openai/openai-python · error · OpenAIError

Static AWS credentials require non-empty `access_key_id` and

Error message

Static AWS credentials require non-empty `access_key_id` and `secret_access_key` values.

What it means

Both parts of the static AWS credential pair were supplied, but at least one of `access_key_id` or `secret_access_key` is empty or whitespace-only. The SDK rejects blank credentials rather than sending a request that AWS would reject with a signature error.

Source

Thrown at src/openai/providers/bedrock.py:436

    canonical_endpoint = (
        _parse_bedrock_endpoint_hostname(configured_base_url.host) if configured_base_url is not None else None
    )
    resolved_endpoint: BedrockEndpoint = endpoint or (
        canonical_endpoint[0] if canonical_endpoint is not None else "mantle"
    )

    normalized_profile = _normalize_optional_string(profile)
    if profile is not None and normalized_profile is None:
        raise OpenAIError("The Bedrock AWS `profile` must not be empty.")

    if (access_key_id is None) != (secret_access_key is None) or (session_token is not None and access_key_id is None):
        raise OpenAIError(
            "Static AWS credentials require both `access_key_id` and `secret_access_key`. "
            "A `session_token` may only be used with both."
        )
    if access_key_id is not None and (not access_key_id.strip() or not cast(str, secret_access_key).strip()):
        raise OpenAIError("Static AWS credentials require non-empty `access_key_id` and `secret_access_key` values.")
    if session_token is not None and not session_token.strip():
        raise OpenAIError("A static AWS `session_token` must not be empty when provided.")

    explicit_api_key = not isinstance(api_key, NotGiven) and api_key is not None
    if explicit_api_key and (not isinstance(api_key, str) or not api_key.strip()):
        raise OpenAIError("The Bedrock bearer credential must not be empty.")
    if explicit_api_key and token_provider is not None:
        raise OpenAIError("The `api_key` and `token_provider` options are mutually exclusive. Configure only one.")

    explicit_bearer = explicit_api_key or token_provider is not None
    aws_modes = sum(
        (
            access_key_id is not None,
            normalized_profile is not None,
            credential_provider is not None,
        )
    )
    if aws_modes > 1:

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Regenerate/retrieve the credentials and pass fully non-empty values
2. Log (safely, length only) or assert credential lengths before constructing the provider
3. If credentials come from env, ensure the variable names and values are actually set

Example fix

# before
bedrock(access_key_id=os.getenv('AK', ''), secret_access_key=os.getenv('SK', ''))
# after
bedrock(access_key_id=os.environ['AWS_ACCESS_KEY_ID'], secret_access_key=os.environ['AWS_SECRET_ACCESS_KEY'])

if not (access_key_id or '').strip() or not (secret_access_key or '').strip():
    raise ValueError('blank AWS credentials')

def creds_are_nonempty(ak: str | None, sk: str | None) -> bool:
    return bool((ak or '').strip() and (sk or '').strip())

When it happens

Trigger: bedrock(access_key_id='', secret_access_key='x') or either value being ' ', typically from misread or truncated secret storage.

Common situations: Secrets pulled from a .env file with quoting issues, a vault lookup returning an empty string, or trailing whitespace corruption.

Related errors

• The Bedrock AWS `profile` must not be empty.
• Static AWS credentials require both `access_key_id` and `sec
• A static AWS `session_token` must not be empty when provided
• Bedrock authentication is ambiguous. Configure exactly one e
• The `api_key` argument must not be empty.

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/eebea23b1b879433. Report an issue: GitHub.