"'access_key' must be provided when 'secret_key' is specified","messagePattern":"'access_key' must be provided when 'secret_key' is specified","errorType":"validation","errorClass":"RemotionInvalidArgumentException","httpStatus":null,"severity":"error","filePath":"packages/lambda-python/remotion_lambda/remotionclient.py","lineNumber":194,"sourceCode":"            raise RemotionInvalidArgumentException(\n                \"Cannot specify both 'session' and explicit credentials \"\n                \"('access_key'/'secret_key'). Please use only 'session'.\"\n            )\n\n        # Handle deprecated credential parameters\n        if access_key is not None or secret_key is not None:\n            warnings.warn(\n                \"Parameters 'access_key' and 'secret_key' are deprecated \"\n                \"as of version 4.0.376 and will be removed in version 5.0.0. \"\n                \"Please migrate to using 'session' for improved security. \",\n                DeprecationWarning,\n                stacklevel=2,\n            )\n            # Validate both keys are provided together\n            if access_key and not secret_key:\n                raise RemotionInvalidArgumentException(\"'secret_key' must be provided when 'access_key' is specified\")\n            if secret_key and not access_key:\n                raise RemotionInvalidArgumentException(\"'access_key' must be provided when 'secret_key' is specified\")\n\n            # Create session from deprecated credentials\n            self.session = Session(\n                aws_access_key_id=access_key,\n                aws_secret_access_key=secret_key,\n                region_name=region,\n            )\n        elif session:\n            # Use provided session\n            self.session = session\n        else:\n            # Create default session (uses credential chain)\n            self.session = Session(region_name=region)\n\n        # Store configuration\n        self.region = region.strip()\n        self.serve_url = serve_url.strip().rstrip('/')\n        self.function_name = function_name.strip()","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda-python/remotion_lambda/remotionclient.py#L176-L212","documentation":"Raised (with a deprecation warning) when the caller provides secret_key but no access_key to the Python RemotionClient. Mirror of the access_key-without-secret_key guard, fired by `if secret_key and not access_key`.","triggerScenarios":"Calling RemotionClient(secret_key='...', access_key=None); passing only the secret half of the credential pair.","commonSituations":"Env var AWS_ACCESS_KEY_ID unset while AWS_SECRET_ACCESS_KEY is set; only the secret was copied from the AWS console; using a partial credential export script.","solutions":["Provide BOTH access_key and secret_key, or migrate to a boto3 Session (preferred).","Confirm both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are present in the environment before launch.","Use `aws configure list` to verify the active profile has both credentials."],"exampleFix":"// before\nclient = RemotionClient(\n    region=region,\n    serve_url=serve_url,\n    function_name=fn,\n    secret_key=os.environ['AWS_SECRET_ACCESS_KEY'],\n)\n\n# after\nsession = boto3.Session(profile_name='remotion')\nclient = RemotionClient(\n    region=region,\n    serve_url=serve_url,\n    function_name=fn,\n    session=session,\n)","handlingStrategy":"validation","validationCode":"def validate_paired_credentials(access_key, secret_key):\n    if secret_key and not access_key:\n        raise ValueError('secret_key provided without access_key')\n    return True","typeGuard":"def credentials_are_paired(access_key, secret_key) -> bool:\\n    return bool(access_key) == bool(secret_key)","tryCatchPattern":"try:\\n    client = RemotionClient(region=region, serve_url=serve_url, function_name=fn,\\n                           access_key=ak, secret_key=sk)\\nexcept RemotionInvalidArgumentException as e:\\n    raise SystemExit(f'Credentials incomplete: {e}')","preventionTips":["Always pass access_key and secret_key together or neither.","Prefer boto3.Session from an AWS profile over raw credentials.","Verify with `aws configure list` that the profile has both credentials."],"tags":["python","validation","authentication","aws-credentials","deprecated"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}