{"record":{"id":"e89d9b4049a01bea","repo":"vercel/ai","slug":"aws-sigv4-authentication-requires-both-aws-access-e89d9b","errorCode":null,"errorMessage":"AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Please ensure both credentials are provided.\nOriginal error: ${errorMessage}","messagePattern":"AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY\\. Please ensure both credentials are provided\\.\nOriginal error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/amazon-bedrock/src/anthropic/amazon-bedrock-anthropic-provider.ts","lineNumber":228,"sourceCode":"            error instanceof Error ? error.message : String(error);\n          if (\n            errorMessage.includes('AWS_ACCESS_KEY_ID') ||\n            errorMessage.includes('accessKeyId')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires AWS credentials. Please provide either:\\n' +\n                '1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables\\n' +\n                '2. Provide accessKeyId and secretAccessKey in options\\n' +\n                '3. Use a credentialProvider function\\n' +\n                '4. Use API key authentication with AWS_BEARER_TOKEN_BEDROCK or apiKey option\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }\n          if (\n            errorMessage.includes('AWS_SECRET_ACCESS_KEY') ||\n            errorMessage.includes('secretAccessKey')\n          ) {\n            throw new Error(\n              'AWS SigV4 authentication requires both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. ' +\n                'Please ensure both credentials are provided.\\n' +\n                `Original error: ${errorMessage}`,\n            );\n          }\n          throw error;\n        }\n      }, options.fetch);\n\n  // Wrap with Bedrock event stream to SSE transformer for streaming support\n  const fetchFunction = createAmazonBedrockAnthropicFetch(baseFetchFunction);\n\n  const getBaseURL = (): string =>\n    withoutTrailingSlash(\n      options.baseURL ??\n        `https://bedrock-runtime.${loadSetting({\n          settingValue: options.region,\n          settingName: 'region',","sourceCodeStart":210,"sourceCodeEnd":246,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/amazon-bedrock/src/anthropic/amazon-bedrock-anthropic-provider.ts#L210-L246","documentation":"The anthropic-sub-provider variant of error 121: the wrapped failure mentions AWS_SECRET_ACCESS_KEY or secretAccessKey, indicating the secret access key half of the SigV4 credential pair is missing. Both halves are required for signing.","triggerScenarios":"Calling createAmazonBedrockAnthropic with the access key ID present but the secret access key absent (env var unset, secretAccessKey option omitted, or credentialProvider omitting secretAccessKey), where the wrapped message mentions 'AWS_SECRET_ACCESS_KEY' or 'secretAccessKey'.","commonSituations":"Incomplete CI secrets configuration; only one variable set in .env; copying credential options between providers and dropping secretAccessKey; unlike the main provider, any unrecognized credential error is rethrown as-is (no wrapping).","solutions":["Ensure AWS_SECRET_ACCESS_KEY is set in the environment alongside AWS_ACCESS_KEY_ID.","Pass both accessKeyId and secretAccessKey options to createAmazonBedrockAnthropic.","If using a credentialProvider, verify it returns secretAccessKey too.","Check env var name typos in .env files and CI secret configuration."],"exampleFix":"// before\nAWS_ACCESS_KEY_ID=AKIA...   # secret missing in .env\n// after\nAWS_ACCESS_KEY_ID=AKIA...\nAWS_SECRET_ACCESS_KEY=wJalr...\nAWS_REGION=us-east-1","handlingStrategy":"validation","validationCode":"if (!process.env.AWS_SECRET_ACCESS_KEY && !opts?.secretAccessKey) {\n  throw new Error('AWS_SECRET_ACCESS_KEY (or secretAccessKey option) is required for Bedrock Anthropic SigV4 auth.');\n}","typeGuard":"function hasSecretKey(o: unknown): o is { secretAccessKey: string } {\n  return !!o && typeof (o as any).secretAccessKey === 'string' && (o as any).secretAccessKey.length > 0;\n}","tryCatchPattern":"try {\n  const anthropic = createAmazonBedrockAnthropic(options);\n} catch (error) {\n  if (error instanceof Error && error.message.includes('AWS_SECRET_ACCESS_KEY')) {\n    console.error('Missing AWS secret access key for Bedrock Anthropic provider.');\n  } else {\n    throw error;\n  }\n}","preventionTips":["Keep access key ID and secret access key configured as an atomic pair everywhere.","Diff .env.example against your deployment env before deploys.","Validate secretAccessKey presence when constructing credential objects in shared helpers."],"tags":["aws","authentication","bedrock","anthropic","missing-credentials"],"backgroundTag":"missing-aws-credentials","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}