{"record":{"id":"bae2d65aa01f6712","repo":"BerriAI/litellm","slug":"aws-region-name-is-required-in-the-wif-credential","errorCode":null,"errorMessage":"aws_region_name is required in the WIF credential JSON when using explicit AWS authentication. Add \"aws_region_name\": \"<your-region>\" to your credential file.","messagePattern":"aws_region_name is required in the WIF credential JSON when using explicit AWS authentication\\. Add \"aws_region_name\": \"<your-region>\" to your credential file\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/llms/vertex_ai/vertex_ai_aws_wif.py","lineNumber":81,"sourceCode":"            aws_params: Dict of aws_* params extracted from json_obj\n            scopes: OAuth scopes for the GCP credentials\n        \"\"\"\n        try:\n            from google.auth import aws\n        except ImportError:\n            raise ImportError(GOOGLE_IMPORT_ERROR_MESSAGE)\n\n        from litellm.llms.bedrock.base_aws_llm import BaseAWSLLM\n        from litellm.llms.vertex_ai.aws_credentials_supplier import (\n            AwsCredentialsSupplier,\n        )\n\n        # Validate region first — required for the GCP token exchange.\n        # Check before get_credentials() to avoid unnecessary AWS API calls\n        # (e.g. STS AssumeRole) on misconfiguration.\n        aws_region: Final = aws_params.get(\"aws_region_name\")\n        if not aws_region:\n            raise ValueError(\n                \"aws_region_name is required in the WIF credential JSON \"\n                \"when using explicit AWS authentication. Add \"\n                '\"aws_region_name\": \"<your-region>\" to your credential file.'\n            )\n\n        # Build a credentials provider that re-resolves AWS creds on each call.\n        # This ensures rotated/refreshed STS tokens are picked up during\n        # long-running processes when google-auth refreshes the GCP token.\n        base_aws: Final = BaseAWSLLM()\n        aws_params_copy: Final = dict(aws_params)  # avoid mutating caller's dict\n\n        def _get_aws_credentials():\n            return base_aws.get_credentials(**aws_params_copy)\n\n        # Create the custom supplier with a lazy credentials provider\n        supplier: Final = AwsCredentialsSupplier(\n            credentials_provider=_get_aws_credentials,\n            aws_region=aws_region,","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/llms/vertex_ai/vertex_ai_aws_wif.py#L63-L99","documentation":"Validation failure in credentials_from_explicit_aws: the WIF credential JSON contains aws_* parameters but no aws_region_name, which is required for the GCP STS token exchange. It is checked before get_credentials() to avoid a pointless AWS API call.","triggerScenarios":"Thrown at litellm/llms/vertex_ai/vertex_ai_aws_wif.py:81 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add \"aws_region_name\": \"<your-region>\" to the WIF credential JSON file used for AWS authentication.","Alternatively use ambient AWS credentials (env vars / instance metadata) so the region is resolved automatically."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}