mem0ai/mem0 · error · Error

AWS Bedrock requires both awsAccessKeyId and awsSecretAccess

Error message

AWS Bedrock requires both awsAccessKeyId and awsSecretAccessKey when any explicit credential is configured. Omit all credential fields to use the AWS default credential chain.

What it means

Thrown by the AWS Bedrock embedder constructor when credential config is partially filled in. The SDK refuses a mix like accessKeyId without secretAccessKey because the AWS client would silently fall back to the default credential chain, embedding data under an identity the caller never chose — a fail-fast security guard. Either provide BOTH awsAccessKeyId and awsSecretAccessKey (plus optional awsSessionToken), or provide none of them.

Source

Thrown at mem0-ts/src/oss/src/embeddings/aws_bedrock.ts:100

  constructor(config: EmbeddingConfig) {
    this.model = config.model || DEFAULT_MODEL;
    this.region = config.awsRegion || process.env.AWS_REGION || DEFAULT_REGION;
    this.embeddingDims = config.embeddingDims;

    const hasKeyPair = Boolean(
      config.awsAccessKeyId && config.awsSecretAccessKey,
    );
    const hasAnyCredential = Boolean(
      config.awsAccessKeyId ||
      config.awsSecretAccessKey ||
      config.awsSessionToken,
    );

    // Partially configured credentials would silently fall back to the default
    // chain, embedding under an identity the caller never chose.
    if (hasAnyCredential && !hasKeyPair) {
      throw new Error(
        "AWS Bedrock requires both awsAccessKeyId and awsSecretAccessKey when any explicit credential is configured. " +
          "Omit all credential fields to use the AWS default credential chain.",
      );
    }

    // Leaving `credentials` unset lets the AWS SDK resolve them from its
    // default chain: environment, shared config, SSO, or the instance role.
    if (hasKeyPair) {
      this.credentials = {
        accessKeyId: config.awsAccessKeyId!,
        secretAccessKey: config.awsSecretAccessKey!,
        ...(config.awsSessionToken && { sessionToken: config.awsSessionToken }),
      };
    }
  }

  private async loadSdk(): Promise<BedrockRuntimeModule> {
    try {

View on GitHub (pinned to 001c235229)

Solutions

1. Supply the full pair: { awsAccessKeyId, awsSecretAccessKey, ...(token && { awsSessionToken: token }) }
2. Or remove ALL credential fields from the embedder config to use the AWS default chain (env vars, shared config/SSO, instance role) — often the right choice on EC2/ECS/EKS
3. Check for typos/falsy values: an empty string still counts as 'not configured', so ensure both values are real strings

Example fix

// before
new Memory({
  embedder: { provider: 'aws_bedrock', config: { model: 'cohere.embed-english-v3', awsAccessKeyId, } },
});

// after - explicit static keys
new Memory({
  embedder: {
    provider: 'aws_bedrock',
    config: { model: 'cohere.embed-english-v3', awsAccessKeyId, awsSecretAccessKey },
  },
});
// or: omit all three fields and rely on the default credential chain

const cfg: BedrockConfig = { model: 'cohere.embed-english-v3', region };
if (cfg.awsAccessKeyId || cfg.awsSecretAccessKey || cfg.awsSessionToken) {
  if (!(cfg.awsAccessKeyId && cfg.awsSecretAccessKey)) {
    throw new Error('Provide BOTH awsAccessKeyId and awsSecretAccessKey, or none');
  }
}
// safe to construct the Memory/embedder now

type FullAwsCreds = { awsAccessKeyId: string; awsSecretAccessKey: string; awsSessionToken?: string };
const hasFullAwsCreds = (c: Partial<FullAwsCreds> = {}): c is FullAwsCreds =>
  typeof c.awsAccessKeyId === 'string' && c.awsAccessKeyId.length > 0 &&
  typeof c.awsSecretAccessKey === 'string' && c.awsSecretAccessKey.length > 0;

try {
  new Memory({ embedder: { provider: 'aws_bedrock', config: bedrockConfig } });
} catch (e) {
  if (e instanceof Error && e.message.includes('awsAccessKeyId and awsSecretAccessKey')) {
    // deterministic config error — complete the pair or drop all credential fields
    delete bedrockConfig.awsSessionToken; // etc., then rebuild config deliberately
    throw e;
  }
  throw e;
}

When it happens

Trigger: EmbeddingConfig with awsAccessKeyId set but awsSecretAccessKey missing/typo'd; awsSessionToken supplied alone (temporary-STS pattern copied incompletely); key names mistyped so one lands undefined (e.g. awsAccessKeyId vs aws_access_key_id).

Common situations: Rotating from static keys to IAM roles and deleting only one field; copying IAM env-var names (AWS_ACCESS_KEY_ID) into config expecting them to map; using STS temp credentials and forgetting the session token alone is not an identity.

Related errors

• Error getting embedding from AWS Bedrock: {e}
• Error getting embedding from AWS Bedrock model ${this.model}
• AWS Bedrock model ${this.model} returned no embedding for on
• The 'boto3' library is required. Please install it using 'pi
• Unknown provider_override '{explicit_provider}'. Valid provi

AI-assisted analysis of mem0ai/mem0@001c235229 (2026-08-15). Data as JSON: /api/errors/55d76e5adb8a3986. Report an issue: GitHub.