{"record":{"id":"eebea23b1b879433","repo":"openai/openai-python","slug":"static-aws-credentials-require-non-empty-access-k","errorCode":null,"errorMessage":"Static AWS credentials require non-empty `access_key_id` and `secret_access_key` values.","messagePattern":"Static AWS credentials require non-empty `access_key_id` and `secret_access_key` values\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":436,"sourceCode":"\n    canonical_endpoint = (\n        _parse_bedrock_endpoint_hostname(configured_base_url.host) if configured_base_url is not None else None\n    )\n    resolved_endpoint: BedrockEndpoint = endpoint or (\n        canonical_endpoint[0] if canonical_endpoint is not None else \"mantle\"\n    )\n\n    normalized_profile = _normalize_optional_string(profile)\n    if profile is not None and normalized_profile is None:\n        raise OpenAIError(\"The Bedrock AWS `profile` must not be empty.\")\n\n    if (access_key_id is None) != (secret_access_key is None) or (session_token is not None and access_key_id is None):\n        raise OpenAIError(\n            \"Static AWS credentials require both `access_key_id` and `secret_access_key`. \"\n            \"A `session_token` may only be used with both.\"\n        )\n    if access_key_id is not None and (not access_key_id.strip() or not cast(str, secret_access_key).strip()):\n        raise OpenAIError(\"Static AWS credentials require non-empty `access_key_id` and `secret_access_key` values.\")\n    if session_token is not None and not session_token.strip():\n        raise OpenAIError(\"A static AWS `session_token` must not be empty when provided.\")\n\n    explicit_api_key = not isinstance(api_key, NotGiven) and api_key is not None\n    if explicit_api_key and (not isinstance(api_key, str) or not api_key.strip()):\n        raise OpenAIError(\"The Bedrock bearer credential must not be empty.\")\n    if explicit_api_key and token_provider is not None:\n        raise OpenAIError(\"The `api_key` and `token_provider` options are mutually exclusive. Configure only one.\")\n\n    explicit_bearer = explicit_api_key or token_provider is not None\n    aws_modes = sum(\n        (\n            access_key_id is not None,\n            normalized_profile is not None,\n            credential_provider is not None,\n        )\n    )\n    if aws_modes > 1:","sourceCodeStart":418,"sourceCodeEnd":454,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L418-L454","documentation":"Both parts of the static AWS credential pair were supplied, but at least one of `access_key_id` or `secret_access_key` is empty or whitespace-only. The SDK rejects blank credentials rather than sending a request that AWS would reject with a signature error.","triggerScenarios":"bedrock(access_key_id='', secret_access_key='x') or either value being '  ', typically from misread or truncated secret storage.","commonSituations":"Secrets pulled from a .env file with quoting issues, a vault lookup returning an empty string, or trailing whitespace corruption.","solutions":["Regenerate/retrieve the credentials and pass fully non-empty values","Log (safely, length only) or assert credential lengths before constructing the provider","If credentials come from env, ensure the variable names and values are actually set"],"exampleFix":"# before\nbedrock(access_key_id=os.getenv('AK', ''), secret_access_key=os.getenv('SK', ''))\n# after\nbedrock(access_key_id=os.environ['AWS_ACCESS_KEY_ID'], secret_access_key=os.environ['AWS_SECRET_ACCESS_KEY'])","handlingStrategy":"validation","validationCode":"if not (access_key_id or '').strip() or not (secret_access_key or '').strip():\n    raise ValueError('blank AWS credentials')","typeGuard":"def creds_are_nonempty(ak: str | None, sk: str | None) -> bool:\n    return bool((ak or '').strip() and (sk or '').strip())","tryCatchPattern":null,"preventionTips":["Assert credential lengths (not contents) at startup","Avoid defaulting secrets to empty strings"],"tags":["bedrock","aws-credentials","validation"],"backgroundTag":"empty-credential-value","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}