{"id":"3c082f39ef1914e1","repo":"boto/boto3","slug":"unable-to-locate-credentials","errorCode":null,"errorMessage":"Unable to locate credentials","messagePattern":"Unable to locate credentials","errorType":"exception","errorClass":"NoCredentialsError","httpStatus":null,"severity":"critical","filePath":"boto3/session.py","lineNumber":93,"sourceCode":"                self._session.user_agent_extra += f\" {botocore_info}\"\n            else:\n                self._session.user_agent_extra = botocore_info\n            self._session.user_agent_name = 'Boto3'\n            self._session.user_agent_version = boto3.__version__\n\n        if profile_name is not None:\n            self._session.set_config_variable('profile', profile_name)\n\n        credentials_kwargs = {\n            \"aws_access_key_id\": aws_access_key_id,\n            \"aws_secret_access_key\": aws_secret_access_key,\n            \"aws_session_token\": aws_session_token,\n            \"aws_account_id\": aws_account_id,\n        }\n\n        if any(credentials_kwargs.values()):\n            if self._account_id_set_without_credentials(**credentials_kwargs):\n                raise NoCredentialsError()\n\n            if aws_account_id is None:\n                del credentials_kwargs[\"aws_account_id\"]\n\n            self._session.set_credentials(*credentials_kwargs.values())\n\n        if region_name is not None:\n            self._session.set_config_variable('region', region_name)\n\n        self.resource_factory = ResourceFactory(\n            self._session.get_component('event_emitter')\n        )\n        self._setup_loader()\n        self._register_default_handlers()\n\n    def __repr__(self):\n        return '{}(region_name={})'.format(\n            self.__class__.__name__,","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/boto/boto3/blob/c7b4afac237b976d48395d7523eaf7cec3a450b3/boto3/session.py#L75-L111","documentation":"Raised as botocore NoCredentialsError ('Unable to locate credentials') from Session.__init__ specifically when the caller passes aws_account_id to Session() without also providing aws_access_key_id and aws_secret_access_key. The _account_id_set_without_credentials guard returns True when account_id is set but the key/secret are missing, and boto3 fails fast rather than silently proceeding with an unauthenticated session.","triggerScenarios":"Constructing boto3.Session(aws_account_id='123456789012') without credentials; passing aws_account_id together with only one of access_key/secret_key; passing aws_account_id while relying on a profile/env that is not actually configured.","commonSituations":"Confusing aws_account_id (an account identifier) with actual credentials; partially migrating code that previously used explicit keys and adding account_id without the keys; expecting account_id alone to authenticate.","solutions":["Provide credentials alongside the account id: boto3.Session(aws_access_key_id=..., aws_secret_access_key=..., aws_account_id='123456789012').","If you meant to use a named profile, call boto3.Session(profile_name='myprofile') and drop aws_account_id.","Set credentials via environment (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or ~/.aws/credentials and omit aws_account_id from the Session call.","Do not pass aws_account_id unless you are also supplying explicit long-term credentials in the same call."],"exampleFix":"// before\nsession = boto3.Session(aws_account_id='123456789012')  # raises NoCredentialsError\n\n// after\nsession = boto3.Session(\n    aws_access_key_id=ACCESS_KEY,\n    aws_secret_access_key=SECRET_KEY,\n    aws_account_id='123456789012',\n)\n# or simply rely on a configured profile:\nsession = boto3.Session(profile_name='myprofile')","handlingStrategy":"validation","validationCode":"def make_session(aws_account_id=None, aws_access_key_id=None, aws_secret_access_key=None, **kw):\n    if aws_account_id is not None and (aws_access_key_id is None or aws_secret_access_key is None):\n        raise ValueError('aws_account_id requires explicit access key and secret')\n    return boto3.Session(aws_account_id=aws_account_id,\n                         aws_access_key_id=aws_access_key_id,\n                         aws_secret_access_key=aws_secret_access_key, **kw)","typeGuard":"def credentials_complete(aws_account_id, aws_access_key_id, aws_secret_access_key) -> bool:\n    if aws_account_id is None:\n        return True\n    return aws_access_key_id is not None and aws_secret_access_key is not None","tryCatchPattern":"from botocore.exceptions import NoCredentialsError\ntry:\n    session = boto3.Session(aws_account_id=acct)\nexcept NoCredentialsError:\n    session = boto3.Session(profile_name='default')  # fall back to configured profile","preventionTips":["Never pass aws_account_id without also passing explicit access key and secret.","Prefer profile_name or environment variables over inline credentials.","Run boto3.client('sts').get_caller_identity() early to fail fast on credential problems."],"tags":["boto3","session","credentials","authentication","config"],"analyzedSha":"c7b4afac237b976d48395d7523eaf7cec3a450b3","analyzedAt":"2026-08-04T20:35:51.598Z","schemaVersion":2}