openai/codex · error · AwsAuthError

AWS SDK config did not resolve a credentials provider

Error message

AWS SDK config did not resolve a credentials provider

What it means

After the aws_config default chain loads, AwsAuthContext::load requires the resulting SdkConfig to expose a credentials_provider; when credentials_provider() returns None, config.rs maps it to this error. It means the SDK found no credential source at all: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars, no ~/.aws/credentials, no usable named profile, and no container/IMDS endpoint. Non-retryable per is_retryable().

Source

Thrown at codex-rs/aws-auth/src/lib.rs:49

    pub headers: HeaderMap,
    pub body: Bytes,
}

/// Signed request parts returned to the caller.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct AwsSignedRequest {
    pub url: String,
    pub headers: HeaderMap,
}

/// Errors returned by credential loading or SigV4 signing.
#[derive(Debug, Error)]
pub enum AwsAuthError {
    #[error("AWS service name must not be empty")]
    EmptyService,
    #[error("AWS profile must be configured")]
    MissingProfile,
    #[error("AWS SDK config did not resolve a credentials provider")]
    MissingCredentialsProvider,
    #[error("AWS SDK config did not resolve a region")]
    MissingRegion,
    #[error("failed to load AWS profiles: {0}")]
    ProfileLoad(#[from] aws_config::profile::ProfileFileLoadError),
    #[error("failed to load AWS credentials: {0}")]
    Credentials(#[from] aws_credential_types::provider::error::CredentialsError),
    #[error("request URL is not a valid URI: {0}")]
    InvalidUri(#[source] http::uri::InvalidUri),
    #[error("failed to construct HTTP request for signing: {0}")]
    BuildHttpRequest(#[source] http::Error),
    #[error("request contains a non-UTF8 header value: {0}")]
    InvalidHeaderValue(#[source] http::header::ToStrError),
    #[error("failed to build signable request: {0}")]
    SigningRequest(#[source] aws_sigv4::http_request::SigningError),
    #[error("failed to build SigV4 signing params: {0}")]
    SigningParams(String),
    #[error("SigV4 signing failed: {0}")]

View on GitHub (pinned to 339751715c)

Solutions

1. Configure credentials: run aws configure, or export AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (plus AWS_SESSION_TOKEN for roles)
2. Verify the profile: aws configure list, and check ~/.aws/credentials contains the profile named in AwsAuthConfig.profile or AWS_PROFILE
3. On ECS/EC2, ensure the container/IMDS credential endpoints are reachable and instance metadata is enabled
4. For CI, inject credentials via secrets instead of relying on ambient discovery

Example fix

# before: nothing configured
$ codex-aws-call # -> MissingCredentialsProvider

# after
$ aws configure # writes ~/.aws/credentials
$ export AWS_PROFILE=default
$ codex-aws-call

fn has_ambient_aws_creds() -> bool {
    std::env::var_os("AWS_ACCESS_KEY_ID").is_some()
        || std::env::var_os("HOME")
            .map(|h| std::path::Path::new(&h).join(".aws/credentials").exists())
            .unwrap_or(false)
        || std::env::var_os("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI").is_some()
}

fn is_missing_credentials_provider(e: &AwsAuthError) -> bool {
    matches!(e, AwsAuthError::MissingCredentialsProvider)
}

match AwsAuthContext::load(config).await {
    Err(e) if matches!(e, AwsAuthError::MissingCredentialsProvider) => {
        // no credential source at all: surface setup instructions, do not retry (is_retryable() == false)
    }
    Err(AwsAuthError::Credentials(c)) => /* provider exists but failed: transient or expired */ (),
    other => other?,
}

When it happens

Trigger: Calling AwsAuthContext::load on a host with no AWS credentials configured anywhere: env vars unset, shared credentials file absent or lacking the named profile, AWS_PROFILE pointing at a profile with no creds, no AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, and IMDS (169.254.169.254) unreachable.

Common situations: Fresh dev machine or CI runner that never ran aws configure; minimal container images with no secrets mounted; AWS_PROFILE typo resolving to a nonexistent profile; networks blocking the EC2 metadata endpoint.

Related errors

• current-time request timed out after {}s
• invalid remote control account id header: {err}
• AWS service name must not be empty
• AWS profile must be configured
• AWS SDK config did not resolve a region

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/943474d79593b325. Report an issue: GitHub.