{"record":{"id":"e98f177e1e2bdca9","repo":"vercel/ai","slug":"aws-credential-provider-failed-errormessage-p-e98f17","errorCode":null,"errorMessage":"AWS credential provider failed: ${errorMessage}. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties.","messagePattern":"AWS credential provider failed: (.+?)\\. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/anthropic-aws/src/anthropic-aws-provider.ts","lineNumber":152,"sourceCode":"    ? createApiKeyFetchFunction(apiKey, options.fetch)\n    : createSigV4FetchFunction(async () => {\n        const region = loadSetting({\n          settingValue: options.region,\n          settingName: 'region',\n          environmentVariableName: 'AWS_REGION',\n          description: 'AWS region',\n        });\n\n        if (options.credentialProvider) {\n          try {\n            return {\n              ...(await options.credentialProvider()),\n              region,\n            };\n          } catch (error) {\n            const errorMessage =\n              error instanceof Error ? error.message : String(error);\n            throw new Error(\n              `AWS credential provider failed: ${errorMessage}. ` +\n                'Please ensure your credential provider returns valid AWS credentials ' +\n                'with accessKeyId and secretAccessKey properties.',\n            );\n          }\n        }\n\n        try {\n          return {\n            region,\n            accessKeyId: loadSetting({\n              settingValue: options.accessKeyId,\n              settingName: 'accessKeyId',\n              environmentVariableName: 'AWS_ACCESS_KEY_ID',\n              description: 'AWS access key ID',\n            }),\n            secretAccessKey: loadSetting({\n              settingValue: options.secretAccessKey,","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/anthropic-aws/src/anthropic-aws-provider.ts#L134-L170","documentation":"`createAnthropicAws` supports an optional `credentialProvider` function for AWS credentials. If that provider function throws or returns an invalid value while building the SigV4 signing credentials, the library wraps the failure in this error, preserving the original message and instructing that accessKeyId/secretAccessKey must be present.","triggerScenarios":"Passing `options.credentialProvider` to `createAnthropicAws({ credentialProvider })` where the async function throws (network/STS failure) or resolves to an object missing `accessKeyId`/`secretAccessKey`, during credential resolution for a request.","commonSituations":"Custom credential providers hitting expired SSO/token endpoints; returning `undefined` when no credentials found; fromIni/fromTemporaryCredentials misconfiguration; region-credential resolution races.","solutions":["Fix the credentialProvider so it resolves to `{ accessKeyId, secretAccessKey, sessionToken? }` — inspect the 'Original error' portion of the message.","Return null/undefined-safe behavior: if credentials can't be obtained, rely on default env credentials instead of throwing.","Test the provider in isolation: `await credentialProvider()` should yield valid credentials.","Check upstream token sources (SSO login, instance metadata) the provider depends on."],"exampleFix":"// before\ncreateAnthropicAws({ credentialProvider: async () => undefined });\n// after\ncreateAnthropicAws({\n  credentialProvider: async () => ({\n    accessKeyId: process.env.AWS_ACCESS_KEY_ID!,\n    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,\n  }),\n});","handlingStrategy":"validation","validationCode":"const creds = await credentialProvider();\nif (!creds || typeof creds.accessKeyId !== 'string' || typeof creds.secretAccessKey !== 'string') {\n  throw new Error('credentialProvider must return accessKeyId and secretAccessKey');\n}","typeGuard":"function hasAwsCreds(v: unknown): v is { accessKeyId: string; secretAccessKey: string; sessionToken?: string } {\n  return !!v && typeof v === 'object' && typeof (v as any).accessKeyId === 'string' && typeof (v as any).secretAccessKey === 'string';\n}","tryCatchPattern":"try {\n  const model = anthropicAws('claude-...');\n} catch (e) {\n  if (e instanceof Error && e.message.startsWith('AWS credential provider failed:')) {\n    console.error('Credential provider issue:', e.message);\n  }\n  throw e;\n}","preventionTips":["Unit-test your credentialProvider resolves valid credentials before deploying.","Return credentials synchronously available or handle async token refresh upstream.","Keep SSO/temporary token sources fresh.","Prefer built-in env credential resolution when a custom provider adds no value."],"tags":["aws","authentication","credentials","sigv4"],"backgroundTag":"aws-credentials-missing","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}