{"record":{"id":"f486144acc18e76e","repo":"run-llama/llama_index","slug":"please-verify-the-provided-credentials","errorCode":null,"errorMessage":"Please verify the provided credentials.","messagePattern":"Please verify the provided credentials\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"llama-index-core/llama_index/core/utilities/aws_utils.py","lineNumber":50,"sourceCode":"            session = boto3.Session(\n                aws_access_key_id=aws_access_key_id,\n                aws_secret_access_key=aws_secret_access_key,\n                aws_session_token=aws_session_token,\n                region_name=region_name,\n            )\n            client = session.client(service_name, config=config)  # type: ignore\n        else:\n            session = boto3.Session(profile_name=profile_name)\n            if region_name:\n                client = session.client(\n                    service_name,\n                    region_name=region_name,\n                    config=config,  # type: ignore\n                )\n            else:\n                client = session.client(service_name, config=config)  # type: ignore\n    except Exception as e:\n        raise ValueError(\"Please verify the provided credentials.\") from (e)\n\n    return client\n","sourceCodeStart":32,"sourceCodeEnd":53,"githubUrl":"https://github.com/run-llama/llama_index/blob/afd0fef371831f9bda13e5af7167cf4e981278ab/llama-index-core/llama_index/core/utilities/aws_utils.py#L32-L53","documentation":"get_aws_client() wraps any exception raised while creating the boto3 session or client (bad keys, unknown profile, locked region, expired token) into ValueError('Please verify the provided credentials.') with the original exception chained via 'from'. It is a catch-all for session/client construction failures, not only literal credential rejection.","triggerScenarios":"Passing invalid aws_access_key_id/aws_secret_access_key, a profile_name that does not exist in ~/.aws/credentials, an unavailable region_name, or running with expired STS session tokens - anything that makes boto3.Session(...).client(...) raise.","commonSituations":"Rotated AWS keys not updated in env vars; missing named profile in containers; IMDS unavailable in CI while relying on instance metadata; STS tokens expired mid-run.","solutions":["Verify credentials first: aws sts get-caller-identity with the same profile/env.","Check that profile_name exists in ~/.aws/credentials (or ~/.aws/config) if you pass profile_name.","Inspect the chained exception (__cause__) - the original botocore error names the real problem (auth, region, profile).","Refresh expired session tokens or re-export AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY."],"exampleFix":"# before\n client = get_aws_client('bedrock-runtime', profile_name='prod')  # profile missing -> ValueError\n\n# after (define the profile, or pass keys explicitly)\n client = get_aws_client(\n     'bedrock-runtime',\n     aws_access_key_id=os.environ['AWS_ACCESS_KEY_ID'],\n     aws_secret_access_key=os.environ['AWS_SECRET_ACCESS_KEY'],\n     region_name='us-east-1',\n )","handlingStrategy":"try-catch","validationCode":"import os\n\ndef aws_creds_look_configured() -> bool:\n    return bool(\n        os.environ.get('AWS_PROFILE')\n        or (os.environ.get('AWS_ACCESS_KEY_ID') and os.environ.get('AWS_SECRET_ACCESS_KEY'))\n        or os.path.exists(os.path.expanduser('~/.aws/credentials'))\n    )","typeGuard":"def has_valid_aws_config(profile: str = None, keys: tuple = None) -> bool:\n    if keys and keys[0] and keys[1]:\n        return True\n    if profile:\n        import botocore.session\n        s = botocore.session.get_session()\n        return profile in s.full_config.get('profiles', {})\n    return False","tryCatchPattern":"try:\n    client = get_aws_client('bedrock-runtime', region_name=r, profile_name=p)\nexcept ValueError as e:\n    if 'verify the provided credentials' in str(e):\n        log.error('AWS auth failed; chained cause: %s', e.__cause__)\n        raise RuntimeError('Re-check AWS keys/profile/region') from e\n    raise","preventionTips":["Run aws sts get-caller-identity in deploy scripts before starting the app.","Inspect the chained __cause__ for the true botocore failure (profile, region, token).","Rotate keys via a secrets manager; never hardcode, and alert on auth failure trends."],"tags":["aws","credentials","boto3","value-error"],"backgroundTag":null,"analyzedSha":"afd0fef371831f9bda13e5af7167cf4e981278ab","analyzedAt":"2026-08-15T05:42:58.429Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}