{"record":{"id":"f6ca2a0e598ba9ce","repo":"BerriAI/litellm","slug":"oidc-token-could-not-be-retrieved-from-secret-mana-f6ca2a","errorCode":null,"errorMessage":"OIDC token could not be retrieved from secret manager.","messagePattern":"OIDC token could not be retrieved from secret manager\\.","errorType":"exception","errorClass":"AwsAuthError","httpStatus":401,"severity":"error","filePath":"litellm/llms/bedrock/base_aws_llm.py","lineNumber":832,"sourceCode":"            aws_role_name,\n            aws_session_name,\n        )\n\n        # get_secret() expands environment-variable references (an os.environ/<VAR>\n        # prefix, or a bare name matching an environment variable). Config-sourced\n        # references are expanded at load time, so such a reference reaching here is\n        # caller-supplied input; reject it rather than expanding a process-environment\n        # value for use as the token.\n        if aws_web_identity_token.startswith(\"os.environ/\") or aws_web_identity_token in os.environ:\n            raise AwsAuthError(\n                message=\"Invalid web identity token reference.\",\n                status_code=400,\n            )\n\n        oidc_token: Final = get_secret(aws_web_identity_token)\n\n        if oidc_token is None:\n            raise AwsAuthError(\n                message=\"OIDC token could not be retrieved from secret manager.\",\n                status_code=401,\n            )\n\n        sts_client_kwargs: Final = self._build_sts_client_kwargs(\n            aws_sts_endpoint=aws_sts_endpoint,\n            ssl_verify=ssl_verify,\n        )\n\n        with tracer.trace(\"boto3.client(sts)\"):\n            sts_client: Final = boto3.client(\"sts\", **sts_client_kwargs)\n\n        # The session policy is an IAM PERMISSION CEILING — effective\n        # permissions are the intersection of the role's identity policies\n        # and this policy. Any action not listed here is silently denied\n        # even when the IAM role grants it. So every Bedrock route we\n        # support needs a matching action statement, or it 403s on OIDC\n        # auth only (static creds + IRSA take other code paths).","sourceCodeStart":814,"sourceCodeEnd":850,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/llms/bedrock/base_aws_llm.py#L814-L850","documentation":"Error \"OIDC token could not be retrieved from secret manager.\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/llms/bedrock/base_aws_llm.py:832 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the secret manager configuration so the OIDC token can be retrieved."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}