continuedev/continue · error · Error

accessKeyId is required for Bedrock API. Only found secretAc

Error message

accessKeyId is required for Bedrock API. Only found secretAccessKey

What it means

The Bedrock adapter requires AWS credentials to come in pairs: if either accessKeyId or secretAccessKey is set in config.env, both must be present. This constructor guard catches the specific case where only secretAccessKey was supplied, failing fast instead of letting the AWS SDK attempt unsigned/failed requests with a confusing downstream error.

Source

Thrown at packages/openai-adapters/src/apis/Bedrock.ts:67

    (getSecureID as any).uuid = uuidv4();
  }
  return `<!-- SID: ${(getSecureID as any).uuid} -->`;
}

/**
 * Interface for tool use state tracking
 */
interface ToolUseState {
  toolUseId: string;
  name: string;
  input: string;
}

export class BedrockApi implements BaseLlmApi {
  constructor(protected config: BedrockConfig) {
    if (config.env?.accessKeyId || config?.env?.secretAccessKey) {
      if (!config.env?.accessKeyId) {
        throw new Error(
          "accessKeyId is required for Bedrock API. Only found secretAccessKey",
        );
      }
      if (!config.env?.secretAccessKey) {
        throw new Error(
          "secretAccessKey is required for Bedrock API. Only found accessKeyId",
        );
      }
    }
  }

  async getCreds() {
    if (this.config?.env?.accessKeyId && this.config?.env?.secretAccessKey) {
      return {
        accessKeyId: this.config.env.accessKeyId,
        secretAccessKey: this.config.env.secretAccessKey,
      };
    }

View on GitHub (pinned to 5522c6f44c)

Solutions

1. Add the missing accessKeyId alongside secretAccessKey in config.env
2. Prefer IAM roles / the ambient AWS credential chain by omitting both env keys entirely if running on AWS infrastructure
3. Double-check for typos/case: it must be exactly accessKeyId and secretAccessKey

Example fix

// before
{ provider: 'bedrock', env: { secretAccessKey: 'wJalr...', region: 'us-east-1' } }

// after
{ provider: 'bedrock', env: { accessKeyId: 'AKIA...', secretAccessKey: 'wJalr...', region: 'us-east-1' } }

const env = config.env ?? {};
if (env.secretAccessKey && !env.accessKeyId) {
  throw new Error('accessKeyId missing: provide both AWS keys or neither (use IAM role)');
}

const hasCompleteBedrockCreds = (env?: BedrockEnv): boolean =>
  Boolean(env?.accessKeyId && env?.secretAccessKey) ||
  (!env?.accessKeyId && !env?.secretAccessKey);

try { new BedrockApi(config); } catch (e) {
  if (e instanceof Error && e.message.includes('accessKeyId is required')) {
    // fetch the key from secrets manager and retry, or drop both keys to use IAM
  }
  throw e;
}

When it happens

Trigger: Constructing BedrockApi with config.env containing secretAccessKey but not accessKeyId — e.g. a config where one key was deleted or never set while the other remained.

Common situations: Rotating AWS keys and only updating one value; copying config templates that have only one key filled in; misunderstanding that Bedrock in this adapter uses static keys rather than the default AWS credential chain when any env key is present.

Related errors

• secretAccessKey is required for Bedrock API. Only found acce
• AWS profile with name ${profile} not found in ~/.aws/credent
• AWS Bedrock rerank error (${(error as any).code}): ${error.m
• Error in BedrockReranker.rerank: ${error.message}
• Error in BedrockReranker.rerank: Unknown error occurred

AI-assisted analysis of continuedev/continue@5522c6f44c (2026-08-27). Data as JSON: /api/errors/f5aa1e4176292716. Report an issue: GitHub.