hatoo/oha · error · anyhow::Error

AWS credentials (--auth) required when using --aws-sigv4

Error message

AWS credentials (--auth) required when using --aws-sigv4

What it means

AWS SigV4 signing requires credentials, which oha reads from the --auth option when --aws-sigv4 is set. If --aws-sigv4 is provided but no --auth value exists, run() cannot build AwsSignatureConfig and bails before issuing requests.

Solutions

Add `--auth <access_key>:<secret_key>` alongside --aws-sigv4.
Supply an optional session token with --aws-session-token for temporary credentials.
If you expected env-var credentials, note oha requires them via --auth for SigV4.

Example fix

// before
oha --aws-sigv4 "aws:amz:us-east-1:s3" https://bucket.s3.amazonaws.com/
// after
oha --aws-sigv4 "aws:amz:us-east-1:s3" --auth AKIDEXAMPLE:secretKey https://bucket.s3.amazonaws.com/

Defensive patterns

Strategy: validation

Validate before calling

if process_args.iter().any(|a| a == "--aws-sigv4")
    && !process_args.iter().any(|a| a == "--auth") {
    eprintln!("--aws-sigv4 requires --auth access_key:secret_key");
}

Try / catch

match run(opts).await {
    Err(e) if e.to_string().contains("AWS credentials (--auth) required") => {
        eprintln!("Supply credentials via --auth <access_key>:<secret_key>");
    }
    Err(e) => return Err(e),
    Ok(v) => v,
}

Prevention

Remember oha does not read AWS_ACCESS_KEY_ID / AWS_PROFILE env vars for SigV4; use --auth.
Wrap invocation helpers so --aws-sigv4 always injects --auth.
Test the CLI invocation in CI before running long load tests.

When it happens

Trigger: Running oha with `--aws-sigv4 "aws:amz:region:service"` but omitting `--auth access_key:secret_key`.

Common situations: Users assume credentials are picked up from AWS_PROFILE / environment variables like AWS_ACCESS_KEY_ID; oha only reads them from --auth, so environment-based setups hit this bail.

Related errors

AI-assisted analysis of hatoo/oha@4efba2d113 (2026-09-09). Data as JSON: /api/errors/bb405811fc8e24c2. Report an issue: GitHub.

Appendix: source

Thrown at src/main.rs:366

    // Parse AWS credentials from basic auth if AWS signing is requested
    let aws_config = if let Some(signing_params) = opts.aws_sigv4 {
        if let Some(auth) = &opts.basic_auth {
            let parts: Vec<&str> = auth.split(':').collect();
            if parts.len() != 2 {
                anyhow::bail!("Invalid AWS credentials format. Expected access_key:secret_key");
            }
            let access_key = parts[0];
            let secret_key = parts[1];
            let session_token = opts.aws_session.take();
            Some(AwsSignatureConfig::new(
                access_key,
                secret_key,
                &signing_params,
                session_token,
            )?)
        } else {
            anyhow::bail!("AWS credentials (--auth) required when using --aws-sigv4");
        }
    } else {
        None
    };

    let parse_http_version = |is_http2: bool, version: Option<&str>| match (is_http2, version) {
        (true, Some(_)) => anyhow::bail!("--http2 and --http-version are exclusive"),
        (true, None) => Ok(http::Version::HTTP_2),
        (false, Some(http_version)) => match http_version.trim() {
            "0.9" => Ok(http::Version::HTTP_09),
            "1.0" => Ok(http::Version::HTTP_10),
            "1.1" => Ok(http::Version::HTTP_11),
            "2.0" | "2" => Ok(http::Version::HTTP_2),
            #[cfg(feature = "http3")]
            "3.0" | "3" => Ok(http::Version::HTTP_3),
            #[cfg(not(feature = "http3"))]
            "3.0" | "3" => anyhow::bail!(
                "Your Oha instance has not been built with HTTP/3 support. Try recompiling with the feature enabled."

View on GitHub (pinned to 4efba2d113)