{"record":{"id":"f2ee9a5ba1382469","repo":"alibaba/open-code-review","slug":"bedrock-could-not-authenticate-aws-credentials-ar","errorCode":null,"errorMessage":"bedrock could not authenticate: AWS credentials are expired or unavailable (%s): %w\n  run `aws sso login%s`, or refresh whichever credential source this profile uses","messagePattern":"bedrock could not authenticate: AWS credentials are expired or unavailable \\((.+?)\\): %w\n  run `aws sso login(.+?)`, or refresh whichever credential source this profile uses","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/llm/client.go","lineNumber":1124,"sourceCode":"\t\t\treturn fmt.Errorf(\"bedrock rejected the token in AWS_BEARER_TOKEN_BEDROCK (%s): %w\\n\"+\n\t\t\t\t\"  unset that variable to sign requests with SigV4 instead\", where, err)\n\t\t}\n\t\treturn fmt.Errorf(\"bedrock rejected an API-key header rather than a signature (%s): %w\\n\"+\n\t\t\t\"  no api_key applies to bedrock; this means a bearer token reached the request, not that a key is missing\", where, err)\n\tcase strings.Contains(msg, \"don't have access to the model\"):\n\t\treturn fmt.Errorf(\"bedrock has no access enabled for model %q (%s): %w\\n\"+\n\t\t\t\"  model access is granted per account and per region in the Bedrock console; an IAM policy alone does not enable it\", model, where, err)\n\tcase strings.Contains(msg, \"model identifier is invalid\"),\n\t\tstrings.Contains(msg, \"inference profile\") && strings.Contains(msg, \"not found\"):\n\t\treturn fmt.Errorf(\"bedrock rejected model %q (%s): %w\\n\"+\n\t\t\t\"  run `aws bedrock list-inference-profiles%s` to see what this account offers — IDs are account- and region-scoped, and a version suffix such as -v1:0 is invalid for the newer families\",\n\t\t\tmodel, where, err, listProfilesRegionArg(c.awsRegion))\n\t// Specific credential codes only. A bare \"expired\" would also claim an\n\t// expired TLS certificate is an SSO problem.\n\tcase strings.Contains(msg, \"ExpiredToken\"), strings.Contains(msg, \"ExpiredTokenException\"),\n\t\tstrings.Contains(msg, \"SSOProviderInvalidToken\"), strings.Contains(msg, \"InvalidGrantException\"),\n\t\tstrings.Contains(msg, \"NoCredentialProviders\"), strings.Contains(msg, \"failed to refresh cached credentials\"):\n\t\treturn fmt.Errorf(\"bedrock could not authenticate: AWS credentials are expired or unavailable (%s): %w\\n\"+\n\t\t\t\"  run `aws sso login%s`, or refresh whichever credential source this profile uses\", where, err, ssoLoginProfileArg(c.awsProfile))\n\t// \"not authorized to invoke this API operation\" is IAM's own wording, so it\n\t// belongs here rather than in the model-access branch above: the fix is a\n\t// policy change, not a console toggle.\n\tcase strings.Contains(msg, \"AccessDenied\"),\n\t\tstrings.Contains(msg, \"not authorized to invoke this API operation\"):\n\t\treturn fmt.Errorf(\"bedrock denied access to model %q (%s): %w\\n\"+\n\t\t\t\"  credentials resolved, so this is an authorization gap: the identity needs bedrock:InvokeModel on this model in this region, and the account needs model access enabled for it\", model, where, err)\n\t}\n\t// Everything else — ValidationException on max_tokens, a network reset, a\n\t// throttle — keeps the service's own wording. Guessing at a cause here would\n\t// send people after the wrong problem, which is the failure this function\n\t// exists to prevent.\n\treturn fmt.Errorf(\"bedrock request failed (%s): %w\", where, err)\n}\n\nfunc listProfilesRegionArg(region string) string {\n\tif region == \"\" {","sourceCodeStart":1106,"sourceCodeEnd":1142,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/internal/llm/client.go#L1106-L1142","documentation":"explainError (internal/llm/client.go:1124) matches specific AWS credential-failure codes — ExpiredToken, ExpiredTokenException, SSOProviderInvalidToken, InvalidGrantException, NoCredentialProviders, 'failed to refresh cached credentials' — and rewrites them as 'bedrock could not authenticate: AWS credentials are expired or unavailable'. Only exact credential codes match so unrelated 'expired' errors (e.g. TLS cert expiry) are not mislabeled.","triggerScenarios":"A bedrock-runtime InvokeModel call fails at the auth layer because cached SSO credentials expired (default 12h), an assume-role session token timed out, the credential-process returned an expired token, or no provider could produce credentials at request time.","commonSituations":"Next-day use of a machine whose `aws sso login` from yesterday lapsed; long-running CI job outliving temporary credentials; IAM Identity Center session revoked; STS session from env vars hit its 1-12h limit.","solutions":["Run `aws sso login` (append `--profile <profile>` if one is active) to mint fresh SSO credentials","Re-export fresh AWS_ACCESS_KEY_ID/SECRET/SESSION_TOKEN if using static temp credentials","Run `aws sts get-caller-identity` to confirm credentials now resolve and are valid","If a credential_process supplies tokens, extend its refresh or re-run it"],"exampleFix":"// before\n# SSO session from yesterday\nocr review ...  # ExpiredToken\n// after\naws sso login --profile work\nocr review ...  # succeeds","handlingStrategy":"retry","validationCode":"if err := exec.Command(\"aws\", \"sts\", \"get-caller-identity\").Run(); err != nil {\n    exec.Command(\"aws\", \"sso\", \"login\").Run()\n}","typeGuard":null,"tryCatchPattern":"_, err := cl.Call(ctx, messages)\nif err != nil && strings.Contains(err.Error(), \"could not authenticate\") {\n    if err2 := exec.Command(\"aws\", \"sso\", \"login\").Run(); err2 == nil {\n        return retryCall(ctx)\n    }\n    return err\n}","preventionTips":["Re-run `aws sso login` daily; SSO sessions expire (typically 12h)","Refresh temp credentials before jobs expected to outlive their TTL","Gate long CI jobs behind an `aws sts get-caller-identity` preflight","Monitor credential-process/SSO expiry and refresh proactively"],"tags":["aws","bedrock","expired-credentials","sso","authentication"],"backgroundTag":"aws-token-expired","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}