{"record":{"id":"b394d64d1f935685","repo":"BerriAI/litellm","slug":"bedrockexception-invalid-authentication-error-s","errorCode":null,"errorMessage":"BedrockException Invalid Authentication - {error_str}","messagePattern":"BedrockException Invalid Authentication - (.+?)","errorType":"exception","errorClass":"AuthenticationError","httpStatus":401,"severity":"critical","filePath":"litellm/litellm_core_utils/exception_mapping_utils.py","lineNumber":862,"sourceCode":"    elif \"Malformed input request\" in error_str:\n        raise BadRequestError(\n            message=f\"BedrockException - {error_str}\",\n            model=model,\n            llm_provider=\"bedrock\",\n            response=getattr(original_exception, \"response\", None),\n        )\n    elif \"A conversation must start with a user message.\" in error_str:\n        raise BadRequestError(\n            message=f\"BedrockException - {error_str}\\n. Pass in default user message via `completion(..,user_continue_message=)` or enable `litellm.modify_params=True`.\\nFor Proxy: do via `litellm_settings::modify_params: True` or user_continue_message under `litellm_params`\",\n            model=model,\n            llm_provider=\"bedrock\",\n            response=getattr(original_exception, \"response\", None),\n        )\n    elif (\n        \"Unable to locate credentials\" in error_str\n        or \"The security token included in the request is invalid\" in error_str\n    ):\n        raise AuthenticationError(\n            message=f\"BedrockException Invalid Authentication - {error_str}\",\n            model=model,\n            llm_provider=\"bedrock\",\n            response=getattr(original_exception, \"response\", None),\n        )\n    elif \"AccessDeniedException\" in error_str:\n        raise PermissionDeniedError(\n            message=f\"BedrockException PermissionDeniedError - {error_str}\",\n            model=model,\n            llm_provider=\"bedrock\",\n            response=getattr(original_exception, \"response\", None),\n        )\n    elif \"throttlingException\" in error_str or \"ThrottlingException\" in error_str:\n        raise RateLimitError(\n            message=f\"BedrockException: Rate Limit Error - {error_str}\",\n            model=model,\n            llm_provider=\"bedrock\",\n            response=getattr(original_exception, \"response\", None),","sourceCodeStart":844,"sourceCodeEnd":880,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/litellm_core_utils/exception_mapping_utils.py#L844-L880","documentation":"Bedrock-specific: AuthenticationError raised when the AWS error text contains 'Unable to locate credentials' or 'The security token included in the request is invalid'. LiteLLM failed at the AWS layer — either no credentials were discoverable at all, or the discovered credentials (access key / session token) were rejected.","triggerScenarios":"No AWS_* environment variables, no ~/.aws/credentials, and no instance/task role available (local laptop without aws login); or stale/expired AWS_SESSION_TOKEN / AWS_SECRET_ACCESS_KEY after key rotation or MFA session expiry.","commonSituations":"Running locally without 'aws sso login' / 'aws configure', expired SSO sessions, CI runners missing credential env vars, containers without the task role, or clock skew invalidating SigV4 signatures.","solutions":["Provide credentials: run 'aws configure'/'aws sso login', export AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY(/AWS_SESSION_TOKEN), or attach an IAM role to the compute.","If using a session, refresh it — expired AWS_SESSION_TOKEN is a common cause.","Verify with a quick boto3 call (sts.get_caller_identity) before running litellm.","Check system clock (SigV4 is time-sensitive) and AWS_REGION is set."],"exampleFix":"# before\nresp = litellm.completion(model=\"bedrock/anthropic.claude-3-5-sonnet-20240620-v1:0\", messages=msgs)  # no creds in env\n\n# after\nimport boto3\nboto3.client(\"sts\").get_caller_identity()  # fail fast if credentials are missing/invalid\nresp = litellm.completion(model=\"bedrock/anthropic.claude-3-5-sonnet-20240620-v1:0\", messages=msgs)","handlingStrategy":"validation","validationCode":"import boto3\n\ndef aws_credentials_available() -> bool:\n    try:\n        boto3.client(\"sts\").get_caller_identity()\n        return True\n    except Exception:\n        return False","typeGuard":"import litellm\n\ndef is_bedrock_auth_error(e: BaseException) -> bool:\n    return isinstance(e, litellm.AuthenticationError) and getattr(e, \"llm_provider\", \"\") == \"bedrock\"","tryCatchPattern":"try:\n    resp = litellm.completion(model=\"bedrock/...\", messages=msgs)\nexcept litellm.AuthenticationError as e:\n    raise RuntimeError(\"AWS credentials missing/invalid — run aws sso login / configure, or attach a role\") from e","preventionTips":["Call sts.get_caller_identity() at startup to fail fast on missing/expired credentials.","In containers/lambda, prefer IAM task/execution roles over static keys.","Refresh SSO sessions and session tokens on a schedule; do not retry auth errors."],"tags":["bedrock","aws","credentials","authentication","litellm"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}