plandex-ai/plandex · error

failed to retrieve AWS credentials: %v

Error message

failed to retrieve AWS credentials: %v

What it means

loadAWSVars resolves the AWS credential chain via the AWS SDK's cfg.Credentials.Retrieve(). This error wraps any failure of that retrieval after a successful config load — meaning the SDK could build a config but could not produce a usable credential set (AccessKeyID/SecretAccessKey). It is thrown because model credentials resolution cannot proceed without valid AWS credentials to export as AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars.

Source

Thrown at app/cli/lib/model_credentials.go:335

	if err != nil {
		return "", err
	}

	return string(content), nil
}

func loadAWSVars(vars map[string]string) error {
	// disable IMDS to prevent slow request
	os.Setenv("AWS_EC2_METADATA_DISABLED", "true")

	cfg, err := config.LoadDefaultConfig(context.Background())
	if err != nil {
		return fmt.Errorf("failed to load AWS config: %v", err)
	}

	creds, err := cfg.Credentials.Retrieve(context.Background())
	if err != nil {
		return fmt.Errorf("failed to retrieve AWS credentials: %v", err)
	}

	vars["AWS_ACCESS_KEY_ID"] = creds.AccessKeyID
	vars["AWS_SECRET_ACCESS_KEY"] = creds.SecretAccessKey
	vars["AWS_REGION"] = cfg.Region
	if creds.SessionToken != "" {
		vars["AWS_SESSION_TOKEN"] = creds.SessionToken
	}

	return nil
}

func mergeAuthVars(dest, src map[string]string) {
	for k, v := range src {
		dest[k] = v
	}
}

View on GitHub (pinned to e2d772072e)

Solutions

1. Run `aws configure` or set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_REGION in the environment.
2. Verify AWS_PROFILE names an existing profile in ~/.aws/credentials or ~/.aws/config.
3. If using SSO/temporary credentials, re-authenticate (aws sso login) to refresh them.
4. Check the wrapped %v detail: 'SigV4' or provider-not-found messages point to which credential source failed.

Example fix

// before: relies on ambient SDK chain, fails on CI host
// after: ensure explicit credentials are present before calling
if os.Getenv("AWS_ACCESS_KEY_ID") == "" && os.Getenv("AWS_PROFILE") == "" {
    return fmt.Errorf("set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or AWS_PROFILE before resolving AWS credentials")
}

if os.Getenv("AWS_ACCESS_KEY_ID") == "" && os.Getenv("AWS_PROFILE") == "" && os.Getenv("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI") == "" {
    return fmt.Errorf("no AWS credential source configured (env, profile, or instance role)")
}

if err != nil {
    if strings.Contains(err.Error(), "failed to retrieve AWS credentials") {
        return fmt.Errorf("AWS credential resolution failed: %w — run `aws configure` or `aws sso login`", err)
    }
    return err
}

When it happens

Trigger: Calling ResolveProviderAuthVars → loadAWSVars when AWS SDK credential resolution fails: no credentials in env/files, invalid profile, expired SSO/session token, or the IMDS/identity provider returns an error.

Common situations: AWS_PROFILE points to a non-existent profile; ~/.aws/credentials missing or malformed; running on a machine without IMDS (non-EC2) with no static keys; expired temporary credentials or SSO login; AWS_CONFIG_FILE pointing at a broken file.

Related errors

• failed to load AWS config: %v
• no stored Claude credentials
• refresh failed - marshal: %w
• refresh failed - save: %w
• error checking API keys/credentials: %v

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/e7f3b749478fe7bf. Report an issue: GitHub.