can1357/oh-my-pi · error · AwsCredentialsError

Unable to resolve AWS credentials. Configure static environm

Error message

Unable to resolve AWS credentials. Configure static environment keys, web identity, an AWS profile, ECS credentials, or an EC2 instance role.

What it means

AIError.AwsCredentialsError (kind 'resolution') thrown by resolveFresh in packages/ai/src/providers/aws-credentials.ts after exhausting the entire credential resolution chain: static env keys, web identity (OIDC/IRSA), AWS profile (shared credentials/config files), ECS container credentials, and finally EC2 IMDSv2 instance role. It means the library could not construct any usable AWS credentials in the current environment.

Source

Thrown at packages/ai/src/providers/aws-credentials.ts:156

	// 2. Web identity.
	const webIdentityCreds = await readWebIdentityCredentials(region, signal, fetchImpl);
	if (webIdentityCreds) return webIdentityCreds;

	// 3. Profile (static, SSO, or credential_process).
	const profileCreds = await readProfileCredentials(profile, region, loadSharedConfig, signal, fetchImpl);
	if (profileCreds) return profileCreds;

	// 4. ECS/container credentials.
	const containerCreds = await readContainerCredentials(signal, fetchImpl);
	if (containerCreds) return containerCreds;

	// 5. EC2 IMDSv2.
	if ($env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== "true") {
		const imdsCreds = await readImdsCredentials(signal, fetchImpl);
		if (imdsCreds) return imdsCreds;
	}

	throw new AIError.AwsCredentialsError(
		`Unable to resolve AWS credentials. Configure static environment keys, web identity, ` +
			`an AWS profile, ECS credentials, or an EC2 instance role.`,
		"resolution",
	);
}

function readEnvCredentials(): ResolvedCredentials | undefined {
	const ak = $env.AWS_ACCESS_KEY_ID;
	const sk = $env.AWS_SECRET_ACCESS_KEY;
	if (!ak || !sk) return undefined;
	const token = $env.AWS_SESSION_TOKEN;
	return token
		? { accessKeyId: ak, secretAccessKey: sk, sessionToken: token }
		: { accessKeyId: ak, secretAccessKey: sk };
}

async function readIniFile(p: string): Promise<AwsIniFile | undefined> {
	try {

View on GitHub (pinned to 9690622007)

Solutions

1. Set static credentials in the environment: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_REGION/AWS_SESSION_TOKEN if applicable
2. Configure a named profile: run `aws configure` or create ~/.aws/credentials, and set AWS_PROFILE to it
3. If in ECS/EKS, ensure AWS_CONTAINER_CREDENTIALS_RELATIVE_URI or web identity (IRSA) is set up for the task/service account
4. If on EC2, ensure the instance has an IAM instance profile attached and AWS_EC2_METADATA_DISABLED is not 'true' (and IMDSv2 hop limit allows containers)
5. Verify which source you intended to use is actually reachable (e.g. curl the ECS metadata endpoint or IMDS) to find why it was skipped

Example fix

// before: no credentials in env
spawnProcess({ env: minimalEnv })
// after: export credentials before running
AWS_ACCESS_KEY_ID=AKIA... AWS_SECRET_ACCESS_KEY=... AWS_REGION=us-east-1 omp

function canResolveAwsCredentials(): boolean {
  const env = process.env;
  if (env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) return true;
  if (env.AWS_WEB_IDENTITY_TOKEN_FILE) return true;
  if (env.AWS_PROFILE || env.AWS_DEFAULT_PROFILE) return true;
  if (env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || env.AWS_CONTAINER_CREDENTIALS_FULL_URI) return true;
  if (env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== "true") return true; // IMDS may work
  return false;
}
if (!canResolveAwsCredentials()) throw new Error("No AWS credential source configured");

try {
  const result = await session.prompt(bedrockModel, messages);
} catch (err) {
  if (err instanceof AIError.AwsCredentialsError && err.message.startsWith("Unable to resolve AWS credentials")) {
    console.error("Configure AWS credentials: AWS_ACCESS_KEY_ID/SECRET, AWS_PROFILE, or an instance role.");
    process.exitCode = 1;
    return;
  }
  throw err;
}

When it happens

Trigger: Calling any AWS-backed model (e.g. Bedrock provider) when: AWS_ACCESS_KEY_ID/SECRET are unset, no AWS_WEB_IDENTITY_TOKEN_FILE, no matching ~/.aws/credentials or ~/.aws/config profile, AWS_CONTAINER_CREDENTIALS_* unset/unreachable, and either AWS_EC2_METADATA_DISABLED=true or the code is not on an EC2 instance (IMDS unreachable), all inside resolveFresh.

Common situations: Running locally without ever configuring AWS credentials; CI container with no role and metadata service blocked; ECS/EC2 task where IMDS is disabled or the hop limit blocks IMDSv2 tokens; wrong AWS_PROFILE name pointing at a nonexistent profile; running on-prem where none of the five sources exist.

Related errors

• profile
• Bedrock HTTP ${response.status}: ${errBody.slice(0, 1000)}
• Bedrock response has no body
• exceptionType
• code

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/5b11a329d8b80915. Report an issue: GitHub.