{"record":{"id":"ab7d7093dc47a424","repo":"alibaba/open-code-review","slug":"bedrock-no-aws-region-resolved-set-aws-region","errorCode":null,"errorMessage":"bedrock: no AWS region resolved\n  set AWS_REGION, or give the active profile a region — the region decides which bedrock-runtime host is used","messagePattern":"bedrock: no AWS region resolved\n  set AWS_REGION, or give the active profile a region — the region decides which bedrock-runtime host is used","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/llm/client.go","lineNumber":1015,"sourceCode":"\t}\n\tloadCtx, cancel := context.WithTimeout(context.Background(), bedrockConfigLoadTimeout)\n\tdefer cancel()\n\tawsCfg, err := awsconfig.LoadDefaultConfig(loadCtx, loadOpts...)\n\tif err != nil {\n\t\treturn &AnthropicClient{\n\t\t\tcfg:        cfg,\n\t\t\tbedrock:    true,\n\t\t\tawsProfile: cfg.AWSProfile,\n\t\t\tinitErr: fmt.Errorf(\"bedrock: could not load AWS configuration: %w\\n\"+\n\t\t\t\t\"  bedrock uses the standard AWS credential chain — set AWS_PROFILE, or run `aws sso login%s`\", err, ssoLoginProfileArg(cfg.AWSProfile)),\n\t\t}\n\t}\n\tif awsCfg.Region == \"\" {\n\t\treturn &AnthropicClient{\n\t\t\tcfg:        cfg,\n\t\t\tbedrock:    true,\n\t\t\tawsProfile: cfg.AWSProfile,\n\t\t\tinitErr: fmt.Errorf(\"bedrock: no AWS region resolved\\n\" +\n\t\t\t\t\"  set AWS_REGION, or give the active profile a region — the region decides which bedrock-runtime host is used\"),\n\t\t}\n\t}\n\n\t// Drop the credential-chain bearer token, always.\n\t//\n\t// bedrock.WithConfig prefers bearer auth over SigV4 whenever\n\t// cfg.BearerAuthTokenProvider is non-nil, and LoadDefaultConfig populates\n\t// that provider from the SSO token cache — the OIDC access token, which is\n\t// for identity services, not Bedrock. So an SSO-authenticated caller\n\t// (i.e. most enterprise setups) silently sends `Authorization: Bearer\n\t// <sso-token>` and Bedrock answers 403 \"Invalid API Key format: Must start\n\t// with pre-defined prefix\".\n\t//\n\t// Clearing it unconditionally is what gives AWS_BEARER_TOKEN_BEDROCK the\n\t// precedence its documentation describes. WithConfig's doc comment says the\n\t// variable wins, but the code only consults it when the provider is nil\n\t// (bedrock.go: `if cfg.BearerAuthTokenProvider == nil`), so leaving an","sourceCodeStart":997,"sourceCodeEnd":1033,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/internal/llm/client.go#L997-L1033","documentation":"After LoadDefaultConfig succeeds, NewAnthropicBedrockClient (internal/llm/client.go:1015) checks awsCfg.Region. Bedrock requests are signed for a regional bedrock-runtime endpoint, so with no region the client cannot build a host; it returns a client with initErr explaining that the region decides which bedrock-runtime host is used. Unlike credential failure this is purely a region-resolution gap — credentials were fine.","triggerScenarios":"Creating the Bedrock client when neither AWS_REGION/AWS_DEFAULT_REGION, the active profile's region key, nor any other chain source yields a region — e.g. a credentials-only profile or a bare environment with static keys.","commonSituations":"Profile in ~/.aws/credentials (which cannot hold a region) with no AWS_REGION exported; CI job exporting only access keys; Docker image where AWS_REGION was not passed through; user set a region only in a different profile than the active one.","solutions":["Export AWS_REGION=us-east-1 (or your Bedrock region) in the environment","Add `region = us-east-1` under the active profile in ~/.aws/config (not the credentials file)","Pass the region explicitly in the tool's config (cfg.AWSRegion) so it feeds LoadDefaultConfig opts","Fix CI/container env so AWS_REGION is forwarded into the job/image"],"exampleFix":"// before\n[profile work]\nsso_start_url = https://d-xxx.awsapps.com/start\n# no region key\n// after\n[profile work]\nsso_start_url = https://d-xxx.awsapps.com/start\nregion = us-east-1","handlingStrategy":"validation","validationCode":"region := os.Getenv(\"AWS_REGION\")\nif region == \"\" {\n    if v := os.Getenv(\"AWS_DEFAULT_REGION\"); v != \"\" {\n        region = v\n    } else {\n        return errors.New(\"set AWS_REGION before using the bedrock provider\")\n    }\n}","typeGuard":null,"tryCatchPattern":"_, err := cl.Call(ctx, messages)\nif err != nil && strings.Contains(err.Error(), \"no AWS region resolved\") {\n    return fmt.Errorf(\"export AWS_REGION (e.g. us-east-1) and retry: %w\", err)\n}","preventionTips":["Always export AWS_REGION (not just AWS_DEFAULT_REGION) in shells and CI","Put `region =` under the profile in ~/.aws/config, never only in ~/.aws/credentials","Pass region explicitly in the tool config for the bedrock provider","Verify with `aws configure get region` in the exact environment that runs the job"],"tags":["aws","bedrock","region","configuration"],"backgroundTag":"missing-aws-region","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}