{"record":{"id":"e7f3b749478fe7bf","repo":"plandex-ai/plandex","slug":"failed-to-retrieve-aws-credentials-v","errorCode":null,"errorMessage":"failed to retrieve AWS credentials: %v","messagePattern":"failed to retrieve AWS credentials: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/cli/lib/model_credentials.go","lineNumber":335,"sourceCode":"\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\treturn string(content), nil\n}\n\nfunc loadAWSVars(vars map[string]string) error {\n\t// disable IMDS to prevent slow request\n\tos.Setenv(\"AWS_EC2_METADATA_DISABLED\", \"true\")\n\n\tcfg, err := config.LoadDefaultConfig(context.Background())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to load AWS config: %v\", err)\n\t}\n\n\tcreds, err := cfg.Credentials.Retrieve(context.Background())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to retrieve AWS credentials: %v\", err)\n\t}\n\n\tvars[\"AWS_ACCESS_KEY_ID\"] = creds.AccessKeyID\n\tvars[\"AWS_SECRET_ACCESS_KEY\"] = creds.SecretAccessKey\n\tvars[\"AWS_REGION\"] = cfg.Region\n\tif creds.SessionToken != \"\" {\n\t\tvars[\"AWS_SESSION_TOKEN\"] = creds.SessionToken\n\t}\n\n\treturn nil\n}\n\nfunc mergeAuthVars(dest, src map[string]string) {\n\tfor k, v := range src {\n\t\tdest[k] = v\n\t}\n}\n","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/cli/lib/model_credentials.go#L317-L353","documentation":"loadAWSVars resolves the AWS credential chain via the AWS SDK's cfg.Credentials.Retrieve(). This error wraps any failure of that retrieval after a successful config load — meaning the SDK could build a config but could not produce a usable credential set (AccessKeyID/SecretAccessKey). It is thrown because model credentials resolution cannot proceed without valid AWS credentials to export as AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars.","triggerScenarios":"Calling ResolveProviderAuthVars → loadAWSVars when AWS SDK credential resolution fails: no credentials in env/files, invalid profile, expired SSO/session token, or the IMDS/identity provider returns an error.","commonSituations":"AWS_PROFILE points to a non-existent profile; ~/.aws/credentials missing or malformed; running on a machine without IMDS (non-EC2) with no static keys; expired temporary credentials or SSO login; AWS_CONFIG_FILE pointing at a broken file.","solutions":["Run `aws configure` or set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_REGION in the environment.","Verify AWS_PROFILE names an existing profile in ~/.aws/credentials or ~/.aws/config.","If using SSO/temporary credentials, re-authenticate (aws sso login) to refresh them.","Check the wrapped %v detail: 'SigV4' or provider-not-found messages point to which credential source failed."],"exampleFix":"// before: relies on ambient SDK chain, fails on CI host\n// after: ensure explicit credentials are present before calling\nif os.Getenv(\"AWS_ACCESS_KEY_ID\") == \"\" && os.Getenv(\"AWS_PROFILE\") == \"\" {\n    return fmt.Errorf(\"set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or AWS_PROFILE before resolving AWS credentials\")\n}","handlingStrategy":"try-catch","validationCode":"if os.Getenv(\"AWS_ACCESS_KEY_ID\") == \"\" && os.Getenv(\"AWS_PROFILE\") == \"\" && os.Getenv(\"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI\") == \"\" {\n    return fmt.Errorf(\"no AWS credential source configured (env, profile, or instance role)\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"failed to retrieve AWS credentials\") {\n        return fmt.Errorf(\"AWS credential resolution failed: %w — run `aws configure` or `aws sso login`\", err)\n    }\n    return err\n}","preventionTips":["Configure a static profile or SSO login before running flows that resolve AWS provider credentials.","Set AWS_REGION explicitly so region-dependent auth doesn't fail.","Refresh temporary/SSO credentials on a schedule before they expire.","On CI, provision credentials via OIDC role assumption rather than relying on IMDS."],"tags":["aws","credentials","cloud"],"backgroundTag":"aws-credentials-not-found","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}