{"record":{"id":"da152615cc5895c2","repo":"vercel/ai","slug":"aws-sigv4-authentication-requires-aws-credentials-da1526","errorCode":null,"errorMessage":"AWS SigV4 authentication requires AWS credentials. Please provide either:\n1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n2. Provide accessKeyId and secretAccessKey in options\n3. Use a credentialProvider function\n4. Use API key authentication with ANTHROPIC_AWS_API_KEY or apiKey option\nOriginal error: ${errorMessage}","messagePattern":"AWS SigV4 authentication requires AWS credentials\\. Please provide either:\n1\\. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\n2\\. Provide accessKeyId and secretAccessKey in options\n3\\. Use a credentialProvider function\n4\\. Use API key authentication with ANTHROPIC_AWS_API_KEY or apiKey option\nOriginal error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/anthropic-aws/src/anthropic-aws-provider.ts","lineNumber":187,"sourceCode":"            secretAccessKey: loadSetting({\n              settingValue: options.secretAccessKey,\n              settingName: 'secretAccessKey',\n              environmentVariableName: 'AWS_SECRET_ACCESS_KEY',\n              description: 'AWS secret access key',\n            }),\n            sessionToken: loadOptionalSetting({\n              settingValue: options.sessionToken,\n              environmentVariableName: 'AWS_SESSION_TOKEN',\n            }),\n          };\n        } catch (error) {\n          const errorMessage =\n            error instanceof Error ? error.message : String(error);\n          if (\n            errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n            errorMessage.includes('accessKeyId')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                '3. Use a credentialProvider function\\n' +\n                '4. Use API key authentication with ANTHROPIC_AWS_API_KEY or apiKey option\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }\n          if (\n            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n            errorMessage.includes('secretAccessKey')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                'Please ensure both credentials are provided.\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/anthropic-aws/src/anthropic-aws-provider.ts#L169-L205","documentation":"When SigV4 signing fails because the resolved AWS credentials lack an access key ID, the library re-throws this descriptive error listing the four supported ways to supply credentials. The original underlying error message is appended. It exists to turn opaque SigV4 failures into actionable guidance.","triggerScenarios":"`createAnthropicAws` resolves credentials (env, options, or provider) and the signing step throws an error whose message contains 'AWS_ACCESS_KEY_ID' or 'accessKeyId' — i.e., the access key is missing entirely.","commonSituations":"Deploying to an environment without AWS_ACCESS_KEY_ID set; typo'd env var names; passing `accessKey` instead of `accessKeyId` in options; Lambda/container role env not propagated.","solutions":["Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the environment.","Pass `accessKeyId`/`secretAccessKey` directly in createAnthropicAws options.","Supply a `credentialProvider` function that returns valid credentials.","Or use API-key auth: set ANTHROPIC_AWS_API_KEY env var or the `apiKey` option."],"exampleFix":"// before\nconst anthropic = createAnthropicAws({ baseURL: '...' }); // no credentials anywhere\n// after\nconst anthropic = createAnthropicAws({\n  accessKeyId: process.env.AWS_ACCESS_KEY_ID,\n  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,\n  region: 'us-east-1',\n});","handlingStrategy":"validation","validationCode":"if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) {\n  throw new Error('Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY before calling createAnthropicAws');\n}","typeGuard":"function hasEnvAwsCreds(env: NodeJS.ProcessEnv): env is NodeJS.ProcessEnv & { AWS_ACCESS_KEY_ID: string; AWS_SECRET_ACCESS_KEY: string } {\n  return Boolean(env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY);\n}","tryCatchPattern":"try {\n  const anthropic = createAnthropicAws(opts);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('AWS SigV4 authentication requires AWS credentials')) {\n    // supply env vars, options credentials, credentialProvider, or apiKey\n  }\n  throw e;\n}","preventionTips":["Validate AWS env vars at app startup.","Use one canonical credential source (env, options, or provider).","In serverless, confirm the execution role's env/credentials are attached.","Prefer IAM roles over static keys where possible."],"tags":["aws","authentication","sigv4","credentials","env"],"backgroundTag":"aws-credentials-missing","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}