{"record":{"id":"c12bdb451ef6b9a8","repo":"vercel/ai","slug":"aws-sigv4-authentication-requires-aws-credentials-c12bdb","errorCode":null,"errorMessage":"AWS SigV4 authentication requires AWS credentials. Please provide either:\n1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n2. Provide accessKeyId and secretAccessKey in options\n3. Use a credentialProvider function\n4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\nOriginal error: ${errorMessage}","messagePattern":"AWS SigV4 authentication requires AWS credentials\\. Please provide either:\n1\\. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n2\\. Provide accessKeyId and secretAccessKey in options\n3\\. Use a credentialProvider function\n4\\. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\nOriginal error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/amazon-bedrock/src/mantle/bedrock-mantle-provider.ts","lineNumber":192,"sourceCode":"              secretAccessKey: loadSetting({\n                settingValue: options.secretAccessKey,\n                settingName: 'secretAccessKey',\n                environmentVariableName: 'AWS_SECRET_ACCESS_KEY',\n                description: 'AWS secret access key',\n              }),\n              sessionToken: loadOptionalSetting({\n                settingValue: options.sessionToken,\n                environmentVariableName: 'AWS_SESSION_TOKEN',\n              }),\n            };\n          } catch (error) {\n            const errorMessage =\n              error instanceof Error ? error.message : String(error);\n            if (\n              errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n              errorMessage.includes('accessKeyId')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                  '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                  '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                  '3. Use a credentialProvider function\\n' +\n                  '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }\n            if (\n              errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n              errorMessage.includes('secretAccessKey')\n            ) {\n              throw new Error(\n                'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                  'Please ensure both credentials are provided.\\n' +\n                  `Original error: ${errorMessage}`,\n              );\n            }","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/amazon-bedrock/src/mantle/bedrock-mantle-provider.ts#L174-L210","documentation":"When SigV4 signing fails because the error message references AWS_ACCESS_KEY_ID or accessKeyId, createBedrockMantle rethrows a guided Error listing all four supported authentication mechanisms (env vars, explicit options, credentialProvider, or bearer-token API key). It exists to convert cryptic SDK credential errors into actionable setup instructions.","triggerScenarios":"Calling bedrockMantle(...).create... without any AWS credentials configured: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars, no accessKeyId/secretAccessKey options, no credentialProvider, and no AWS_BEARER_TOKEN_BEDROCK/apiKey.","commonSituations":"Deploying to containers/serverless without the AWS credential chain populated; running locally without ~/.aws/credentials or env vars; CI jobs missing secrets.","solutions":["Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (plus AWS_REGION) in the environment.","Pass accessKeyId/secretAccessKey explicitly in createBedrockMantle options for local dev.","Supply a credentialProvider function (e.g. from @aws-sdk/credential-providers, like fromNodeProviderChain).","Alternatively authenticate with AWS_BEARER_TOKEN_BEDROCK env var or the apiKey option.","If credentials exist, verify the region is set — a missing region can also break credential resolution."],"exampleFix":"// before\nconst mantle = createBedrockMantle({});\n// after\nconst mantle = createBedrockMantle({\n  region: 'us-east-1',\n  accessKeyId: process.env.AWS_ACCESS_KEY_ID,\n  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,\n});","handlingStrategy":"validation","validationCode":"function assertAwsAuthConfigured() {\n  const hasEnv = !!process.env.AWS_ACCESS_KEY_ID && !!process.env.AWS_SECRET_ACCESS_KEY;\n  const hasBearer = !!process.env.AWS_BEARER_TOKEN_BEDROCK;\n  if (!hasEnv && !hasBearer) {\n    throw new Error('Configure AWS credentials (env, options, credentialProvider) or a Bedrock bearer token before calling.');\n  }\n}","typeGuard":"function hasAwsCredentials(opts) {\n  return Boolean((opts.accessKeyId && opts.secretAccessKey) || opts.credentialProvider || process.env.AWS_ACCESS_KEY_ID || process.env.AWS_BEARER_TOKEN_BEDROCK);\n}","tryCatchPattern":"try {\n  return await generateText({ model: mantle(modelId), prompt });\n} catch (error) {\n  if (error instanceof Error && error.message.includes('AWS SigV4 authentication requires AWS credentials')) {\n    console.error('No AWS credentials found. Set env vars, pass options, or use a credentialProvider.');\n  }\n  throw error;\n}","preventionTips":["Fail fast at app startup when no AWS auth mechanism is configured.","Set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_REGION in every environment (local, CI, deploy).","Use a credentialProvider (fromNodeProviderChain) so all standard AWS sources are checked.","Never rely on implicit defaults in ephemeral/container environments."],"tags":["aws","sigv4","credentials","authentication","env-var","bedrock"],"backgroundTag":"aws-credentials-not-found","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}