{"record":{"id":"e585957950672e15","repo":"vercel/ai","slug":"aws-sigv4-authentication-requires-both-aws-access","errorCode":null,"errorMessage":"AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Please ensure both credentials are provided.\nOriginal error: ${errorMessage}","messagePattern":"AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY\\. Please ensure both credentials are provided\\.\nOriginal error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/amazon-bedrock/src/amazon-bedrock-provider.ts","lineNumber":272,"sourceCode":"            error instanceof Error ? error.message : String(error);\n          if (\n            errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n            errorMessage.includes('accessKeyId')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                '3. Use a credentialProvider function\\n' +\n                '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }\n          if (\n            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n            errorMessage.includes('secretAccessKey')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                'Please ensure both credentials are provided.\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }\n          // Re-throw other errors as-is\n          throw error;\n        }\n      }, options.fetch);\n\n  const getHeaders = () => {\n    const baseHeaders = options.headers ?? {};\n    return withUserAgentSuffix(baseHeaders, `ai-sdk/amazon-bedrock/${VERSION}`);\n  };\n\n  const getAmazonBedrockRuntimeBaseUrl = (): string =>\n    withoutTrailingSlash(\n      options.baseURL ??","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/amazon-bedrock/src/amazon-bedrock-provider.ts#L254-L290","documentation":"A sibling of error 120: the wrapped failure mentions AWS_SECRET_ACCESS_KEY or secretAccessKey, meaning only the secret access key was missing (or the pair was incomplete). Bedrock SigV4 signing requires both an access key ID and a secret access key, so the provider explains both must be present.","triggerScenarios":"Calling createAmazonBedrock with AWS_ACCESS_KEY_ID set (or accessKeyId provided) but AWS_SECRET_ACCESS_KEY / secretAccessKey absent, such that the underlying credential error message contains 'AWS_SECRET_ACCESS_KEY' or 'secretAccessKey'.","commonSituations":"Setting only one env var in a shell profile or CI secret store; pasting the access key ID but not the secret into options; typos like AWS_SECRET_ACCESS_KEY_ID or AWS_SECRET_ACCES_KEY.","solutions":["Verify both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set in the environment.","Pass both accessKeyId and secretAccessKey in provider options — the pair, not just one.","Check for typos in env var names (e.g. AWS_SECRET_ACCESS_KEY).","If using a credentialProvider, ensure it returns an object containing both accessKeyId and secretAccessKey."],"exampleFix":"// before\nconst bedrock = createAmazonBedrock({ accessKeyId: 'AKIA...' });\n// after\nconst bedrock = createAmazonBedrock({\n  accessKeyId: 'AKIA...',\n  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,\n  region: 'us-east-1',\n});","handlingStrategy":"validation","validationCode":"if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) {\n  throw new Error('Both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be set for Bedrock SigV4.');\n}","typeGuard":"function isCompleteCredentialPair(c): c is { accessKeyId: string; secretAccessKey: string } {\n  return !!c && typeof (c as any).accessKeyId === 'string' && typeof (c as any).secretAccessKey === 'string';\n}","tryCatchPattern":"try {\n  const model = bedrock(modelId);\n} catch (error) {\n  if (error instanceof Error && error.message.includes('AWS_SECRET_ACCESS_KEY')) {\n    console.error('Secret access key missing; check env var name and value.');\n  } else {\n    throw error;\n  }\n}","preventionTips":["Set both env vars together in shell profiles, .env files, and CI secret config.","Grep .env files for AWS_SECRET_ACCESS_KEY typos before deploying.","When sharing credential options between providers, copy the full pair."],"tags":["aws","authentication","bedrock","missing-credentials"],"backgroundTag":"missing-aws-credentials","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}