{"record":{"id":"e6c5a33bd972aaa8","repo":"vercel/ai","slug":"aws-credential-provider-failed-errormessage-p-e6c5a3","errorCode":null,"errorMessage":"AWS credential provider failed: ${errorMessage}. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties.","messagePattern":"AWS credential provider failed: (.+?)\\. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/amazon-bedrock/src/anthropic/amazon-bedrock-anthropic-provider.ts","lineNumber":180,"sourceCode":"    : createSigV4FetchFunction(async () => {\n        const region = loadSetting({\n          settingValue: options.region,\n          settingName: 'region',\n          environmentVariableName: 'AWS_REGION',\n          description: 'AWS region',\n        });\n\n        // If a credential provider is provided, use it to get the credentials.\n        if (options.credentialProvider) {\n          try {\n            return {\n              ...(await options.credentialProvider()),\n              region,\n            };\n          } catch (error) {\n            const errorMessage =\n              error instanceof Error ? error.message : String(error);\n            throw new Error(\n              `AWS credential provider failed: ${errorMessage}. ` +\n                'Please ensure your credential provider returns valid AWS credentials ' +\n                'with accessKeyId and secretAccessKey properties.',\n            );\n          }\n        }\n\n        try {\n          return {\n            region,\n            accessKeyId: loadSetting({\n              settingValue: options.accessKeyId,\n              settingName: 'accessKeyId',\n              environmentVariableName: 'AWS_ACCESS_KEY_ID',\n              description: 'AWS access key ID',\n            }),\n            secretAccessKey: loadSetting({\n              settingValue: options.secretAccessKey,","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/amazon-bedrock/src/anthropic/amazon-bedrock-anthropic-provider.ts#L162-L198","documentation":"In createAmazonBedrockAnthropic, when a custom credentialProvider option is supplied, the provider awaits it and merges its result into the credentials. If the provider function throws or returns something unusable, the failure is wrapped in this error explaining that a valid credential object with accessKeyId and secretAccessKey is expected.","triggerScenarios":"Passing `credentialProvider` to createAmazonBedrockAnthropic where the supplied async function throws (network failure, expired token fetch, SDK error) while being called to build SigV4 credentials.","commonSituations":"A credentialProvider that calls an external secrets service that is down; a provider returning null/undefined instead of { accessKeyId, secretAccessKey }; a typo causing an exception inside the provider function.","solutions":["Inspect the 'Original error' text inside this message to find why your credentialProvider threw.","Make the credentialProvider return an object with accessKeyId and secretAccessKey (plus optional sessionToken).","Add error handling/logging inside your credentialProvider before it reaches the SDK.","Test the credentialProvider standalone with await to confirm it resolves valid credentials."],"exampleFix":"// before\ncreateAmazonBedrockAnthropic({\n  credentialProvider: async () => secretsManager.getSecret(), // may return raw string\n});\n// after\ncreateAmazonBedrockAnthropic({\n  credentialProvider: async () => {\n    const secret = JSON.parse(await secretsManager.getSecret());\n    if (!secret.accessKeyId || !secret.secretAccessKey) {\n      throw new Error('secret missing accessKeyId/secretAccessKey');\n    }\n    return secret;\n  },\n});","handlingStrategy":"validation","validationCode":"const creds = await credentialProvider();\nif (!creds || typeof creds.accessKeyId !== 'string' || typeof creds.secretAccessKey !== 'string') {\n  throw new Error('credentialProvider must return { accessKeyId, secretAccessKey }.');\n}","typeGuard":"function isAwsCredentials(c: unknown): c is { accessKeyId: string; secretAccessKey: string; sessionToken?: string } {\n  return !!c && typeof (c as any).accessKeyId === 'string' && typeof (c as any).secretAccessKey === 'string';\n}","tryCatchPattern":"try {\n  const anthropic = createAmazonBedrockAnthropic({ credentialProvider });\n} catch (error) {\n  if (error instanceof Error && error.message.includes('credential provider failed')) {\n    console.error('credentialProvider threw:', error.message);\n    // fall back to static credentials or rethrow with context\n  } else {\n    throw error;\n  }\n}","preventionTips":["Unit-test your credentialProvider independently before wiring it into the SDK.","Wrap provider internals with try/catch and log before throwing.","Validate the returned shape (accessKeyId, secretAccessKey) inside the provider itself.","Add timeouts/retries for network-based secret fetching."],"tags":["aws","authentication","bedrock","credential-provider"],"backgroundTag":"invalid-credential-provider","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}