continuedev/continue · error · Error

secretAccessKey is required for Bedrock API. Only found acce

Error message

secretAccessKey is required for Bedrock API. Only found accessKeyId

What it means

The Bedrock adapter's credential pairing guard: if config.env contains accessKeyId, secretAccessKey must also be set, otherwise the constructor throws. This prevents the AWS SDK from attempting requests with a half-configured static credential set, which would otherwise surface as cryptic signing errors.

Source

Thrown at packages/openai-adapters/src/apis/Bedrock.ts:72

/**
 * Interface for tool use state tracking
 */
interface ToolUseState {
  toolUseId: string;
  name: string;
  input: string;
}

export class BedrockApi implements BaseLlmApi {
  constructor(protected config: BedrockConfig) {
    if (config.env?.accessKeyId || config?.env?.secretAccessKey) {
      if (!config.env?.accessKeyId) {
        throw new Error(
          "accessKeyId is required for Bedrock API. Only found secretAccessKey",
        );
      }
      if (!config.env?.secretAccessKey) {
        throw new Error(
          "secretAccessKey is required for Bedrock API. Only found accessKeyId",
        );
      }
    }
  }

  async getCreds() {
    if (this.config?.env?.accessKeyId && this.config?.env?.secretAccessKey) {
      return {
        accessKeyId: this.config.env.accessKeyId,
        secretAccessKey: this.config.env.secretAccessKey,
      };
    }
    const profile = this.config.env?.profile ?? "bedrock";
    try {
      return await fromNodeProviderChain({
        profile: profile,
        ignoreCache: true,

View on GitHub (pinned to 5522c6f44c)

Solutions

Add the missing secretAccessKey next to accessKeyId in config.env
If you intended to use IAM roles or an AWS profile, remove accessKeyId entirely so the SDK credential chain is used
Verify the secret was loaded (not undefined/empty string) from your secret manager

Example fix

// before
{ provider: 'bedrock', env: { accessKeyId: 'AKIA...', region: 'us-east-1' } }

// after
{ provider: 'bedrock', env: { accessKeyId: 'AKIA...', secretAccessKey: 'wJalr...', region: 'us-east-1' } }

Defensive patterns

Strategy: validation

Validate before calling

const env = config.env ?? {};
if (env.accessKeyId && !env.secretAccessKey) {
  throw new Error('secretAccessKey missing: provide both AWS keys or neither (use IAM role)');
}

Type guard

const hasCompleteBedrockCreds = (env?: BedrockEnv): boolean =>
  Boolean(env?.accessKeyId && env?.secretAccessKey) ||
  (!env?.accessKeyId && !env?.secretAccessKey);

Try / catch

try { new BedrockApi(config); } catch (e) {
  if (e instanceof Error && e.message.includes('secretAccessKey is required')) {
    // load secret from secret manager and retry construction
  }
  throw e;
}

Prevention

Assert both keys are non-empty strings at config load time
Add a startup health check that constructs the Bedrock client before serving traffic

When it happens

Trigger: Constructing BedrockApi with config.env.accessKeyId set but config.env.secretAccessKey missing or empty.

Common situations: Secret redaction tooling stripping the secret but leaving the ID; env var name mismatches (SECRET_ACCESS_KEY vs secretAccessKey); partial secret rotation.

Related errors

AI-assisted analysis of continuedev/continue@5522c6f44c (2026-08-27). Data as JSON: /api/errors/37bf11f659aafb98. Report an issue: GitHub.