{"record":{"id":"f6c57327ce599838","repo":"vercel/ai","slug":"aws-credential-provider-failed-errormessage-p","errorCode":null,"errorMessage":"AWS credential provider failed: ${errorMessage}. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties.","messagePattern":"AWS credential provider failed: (.+?)\\. Please ensure your credential provider returns valid AWS credentials with accessKeyId and secretAccessKey properties\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/amazon-bedrock/src/amazon-bedrock-provider.ts","lineNumber":219,"sourceCode":"        const region = loadSetting({\n          settingValue: options.region,\n          settingName: 'region',\n          environmentVariableName: 'AWS_REGION',\n          description: 'AWS region',\n        });\n\n        // If a credential provider is provided, use it to get the credentials.\n        if (options.credentialProvider) {\n          try {\n            return {\n              ...(await options.credentialProvider()),\n              region,\n            };\n          } catch (error) {\n            // Error handling for credential provider failures\n            const errorMessage =\n              error instanceof Error ? error.message : String(error);\n            throw new Error(\n              `AWS credential provider failed: ${errorMessage}. ` +\n                'Please ensure your credential provider returns valid AWS credentials ' +\n                'with accessKeyId and secretAccessKey properties.',\n            );\n          }\n        }\n\n        // Enhanced error handling for SigV4 credential loading\n        try {\n          return {\n            region,\n            accessKeyId: loadSetting({\n              settingValue: options.accessKeyId,\n              settingName: 'accessKeyId',\n              environmentVariableName: 'AWS_ACCESS_KEY_ID',\n              description: 'AWS access key ID',\n            }),\n            secretAccessKey: loadSetting({","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/amazon-bedrock/src/amazon-bedrock-provider.ts#L201-L237","documentation":"When bedrockOptions is created with a custom credentialProvider (an AWS credential provider chain function), createAmazonBedrock resolves it at client creation. If the provider throws or returns something invalid, the SDK wraps the failure in this descriptive error, telling you the provider must yield accessKeyId and secretAccessKey. It surfaces misconfigured or failing credential resolution.","triggerScenarios":"Passing `bedrockOptions.credentialProvider` (or an equivalent custom credential function) that throws — e.g. reading a missing env var, expired SSO/token, network failure fetching instance-profile creds — or returning an object lacking accessKeyId/secretAccessKey.","commonSituations":"AWS_SESSION_TOKEN/keys not set in the environment; ECS/EC2 instance role unavailable; expired SSO session; a custom async provider that returns undefined; typo in credential property names.","solutions":["Log/inspect the underlying cause in the error message (it includes the original provider error) and fix that root cause","Verify your credential provider returns { accessKeyId, secretAccessKey, sessionToken? } — test it standalone","Check AWS env vars (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) or instance role configuration","Re-authenticate (aws sso login / refresh tokens) or fall back to the default AWS credential chain by omitting the custom provider"],"exampleFix":"// before\ncreateAmazonBedrock({ bedrockOptions: { region: 'us-east-1', credentialProvider: async () => ({ accessKeyId: process.env.KEY }) } });\n// after\ncreateAmazonBedrock({ bedrockOptions: { region: 'us-east-1', credentialProvider: async () => ({ accessKeyId: process.env.AWS_ACCESS_KEY_ID!, secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!, sessionToken: process.env.AWS_SESSION_TOKEN }) } });","handlingStrategy":"validation","validationCode":"const creds = await credentialProvider();\nif (!creds?.accessKeyId || !creds?.secretAccessKey) {\n  throw new Error('Credential provider returned incomplete AWS credentials');\n}","typeGuard":"function hasAwsCreds(c: unknown): c is { accessKeyId: string; secretAccessKey: string; sessionToken?: string } {\n  return typeof c === 'object' && c !== null &&\n    typeof (c as any).accessKeyId === 'string' && typeof (c as any).secretAccessKey === 'string';\n}","tryCatchPattern":"try {\n  const provider = createAmazonBedrock({ bedrockOptions: { region, credentialProvider } });\n} catch (e) {\n  // message includes the underlying provider failure — log and fall back to default chain\n}","preventionTips":["Verify env AWS credentials before app start (health check the provider)","Refresh SSO/token sessions proactively","Test custom credential providers standalone before wiring them in"],"tags":["bedrock","aws","credentials","configuration"],"backgroundTag":"aws-credentials-invalid","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}