{"record":{"id":"d524df11f625a571","repo":"BerriAI/litellm","slug":"missing-botocore-to-use-aws-sigv4-authentication","errorCode":null,"errorMessage":"Missing botocore to use AWS SigV4 authentication. Run 'pip install boto3'.","messagePattern":"Missing botocore to use AWS SigV4 authentication\\. Run 'pip install boto3'\\.","errorType":"exception","errorClass":"ImportError","httpStatus":null,"severity":"error","filePath":"litellm/experimental_mcp_client/client.py","lineNumber":122,"sourceCode":"    for every outgoing request, enabling per-request signature computation.\n    \"\"\"\n\n    requires_request_body = True\n\n    def __init__(\n        self,\n        aws_access_key_id: str | None = None,\n        aws_secret_access_key: str | None = None,\n        aws_session_token: str | None = None,\n        aws_region_name: str | None = None,\n        aws_service_name: str | None = None,\n        aws_role_name: str | None = None,\n        aws_session_name: str | None = None,\n    ):\n        try:\n            from botocore.credentials import Credentials\n        except ImportError:\n            raise ImportError(\"Missing botocore to use AWS SigV4 authentication. Run 'pip install boto3'.\")\n        self.service_name = aws_service_name or \"bedrock-agentcore\"\n        self.region_name = aws_region_name or \"us-east-1\"\n        # Note: os.environ/ prefixed values are already resolved by\n        # ProxyConfig._check_for_os_environ_vars() at config load time.\n        # Values arrive here as plain strings.\n        if aws_role_name:\n            self.credentials = self._assume_role(\n                aws_role_name=aws_role_name,\n                aws_session_name=aws_session_name,\n                aws_access_key_id=aws_access_key_id,\n                aws_secret_access_key=aws_secret_access_key,\n                aws_session_token=aws_session_token,\n                aws_region_name=self.region_name,\n            )\n        elif aws_access_key_id and aws_secret_access_key:\n            self.credentials = Credentials(\n                access_key=aws_access_key_id,\n                secret_key=aws_secret_access_key,","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/experimental_mcp_client/client.py#L104-L140","documentation":"The experimental LiteLLM MCP client's AWS SigV4 auth class needs botocore to build SigV4-signed requests (Credentials, STS assume-role). The import is optional: if neither boto3 nor botocore is installed in the environment, __init__ re-raises ImportError with this message before any connection attempt.","triggerScenarios":"Configuring an MCP server entry with aws_sigv4_auth (aws_access_key_id/aws_secret_access_key, or aws_role_name for assume-role) in a venv where 'pip install botocore' or 'pip install boto3' was never run — e.g. a slim Docker image or a fresh proxy deployment that only installed litellm.","commonSituations":"Running litellm proxy in a minimal container (python:slim) with only litellm installed; enabling Bedrock AgentCore MCP tools after an env that predates boto3; CI environments trimmed of AWS SDK packages.","solutions":["pip install boto3 (pulls botocore) in the environment running the litellm proxy / MCP client","Alternatively install just botocore: pip install botocore, if the full boto3 distribution is unwanted","Rebuild your Docker image with the extra dependency and restart the proxy","If AWS SigV4 auth is not actually needed, remove the aws_* fields from the MCP server config so the SigV4 path is never constructed"],"exampleFix":"# before\npip install litellm\n# ... AWS SigV4 MCP auth fails with ImportError\n\n# after\npip install litellm boto3","handlingStrategy":"validation","validationCode":"def has_botocore() -> bool:\n    try:\n        import botocore.credentials  # noqa: F401\n        return True\n    except ImportError:\n        return False\n\nif mcp_auth_uses_sigv4 and not has_botocore():\n    raise RuntimeError(\"pip install boto3 before enabling aws_sigv4_auth\")","typeGuard":null,"tryCatchPattern":"try:\n        from litellm.experimental_mcp_client import MCPClient\n    except ImportError as e:\n        if \"botocore\" in str(e): subprocess.run([sys.executable, '-m', 'pip', 'install', 'boto3'])","preventionTips":["Add boto3 to requirements when any MCP server uses aws_* auth","Dockerfile: pip install litellm boto3 for proxy images using Bedrock MCP"],"tags":["mcp","aws","import-error","dependencies"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}