boto/boto3 · critical · NoCredentialsError

Unable to locate credentials

Error message

Unable to locate credentials

What it means

Raised as botocore NoCredentialsError ('Unable to locate credentials') from Session.__init__ specifically when the caller passes aws_account_id to Session() without also providing aws_access_key_id and aws_secret_access_key. The _account_id_set_without_credentials guard returns True when account_id is set but the key/secret are missing, and boto3 fails fast rather than silently proceeding with an unauthenticated session.

Source

Thrown at boto3/session.py:93

                self._session.user_agent_extra += f" {botocore_info}"
            else:
                self._session.user_agent_extra = botocore_info
            self._session.user_agent_name = 'Boto3'
            self._session.user_agent_version = boto3.__version__

        if profile_name is not None:
            self._session.set_config_variable('profile', profile_name)

        credentials_kwargs = {
            "aws_access_key_id": aws_access_key_id,
            "aws_secret_access_key": aws_secret_access_key,
            "aws_session_token": aws_session_token,
            "aws_account_id": aws_account_id,
        }

        if any(credentials_kwargs.values()):
            if self._account_id_set_without_credentials(**credentials_kwargs):
                raise NoCredentialsError()

            if aws_account_id is None:
                del credentials_kwargs["aws_account_id"]

            self._session.set_credentials(*credentials_kwargs.values())

        if region_name is not None:
            self._session.set_config_variable('region', region_name)

        self.resource_factory = ResourceFactory(
            self._session.get_component('event_emitter')
        )
        self._setup_loader()
        self._register_default_handlers()

    def __repr__(self):
        return '{}(region_name={})'.format(
            self.__class__.__name__,

View on GitHub (pinned to c7b4afac23)

Solutions

1. Provide credentials alongside the account id: boto3.Session(aws_access_key_id=..., aws_secret_access_key=..., aws_account_id='123456789012').
2. If you meant to use a named profile, call boto3.Session(profile_name='myprofile') and drop aws_account_id.
3. Set credentials via environment (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or ~/.aws/credentials and omit aws_account_id from the Session call.
4. Do not pass aws_account_id unless you are also supplying explicit long-term credentials in the same call.

Example fix

// before
session = boto3.Session(aws_account_id='123456789012')  # raises NoCredentialsError

// after
session = boto3.Session(
    aws_access_key_id=ACCESS_KEY,
    aws_secret_access_key=SECRET_KEY,
    aws_account_id='123456789012',
)
# or simply rely on a configured profile:
session = boto3.Session(profile_name='myprofile')

def make_session(aws_account_id=None, aws_access_key_id=None, aws_secret_access_key=None, **kw):
    if aws_account_id is not None and (aws_access_key_id is None or aws_secret_access_key is None):
        raise ValueError('aws_account_id requires explicit access key and secret')
    return boto3.Session(aws_account_id=aws_account_id,
                         aws_access_key_id=aws_access_key_id,
                         aws_secret_access_key=aws_secret_access_key, **kw)

def credentials_complete(aws_account_id, aws_access_key_id, aws_secret_access_key) -> bool:
    if aws_account_id is None:
        return True
    return aws_access_key_id is not None and aws_secret_access_key is not None

from botocore.exceptions import NoCredentialsError
try:
    session = boto3.Session(aws_account_id=acct)
except NoCredentialsError:
    session = boto3.Session(profile_name='default')  # fall back to configured profile

When it happens

Trigger: Constructing boto3.Session(aws_account_id='123456789012') without credentials; passing aws_account_id together with only one of access_key/secret_key; passing aws_account_id while relying on a profile/env that is not actually configured.

Common situations: Confusing aws_account_id (an account identifier) with actual credentials; partially migrating code that previously used explicit keys and adding account_id without the keys; expecting account_id alone to authenticate.

Related errors

• The '{service_name}' resource does not support an API versio
• The '{service_name}' resource does not exist. The available
• The following transfer config options are invalid when prefe
• Search path hits shape type {shape.type_name} from {item}
• Fileobj must implement read

AI-assisted analysis of boto/boto3@c7b4afac23 (2026-08-04). Data as JSON: /data/errors/3c082f39ef1914e1.json. Report an issue: GitHub.