run-llama/llama_index · error · ValueError

Please verify the provided credentials.

Error message

Please verify the provided credentials.

What it means

get_aws_client() wraps any exception raised while creating the boto3 session or client (bad keys, unknown profile, locked region, expired token) into ValueError('Please verify the provided credentials.') with the original exception chained via 'from'. It is a catch-all for session/client construction failures, not only literal credential rejection.

Source

Thrown at llama-index-core/llama_index/core/utilities/aws_utils.py:50

            session = boto3.Session(
                aws_access_key_id=aws_access_key_id,
                aws_secret_access_key=aws_secret_access_key,
                aws_session_token=aws_session_token,
                region_name=region_name,
            )
            client = session.client(service_name, config=config)  # type: ignore
        else:
            session = boto3.Session(profile_name=profile_name)
            if region_name:
                client = session.client(
                    service_name,
                    region_name=region_name,
                    config=config,  # type: ignore
                )
            else:
                client = session.client(service_name, config=config)  # type: ignore
    except Exception as e:
        raise ValueError("Please verify the provided credentials.") from (e)

    return client

View on GitHub (pinned to afd0fef371)

Solutions

1. Verify credentials first: aws sts get-caller-identity with the same profile/env.
2. Check that profile_name exists in ~/.aws/credentials (or ~/.aws/config) if you pass profile_name.
3. Inspect the chained exception (__cause__) - the original botocore error names the real problem (auth, region, profile).
4. Refresh expired session tokens or re-export AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY.

Example fix

# before
 client = get_aws_client('bedrock-runtime', profile_name='prod')  # profile missing -> ValueError

# after (define the profile, or pass keys explicitly)
 client = get_aws_client(
     'bedrock-runtime',
     aws_access_key_id=os.environ['AWS_ACCESS_KEY_ID'],
     aws_secret_access_key=os.environ['AWS_SECRET_ACCESS_KEY'],
     region_name='us-east-1',
 )

import os

def aws_creds_look_configured() -> bool:
    return bool(
        os.environ.get('AWS_PROFILE')
        or (os.environ.get('AWS_ACCESS_KEY_ID') and os.environ.get('AWS_SECRET_ACCESS_KEY'))
        or os.path.exists(os.path.expanduser('~/.aws/credentials'))
    )

def has_valid_aws_config(profile: str = None, keys: tuple = None) -> bool:
    if keys and keys[0] and keys[1]:
        return True
    if profile:
        import botocore.session
        s = botocore.session.get_session()
        return profile in s.full_config.get('profiles', {})
    return False

try:
    client = get_aws_client('bedrock-runtime', region_name=r, profile_name=p)
except ValueError as e:
    if 'verify the provided credentials' in str(e):
        log.error('AWS auth failed; chained cause: %s', e.__cause__)
        raise RuntimeError('Re-check AWS keys/profile/region') from e
    raise

When it happens

Trigger: Passing invalid aws_access_key_id/aws_secret_access_key, a profile_name that does not exist in ~/.aws/credentials, an unavailable region_name, or running with expired STS session tokens - anything that makes boto3.Session(...).client(...) raise.

Common situations: Rotated AWS keys not updated in env vars; missing named profile in containers; IMDS unavailable in CI while relying on instance metadata; STS tokens expired mid-run.

Related errors

• Please run `pip install boto3 botocore` to use AWS services.
• Did not find {key}, please add an environment variable `{env
• spec_functions must be of type: List[Union[str, Tuple[str, s
• Tool name cannot be None
• fn_schema is None.

AI-assisted analysis of run-llama/llama_index@afd0fef371 (2026-08-15). Data as JSON: /api/errors/f486144acc18e76e. Report an issue: GitHub.